hxxp://lemurinfo[.]com/content/fragments/combine.html?fragmentOneContents=

Posts referencing this indicator

• Using threat modeling and prompt injection to audit Comet

  Attacker-controlled endpoint used to exfiltrate combined fragment data, specifically stolen Gmail contents, via URL parameters.

  2026-05-13