Skip to content
.ca
Home
Posts
Engagements
Recaps
IOCs
Detections
About
Search posts and IOCs
sign in
Loading…
indicator
url
hxxps://xijkwm2[.]s3[.]ap-southeast-1[.]amazonaws[.]com/baoxi[.]vbs
copy defanged
copy refanged (live)
First seen
2026-06-24
Last seen
2026-06-24
Sightings
1
Posts referencing this indicator
A VBScript campaign distributed through WhatsApp deploying RMM software
K
Kaspersky
URL used to download secondary VBScript payload.
2026-06-24
https://xijkwm2.s3.ap-southeast-1.amazonaws.com/baoxi.vbs · URL · cyfar.ca
