{
 "report": "2026-10-steam-lure",
 "indicators": [
  {
   "type": "domain",
   "value": "steamcomrnuunity.com",
   "role": "Phishing landing page (QR destination)",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "steamcomrnunuity.online",
   "role": "Steam typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "staemcommunity.com.ru",
   "role": "Steam typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "steamqowered.shop",
   "role": "Steam store typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "steamcommunlty.site",
   "role": "Steam typosquat (about 30 subdomains)",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "gifting-raduga.biz",
   "role": "Gift activation phish",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "rtgift.com",
   "role": "Gift-card phish",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "f1shh.at",
   "role": "Phishing pages and malware C2",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "8909451279.f1shh.at",
   "role": "Phishing page `/client` and C2 for three samples",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "koooolda.shop",
   "role": "Malware C2",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "njrlmwtgpk.shop",
   "role": "Electron fake-Steam page (first of the three target hosts). Behind Cloudflare, DGA-tagged",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "fakefake.shop",
   "role": "Electron fake-Steam page; C2 for fake-cheat droppers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "pulse-keys.store",
   "role": "Electron fake-Steam page",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "dojiner.at",
   "role": "Malware C2",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "cheatdetector.shop",
   "role": "Related to the same server; role unconfirmed",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "csfly.pro",
   "role": "Game-themed lure on the same servers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "rustway.pro",
   "role": "Game-themed lure on the same servers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "rustplus.store",
   "role": "Game-themed lure on the same servers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "drop2.run",
   "role": "Co-hosted on the same servers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "falcnox.pro",
   "role": "Co-hosted on the same servers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "orehvpn.cc",
   "role": "Co-hosted on the same servers",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "steamcomnunltiy.com",
   "role": "Steam typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "steemcommunity.bet",
   "role": "Steam typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "steamcomnmunity.site",
   "role": "Steam typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "domain",
   "value": "stencomnuti.com",
   "role": "Steam typosquat",
   "category": "Phishing and C2 domains"
  },
  {
   "type": "url",
   "value": "https://steamcomrnuunity.com/code/2035922",
   "role": "QR destination in the lure",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://steamcomrnuunity.com/code/647829",
   "role": "Lure code",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://steamcomrnuunity.com/code/876809",
   "role": "Lure code",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://steamcomrnuunity.com/code/3454765444",
   "role": "Lure code",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://8909451279.f1shh.at/client",
   "role": "Phishing page loaded by the WebView2 program",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://njrlmwtgpk.shop/2123223",
   "role": "Electron fake-Steam page (first target host)",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://koooolda.shop/43413",
   "role": "C2 for the Steam client hijacker (`3d2b12f8`)",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://fakefake.shop/3253523",
   "role": "Electron payload page",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://fakefake.shop/config.txt",
   "role": "Seen on VirusTotal",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://pulse-keys.store/6887",
   "role": "Electron payload page",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://pulse-keys.store/steamkeys.com",
   "role": "Seen on VirusTotal",
   "category": "URLs"
  },
  {
   "type": "url",
   "value": "https://pulse-keys.store/app/games",
   "role": "Seen on VirusTotal",
   "category": "URLs"
  },
  {
   "type": "ip",
   "value": "62.60.226.75",
