indicatorurl
hxxps://viewdocuemnt151y-dataqjqhg[.]emp01825[.]workers[.]dev/api/device/start
- First seen
- 2026-06-24
- Last seen
- 2026-06-24
- Sightings
- 1
Posts referencing this indicator
- EvilTokens: How “Ghost” Code Threatens US and European Businesses
Endpoint used by EvilTokens to request the Microsoft device user code
