indicatorurl
hxxps://tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/
- First seen
- 2026-05-14
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
Dead-drop C2 URL (ICP canister) polled by the Python implant to fetch secondary payload URLs.