   "role": "FEMO IT Solutions, AS214351 / Phishing host and malware C2",
   "category": "IP addresses"
  },
  {
   "type": "ip",
   "value": "192.162.199.140",
   "role": "FEMO IT Solutions, AS214351 / Phishing host and typosquats",
   "category": "IP addresses"
  },
  {
   "type": "ip",
   "value": "172.86.88.161",
   "role": "RouterHosting / Cloudzy, AS14956 / Casino farm (offline when checked)",
   "category": "IP addresses"
  },
  {
   "type": "sha256",
   "value": "f27af032b01fc6982ff936086eaeeaa6a517a9b3fad74939ee4e50729c9e3b2c",
   "role": "WebView2 relay shell (analysed) / 40",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "dd5675e5c0e335ac53c81104ccc4eed58180f566970c083d417662c8e4156e2e",
   "role": "WebView2 relay shell / 40",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "5675b9a830e4b89e0ce31f23107467afdd727e38a38f5a72894ad5d4287be755",
   "role": "WebView2 relay shell / 36",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "234c7abcc91b42473c00183c12e7dd0f81126344b21973c2ff68d346d589a9ed",
   "role": "WebView2 relay shell / 34",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "a8e5ce0d903b179b2a53f0d21c54cbd009590cc6683a4ba5fda32aa33818627a",
   "role": "WebView2 relay shell / 20",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "0edcc9061d88c6f0c24ff35d0a2e22387636461db707020d3a70b23cbd523579",
   "role": "WebView2 relay shell / 19",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "224538f4d2f58ac89a5939edcfbcafdb5956aa02320cec5aec1e5ce6f1482468",
   "role": "WebView2 relay shell / 17",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "b0da0012552f229de3a01d1775fa37a343d69a32bf6ef33b0170e54e13df621c",
   "role": "WebView2 relay shell / 14",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "0394a4bbce427fc134363fd805142bc6051a1046042473f7113dbbb43e86ef52",
   "role": "WebView2 relay shell / 13",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "0e302546468e0accc4ed98d60aed83246d671acdaf0728d9ac2cfe48c118615b",
   "role": "WebView2 relay shell / 9",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "3d2b12f8523f92e0e91f3041e2658b98ee07896c54043922ca73c7c17f19cdff",
   "role": "Steam client hijacker (persistent; replaces `steam.exe`) / 3",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "c86286508d09cd68ff0a38b7db9b6f76fd353a9a009402c9c512a568e439b46b",
   "role": "NSIS + Electron installer (analysed) / 0",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "64465b46cfd9ad484c42b9b313401268ee863dd7b18844aa69db95517fdd4d99",
   "role": "NSIS + Electron installer / 2",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "6b3bb3be9661c3db2227a03f6ac528e3518f5e9ede0ce2aece9ba548ba40e971",
   "role": "NSIS + Electron installer / 0",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "a0eb8249298c1119fa1ba389d41d61e32f98f8422e61f9cf360ff7e918f4f303",
   "role": "NSIS + Electron installer / 0",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "b136e43ba624c154d60a52c993963096ddb431e67a120bb993dcf8cf8d291b9e",
   "role": "NSIS + Electron installer / 0",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "6942177c4eae47027e058bdadec8d82afb4826ea4e459ac0e5bc938038f417cc",
   "role": "`app.asar` from the installer / n/a",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "3bf8b47b12d4630495baf611033c80ac6d31c27117b8a0409048d52b8e6260f7",
   "role": "`main.jsc` bytecode payload / n/a",
   "category": "Malware (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "b260dc769ba2217a8ec88d170657cbe02342581154e08d0761f352d7f3b171ee",
   "role": "Phantom injector.exe / 29",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "25b345198484ae19da39df949611a35d3f3dba322d143bd756dd63b0544e47a1",
   "role": "Arcane.exe / 7",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "3ec862f9261aa03da6a3f5dccadff6fa35744e55ba0b4ca46c33108b869f922f",
   "role": "Hyper.exe / 31",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "4925be7c14208711e4c87157882bffcd11b795f488e8cd018174be0cddc82950",
   "role": "Mira.exe / 32",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "ff64f52a8156eb3450cf2e3050a85a3916148c46558740aaee76d6f6baabeb90",
   "role": "Covchec.exe / 29",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "2dade25f2aebb8a8db39d237571c5e0ad3d2740d62c94a41e063a5bd169b6708",
   "role": "Covchec.exe / 31",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "d51c15fbe931a2e1812296e22454a4662eb82e645f2364b6b0976f373ba7084d",
