From Three Phishing Emails to a Connected Investigation

Three recruitment messages started the investigation: a Nodit-themed lure received on 22 June 2026, a D2S AI Trade lure on 21 July and a Category Labs lure on 22 July, and their links led to clipboard manipulation and editor-extension delivery routes, while the collected material also included a mutable GitLab resolver, two targeting databases and administration frontend source.

Some connections are direct code references. The copy handler calls a command builder, the editor task invokes an installer, and sender configuration separately names the database files, while other relationships rely on historical infrastructure observations or compatible functions in separately recovered software, yet no endpoint or backend record reconstructs a complete infection and collection sequence.

A copy handler, an editor task, and a passworded archive

In the browser route, a verification page changes the command placed on the clipboard, and its copy handler passes a nonce, phrase and operating-system value to a builder that adds installation logic while preserving the promised VERIFY- output. The first-stage download location comes from the page’s origin, allowing the same frontend to work on different lure hosts.

The repository route uses project task configuration to reach a VSIX installer, and the Google Update Support extension reads deployment settings from workspace configuration, so the package and its settings jointly determine the configured destination. The VSIX also carries native agents and encrypted Windows components, and authenticated decryption exposed a Windows Node/Python pipeline inside the extension; similar COM elevation-builder code occurs in the ClickFix collector, linking the two implementations. Their entry conditions differ: one depends on a candidate pasting a command into a terminal, while the other depends on editor task permissions and extension installation.

Proofpoint’s earlier report documents the extension route and Windows architecture. I recovered the same mechanisms in the package, including the configuration and process-building code.

The message-header review also identified Mailgun VERP envelope behavior for the D2S and Category Labs lures, while the Nodit message used its own domain in the envelope. The messages arrived through a forwarding service, so the original sending IP was not preserved, and the forwarding service and its relay addresses belong to the recipient’s mail path, not the campaign infrastructure. Personal addresses and envelope identifiers are omitted. The message evidence is summarized in E01.

Figure 1. Code references, configuration values and historical observations connect the recovered components.

Resolver edits point to two July server generations

The GitLab resolver separates destination settings from deployed payloads, and the retained history records changes to config.json and a separate config-alt.json file, but no retained payload references the latter; on 13 July, the referenced config.json set changed to api.cklomino[.]ink and api.dsfmot[.]xyz (E07). A payload hash alone cannot identify which configuration a client fetched.

A certificate naming api.cklomino[.]ink and a Subtensor sign-in panel observed at 207.241.172[.]222 connect that address to the historical service, and passive DNS and related research-service records supplied further pivots. These observations date service associations. Exclusive ownership of the address remains unverified. Client refresh behavior and connections after the configuration change remain unknown.

The late-July lures added another dated origin picture. On 23 and 24 July, 170.205.31[.]182 served the 3dscenebox[.]online lure and was associated with several reactivated lure domains; separately, certificate and passive-scan records linked the api.aazdias[.]ink and api.fallaazdis[.]ink store pair to 207.241.172[.]222, and E20 and E21 document the limits of those observations; the public bundle lacks the complete provider responses.

The older 23.137.105[.]75:5173 C2 observation belongs to an earlier generation, and a 22 July analyst note also records an Express response from 23.137.105[.]75:3000 and a CORS preflight allowing X-Guard-Platform, a header present in the recovered installer. Route existence and data receipt remain unknown: the note records only the 404 and preflight responses, and the probe transcript is not in the public evidence PDFs, while these July observations have not been refreshed since 24 July.

Starting artifact	Connection	Result
Received message	Recruitment URL	A delivered lure
Lure source	Copy handler calls command builder	Clipboard substitution and first-stage retrieval logic
Project configuration	Task and deployment settings	Extension installation path and configured parameters
Held collector	GitLab configuration URL	Mutable destination lookup
Sender configuration	Paths to two SQLite pools	Stored targeting material available to the sender
Administration frontend	Imports and API route references	Repository monitoring and wallet-management controls
ECHOES repository history	Four retained archive revisions	Changes to retrieval and persistence

The historical indicator reference collects the exact hostnames, paths and IP observations behind these links, with the evidence type and uncertainty recorded for each, and the artifact reference gives file hashes for the samples and archive revisions used in the pivots.

