Confident: Block these.

Release 20261012T180322Z · built 2026-10-12 18:03 UTC · valid until 2026-10-15 18:03 UTC

Reported as malicious by two or more independent research teams, and passed every safety check and validation step. This is our strongest recommendation: if you have not blocked these yet, start here. Check your own traffic first all the same.

Copy and paste

One box per type, ready to paste into your tool. Click in a box, press Ctrl+A (Cmd+A on a Mac), then copy. These are live values, not defanged. Check them against your own traffic first.

Domains 13

Block each one with its subdomains.

add-passkey.com
awqhnjewqjkl.icu
fdn4apex.com
js-mirror.com
keysyncos.com
myconnectkey.com
npm-cache.com
oskeyconnect.com
oskeysync.com
passkeyhelpdesk.com
portalsetuphub.com
pypi-get.com
secure-passkey.com

URLs 1

For tools that match full URLs. Never widen to the whole host.

https://npm-cache.com:443/router

SHA-256 file hashes 30

For endpoint protection and EDR tools.

05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69
0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864
22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67
332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17
38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d
43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa
44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250
4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc
54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101
6f079c1e2655ed391fb8f0b6bfafa126acf905732b5554f38a9d32d0b9ca407d
74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27
8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b
8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f
918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593
92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a
9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84
9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1
9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4
bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad
be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c
d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2
ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c
f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd
f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1
fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2
fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf
fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb
fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68

SHA-1 file hashes 1

For tools that take SHA-1.

4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6

MD5 file hashes 1

For tools that take MD5 (Defender does not).

cf903e4a1629aa0582fd0363b5786676

Details and sources

46 indicators. Numbers in the Sources column link to the original reports.

