🎯 Web Service

The items that name it 7

• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSX
  writeup2026-10-02It is written here as Web Service: Dead Drop Resolver.

  Use of Solana transaction memos as a dead-drop to dynamically resolve follow-on payload infrastructure

• Phishing Abuses RMM Tools for Persistent Access
  writeup2026-09-29

  Multiple cloud-hosted web services used throughout the delivery and command-and-control infrastructure.

• Socket: Malicious Extensions Drain Axiom Trade and Padre Crypto Sessions
  writeup2026-09-12

  Use of Vercel app deployments as C2/exfiltration infrastructure

• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeup2026-09-01

  npm registry used as a dead-drop resolver by a related tenant to publish current live backend domains

• Socket: 737 Malicious VPN/Proxy Chrome Extensions Impersonate 66 Brands
  writeup2026-08-12

  Runtime fetches to config/links.json and manual-redirect chasing via resolveAssetsOrigin()/fetchLandingLinks() to relocate destinations without shipping an update

• Socket: Operation Muck and Load
  writeup2026-07-16It is written here as Web Service: Dead Drop Resolver.

  Encrypted payload-location data retrieved from Pastebin, Rlim, Muck-themed domains, YouTube, Instagram, Telegram, Google Docs, GitCode using marker string LastW.

• Socket: Famous Chollima Targets PHP Developers via Compromised Packagist Package
  writeup2026-06-01It is written here as Web Service: Dead Drop Resolver.

  TRON and Aptos blockchain transaction data used as payload pointers/dead drop for retrieving encrypted payload material