Separate contact pools and wallet fields

I recovered the targeting tools and wallet interfaces separately from the delivery chain, and their code describes preparation and intended use of collected data. Their integration remains unverified. The harvester searches repositories by star range and extracts author and committer addresses from branch histories, and sender configuration names two SQLite pools containing 142,365 distinct stored address strings associated with 27,698 repository values (E08). The counts quantify the available targeting material. Missing send logs and endpoint records prevent a count of recipients contacted or systems compromised.

The separately recovered rms-platform frontend contains mail views, repository availability monitoring and wallet import, preview and claim controls, and its mnemonic and ColdKey fields correspond to material selected by the collectors. That connection describes compatible data and functions. No recovered backend establishes that the targeting pools, mail system and wallet workflow were integrated or used successfully.

ECHOES preserves a different delivery branch. Four archive revisions show repeated artwork and staging, changing retrieval destinations and a VBS persistence addition, but its final PowerShell payload was unavailable through the unauthenticated routes examined, so whether it deployed the Go agent, the JavaScript collector or another payload remains unknown.

Three leads that fell apart on review

Several connections that looked strong in the middle of the investigation fell apart when they were checked properly; keeping them would have put somebody else’s infrastructure or name into the indicator set.

The persona accounts claimed roles at real crypto projects and displayed testimonials attributed to founders and executives, and at first some project domains and authors’ social handles were treated as possible operator infrastructure because they shared registrar, hosting and privacy-registration patterns with known sites.

The projects proved to be established companies with years of public history; their testimonials used real people’s names and handles, with no sign those people had written them, and the evidence identifies the companies and people as targets of impersonation. Their domains do not belong on a certificate watch list. Their names are omitted here. The shared hosting fingerprint was common. A budget registrar, popular host and privacy service are not enough to connect a domain to an operation.

Most of this domain family was registered in September 2025 and hosted by the same budget provider, and it was first treated as an earlier campaign phase, then reclassified the same day as probable operator infrastructure with high confidence. Closer inspection found at least six beauty and cosmetics domains, about forty subdomains per domain named for invented Brazilian influencers, numbered bulk-mail sender subdomains and spam classifications. The sites formed an affiliate-marketing spam operation. They had no recruitment lure, ClickFix page or malware.

The “dedicated host” claim came from one passive-DNS source with limited coverage, and another address used by the family hosted unrelated sites for years; the association was withdrawn before any indicator set or referral was filed.

The 3D-artist lead in Part 7 came from a new cover story. The harvester shows no separate sourcing channel for that audience. The operator-associated Solana wallets active into 2026 led through one pass-through account to a program-owned account holding thousands of SOL and handling hundreds of transactions each day. The trace found no victim funds.

The broader repository sweep returned two signature matches. Reading the files showed both were benign.

The July report and an October continuation lead

I checked later reporting against the retained artifacts for further connections; Ben Hopkins’s UNK_DeadDrop investigation first appeared on 23 July, before this case’s evidence cutoff, and was updated in August. The update places api.chestsoi[.]ink in the GitLab dead-drop sequence. That hostname does not appear in the resolver history retained here, so it remains a reported lead rather than a captured indicator.

An October developer-lure report describes a launcher with four markers also found in this corpus: deepfake_guard, a POSIX double-fork, /var/tmp/.kdm.XXXXXX and /guard-launcher-result, and it names taikotalent[.]xyz, the paired hosts api.gaganata[.]ink and api.fallgganata[.]ink, and sample SHA-256 c7c22e322c17bda8198257342d4034af6250a5c433242461b870879ba9aa285d.

The shared markers make this a probable continuation lead. But the article, gist, repository and follow-up all trace to one reporting chain, and the sample was not independently recovered; the hosts and hash therefore remain leads, not verified indicators.