Indicator (defanged)	Type	Reported as	Block scope	First reported	List	Sources
`fc96a04c615847f0fb1391f04d9d1aac7f78ddfb7d459168df0a4172b98354e2`	SHA-256 hash	Malware file	That file	2026-09-09	Confident	Huntress, Microsoft Threat Intelligence [1] [2]
`fdn4apex[.]com`	Domain	Malware download	Domain and subdomains	2026-08-28	Confident	Censys, Elastic Security Labs [1] [2]
`add-passkey[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`keysyncos[.]com`	Domain	Phishing	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`myconnectkey[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`oskeyconnect[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`oskeysync[.]com`	Domain	Phishing	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`passkeyhelpdesk[.]com`	Domain	Phishing	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`portalsetuphub[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`secure-passkey[.]com`	Domain	Listed by researchers	Domain and subdomains	2026-08-06	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence [1] [2]
`awqhnjewqjkl[.]icu`	Domain	Command and control	Domain and subdomains	2026-08-06	Confident	Elastic Security Labs, Unit 42, Zscaler ThreatLabz [1] [2] [3]
`js-mirror[.]com`	Domain	Command and control	Domain and subdomains	2026-08-04	Confident	Microsoft Threat Intelligence, Unit 42 [1] [2]
`npm-cache[.]com`	Domain	Command and control	Domain and subdomains	2026-08-04	Confident	Elastic Security Labs, Microsoft Threat Intelligence, Unit 42 +1 [1] [2] [3] [4]
`pypi-get[.]com`	Domain	Command and control	Domain and subdomains	2026-08-04	Confident	Microsoft Threat Intelligence, Unit 42 [1] [2]
`54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668`	SHA-256 hash	Malware file	That file	2026-08-04	Confident	Elastic Security Labs, Microsoft Threat Intelligence, Unit 42 [1] [2] [3]
`9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc`	SHA-256 hash	Malware file	That file	2026-08-04	Confident	Elastic Security Labs, Microsoft Threat Intelligence, Unit 42 [1] [2] [3]
`fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb`	SHA-256 hash	Malware file	That file	2026-08-04	Confident	Elastic Security Labs, Microsoft Threat Intelligence, Unit 42 [1] [2] [3]
`hxxps://npm-cache[.]com:443/router`	URL	Command and control	That exact URL	2026-08-04	Confident	Microsoft Threat Intelligence, Unit 42, Zscaler ThreatLabz [1] [2] [3]
`918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593`	SHA-256 hash	Malware file	That file	2026-07-31	Confident	Microsoft Threat Intelligence, Zscaler ThreatLabz [1] [2]
`be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c`	SHA-256 hash	Malware file	That file	2026-07-31	Confident	Google Threat Intelligence / Mandiant, Microsoft Threat Intelligence, Zscaler ThreatLabz [1] [2] [3]
`cf903e4a1629aa0582fd0363b5786676`	MD5 hash	Malware file	That file	2026-07-30	Confident	CISA Cybersecurity Advisories, Securelist [1] [2]
`0db36a04d304ad96f9e6f97b531934594cd95a5cea9ff2c9af249201089dc864`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`332ba2f0297dfb1599adecc3e9067893e7cf243aa23aedce4906a4c480574c17`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`38bd137c672bd58d08c4f0502f993a6561e2c3411773d1ae57ee0151a0a9d11d`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`43dc62cef52ebdd69e79f10015b3e13890f26c058325c0ff139c70f8d8eadcfa`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`44f4f7aca7f1d9bfdaf7b3736934cbe19f851a707662f8f0b0c49b383e054250`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`74882085db2088356ed7f72f01e0404a0a98cda88ef56fb15ce74c1f36b26d27`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`8808c794c24367438f183e4be941876f1d3ecd0c8d2eb43b10d2380841d2283b`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`9cf029daca89523d917dafed0568d11d00e45ec96b5b90b4a1f7fd4018c7da84`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`9e4a658e6d831c9e9bdfe11884a75b7c64812ed0a80e8495ddf6b316505acac1`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`b19e06da580cf91691eda066ac9ee4b09c6e5dc26c367af12660fe1f9306eec4`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`bc3b44154518c5794ce639108e7b9c5fecb0c189607a26de1aaed518d890c7ad`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`d4a7e9f107fe40c1a5d0139c6c6e25bf6bf57f61feff090bee28f476bb3cc3c2`	SHA-256 hash	Malware file	That file	2026-05-22	Confident	Check Point Research, Unit 42 [1] [2]
`22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67`	SHA-256 hash	Malware file	That file	2026-04-20	Confident	Check Point Research, Microsoft Threat Intelligence [1] [2] [3]
`fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68`	SHA-256 hash	Malware file	That file	2026-04-20	Confident	Check Point Research, Microsoft Threat Intelligence [1] [2]
`4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc`	SHA-256 hash	Malware file	That file	2026-04-10	Confident	Group-IB, Infoblox Threat Intel [1] [2]
`ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c`	SHA-256 hash	Malware file	That file	2026-04-01	Confident	Elastic Security Labs, Microsoft Threat Intelligence, NVISO Labs [1] [2] [3]
`617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101`	SHA-256 hash	Malware file	That file	2026-03-31	Confident	Elastic Security Labs, Huntress, Microsoft Threat Intelligence +2 [1] [2] [3] [4] [5]
`92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a`	SHA-256 hash	Malware file	That file	2026-03-31	Confident	Elastic Security Labs, Huntress, Microsoft Threat Intelligence +2 [1] [2] [3] [4] [5] [6]
`f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd`	SHA-256 hash	Malware file	That file	2026-03-31	Confident	Huntress, Microsoft Threat Intelligence, NVISO Labs +1 [1] [2] [3] [4]
`fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf`	SHA-256 hash	Malware file	That file	2026-03-31	Confident	Elastic Security Labs, Huntress, Microsoft Threat Intelligence +2 [1] [2] [3] [4] [5]
`4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6`	SHA-1 hash	Malware file	That file	2026-01-23	Confident	ESET WeLiveSecurity, Elastic Security Labs [1] [2] [3]
`05eac3663d47a29da0d32f67e10d161f831138e10958dcd88b9dc97038948f69`	SHA-256 hash	Malware file	That file	2026-01-13	Confident	Check Point Research, Unit 42 [1] [2]
`6f079c1e2655ed391fb8f0b6bfafa126acf905732b5554f38a9d32d0b9ca407d`	SHA-256 hash	Malware file	That file	2025-12-22	Confident	Seqrite, Unit 42 [1] [2]
`8e07beb854f77e90c174829bd4e01e86779d596710ad161dbc0e02a219d6227f`	SHA-256 hash	Malware file	That file	2025-12-15	Confident	Microsoft Threat Intelligence, Sekoia [1] [2]
`f9dd0b57a5c133ca0c4cab3cca1ac8debdc4a798b452167a1e5af78653af00c1`	SHA-256 hash	Malware file	That file	2025-10-22	Confident	Check Point Research, Elastic Security Labs [1] [2]