sh[.]azurestaticprovider[.]net

Posts referencing this indicator

• Popular node-ipc npm Package Infected with Credential Stealer

  Bootstrap DNS resolver used by the malware for exfiltration, designed to look like legitimate Azure traffic.

  2026-05-19