   "role": "Visor.exe / 30",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "717792d839571b90143d81749d0e5d533bcf2e0906e76a1960661e4799252c9c",
   "role": "Division.exe / 32",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "8da77e9e7e1a67188d37d7679cdcdaf1136b2b81e359e2e19ceb41ebec8a32f0",
   "role": "Permanent.exe / 19",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "67370caee481a3b36b545fd5fec22fb9e532ba340243b98b752d3544b0b9c2cd",
   "role": "Extreme.exe / 26",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "84f3921ce27d2dc34669cb5574788ec53d1d55fee96a9ab6168a5e4a654d34a7",
   "role": "Unicore.exe / 29",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "a9ec9aeb42ab370854802c0be40b0d1f3f0081e5a970779f380f0dd63326d710",
   "role": "Exlab.exe / 32",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "cd489e5972e77a4a51fe59891607ab81e75e248992e2a1bfa4daaaddb78da0c8",
   "role": "SMG Software.exe / 31",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "e8e8a489bb9a2dbb32c3e9e53fe347dcf29ffe57d858f8d4b43dbee081787f3c",
   "role": "Evicted Macros.exe / 26",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "706f3cf2746a6e47571a0d87883aeed6368942492c01a7c8dcd8abeeabfdce05",
   "role": "Medusa Lite.exe / 32",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "9decb9f1ffc8f088f7875abd451c3aeb33e0bd0d0650f0da18f3456205c50cb2",
   "role": "Fecurity.exe / 25",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "c2fa1e8989a5a9654f1db44100305a80a4ac25ac2d285ef04f8107f640437f6d",
   "role": "Mason.exe / 31",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "1af0554341779498e5598d9b31c7dcfc29569653d4c60a846bcda59ac794b083",
   "role": "(no name) / 0",
   "category": "Fake game-cheat droppers (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "8357109d570f6f7d477ba4cbd56298b432764c756dcbde8b8e9157cd64065828",
   "role": "Steam gift-card QR lure",
   "category": "Lure images (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "e3758d3b1b5f748867c75e3bd4002adf5d4cba7fe0594933650116b77b7f0931",
   "role": "Fake MrBeast post",
   "category": "Lure images (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "0b2996ad895ebbb6b130133068ddf578f16dab98a8da2ab6c676f90db4b2215e",
   "role": "Casino bonus page",
   "category": "Lure images (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "80238cf2e142c90ed6c5ca9da2e4ce97a515fc436d116136027120ca8b3b9a6d",
   "role": "Fake withdrawal",
   "category": "Lure images (SHA-256)"
  },
  {
   "type": "sha256",
   "value": "3a69aae43bd9c990a04a2e3f0e780de58f840fc8ec3e65cd2b86581dd09a5027",
   "role": "Fake wallet receipt",
   "category": "Lure images (SHA-256)"
  },
  {
   "type": "promo code",
   "value": "CASH",
   "role": "Promo code",
   "category": "Other"
  },
  {
   "type": "scam persona",
   "value": "honestly5434",
   "role": "Scam persona",
   "category": "Other"
  },
  {
   "type": "fake project name",
   "value": "\"Vyro\"",
   "role": "Fake project name",
   "category": "Other"
  },
  {
   "type": "affiliate ids",
   "value": "626, 1207",
   "role": "Affiliate IDs",
   "category": "Other"
  },
  {
   "type": "google site verification",
   "value": "me9ZlrZsMXh3rGKrjmph4_LMHQaPgsy3QXb3b_buz_M",
   "role": "Google site verification",
   "category": "Other"
  },
  {
   "type": "favicon mmh3",
   "value": "1775797633",
   "role": "Favicon mmh3",
   "category": "Other"
  },
  {
   "type": "jarm",
   "value": "21d19d00021d21d00042d43d00000091f9827a8676a9d9f27d421962a09b5d",
   "role": "JARM",
   "category": "Other"
  },
  {
   "type": "electron package name",
   "value": "steam-login-app (author \"Valve Corporation\", version 10.50.87.67)",
   "role": "Electron package name",
   "category": "Other"
  },
  {
   "type": "relay kit api prefix",
   "value": "DyNaM1c (plus the action name, XOR-encrypted with the affiliate cookie's secret)",
   "role": "Relay kit API prefix",
   "category": "Other"
  },
  {
   "type": "relay kit actions",
   "value": "visit, doLogin, submitCode, checkConfirmations",
   "role": "Relay kit actions",
   "category": "Other"
  },
  {
   "type": "webview2 bridge",
   "value": "window.steamm (methods win.min/drag/resize/close, fs.readText/writeText, http.request, shell.open)",
   "role": "WebView2 bridge",
   "category": "Other"
  },
  {
   "type": "hijacker artifacts",
   "value": "steam.orig.exe / steam.live.exe; process title svchost.exe",
   "role": "Hijacker artifacts",
   "category": "Other"
  }
 ]
}