Two malware domains. Twenty-one hosts behind them.

We did not create this cluster. It was already there, one of 80,000 the platform already holds. We opened one of them. That writeup is the technical paper, published with the all-audience cut. This is the next door.

Inside the corpus of 1,585, two domains were classified as malware delivery. Out of 1,585, that number is almost an insult.

Both are ClickFix. A fake check tells the victim to copy a command and run it. If we had stopped at those two indicators of compromise, we would have filed a small malware note and moved on. We did not stop. The trail led through a cloaker, a telemetry client, ten command hosts, and eleven stagers. Twenty-one hosts behind two doors.

The doors are the IOC. The hallway is the IoPA: already wired, already filtering the scanners that would have turned it into an IOC, already part of the same nexus as the German bank lures and the ticket shops. Waiting for the lure to look malicious is waiting until the filter has done its job. The hallway is staging. The paste is Execution. IoPAs on the cloaker and the curl hosts are useful before Initial Access and Delivery succeed.

The August 2026 domain list is the IoPA CSV on Malanta's public GitHub. The full indicator set, including the hashes and the cloaker site ids, is in the technical paper.

The victim sees a job board

openwork[.]life is the macOS path. It presents a developer job board. The malicious step starts only when the visitor tries to interact. A fake reCAPTCHA then tells them to open Spotlight, launch Terminal, paste a command, and press Return. The component ships in 13 languages. We read that polish as a reusable product, not a lure written for one campaign. That is a judgment from the build. It is not a vendor name.

nova-trade[.]world is the Windows face, a fake trading app. worldherald[.]life joined the cluster in the two weeks after 25 Aug 2026 and was already wired to the same cloaker. A fake newspaper. Same gate. New lure. The relationship to the corpus is the cloaker, not the theme of the page. That is what "one of 80,000 already grouped" looks like when a new name lights up: the cluster relationship is already there. The page theme is decoration.

Eight hundred and eighty-nine bytes decide if you are a victim

Before the fake CAPTCHA, a script decides whether you see it. It disguises itself as analytics. It runs a persistent A/B test between two delivery variants. It filters crawlers. The block list includes GPTBot, ChatGPT, ClaudeBot, Anthropic, and CCBot.

The gate file, t.js, is 889 bytes. A matching user agent hits return. No telemetry. No payload. Everyone else gets the next step. The file derives that next infrastructure dynamically, makes it look like analytics, and stores the A/B branch in localStorage so the same browser stays on the same variant.

That is how an IOC gets delayed. A security scanner on the block list receives a harmless page and files a harmless verdict. The cloaker, the stager, and the payload host are already up. Pre-Attack Intelligence is reading those hosts while the lure still looks like a job board.

The next file, t.4b1009ff6c3f.js, is about 2.2 KB and is not heavily obfuscated. It builds a SHA-256 visitor id, writes it to a 365-day cookie and to localStorage, and posts one visit event per calendar day to /collect, with the URL, the referrer, and that id. Unique visitors. Acquisition source. Two branches. The operator is measuring the lure the way a product team measures a landing page.

The A/B test is also a disguise

The two payloads are about 167 KB and 165 KB. Both carry the same multilingual fake reCAPTCHA and the same fkrc- classes. We read fkrc as fake reCAPTCHA: fkrc-checkbox, fkrc-checkbox-window, fkrc-captcha-logo, fkrc-agreement-box, fkrc-im-not-a-robot, fkrc-error-container.

The obfuscation is not the same. Variant A opens with a rotating string array. Variant B uses a different accessor and an inline Base64 alphabet. Our assessment is that the test is at least partly there to vary the obfuscation, not only the lure. Two hashes. One hallway.

openwork[.]life and worldherald[.]life both call corrykro[.]icu and the same t.js. A 32-character site id separates the deployments. We re-verified corrykro[.]icu live on 9 Sep 2026.

The cloaker also shows the three states of this corpus at once. wpdigest[.]life is decommissioned. It was active around July 2026. One related domain was live when we looked. thairelax[.]top was idle. Same delivery component. Live, quiet, and gone, side by side. An IOC on the live name misses the other two. That is the same lesson as the technical paper's 72% that was not serving: state moves. The hallway stays.

The command leaves the lure

What the victim pastes does not run on the job board. We found ten domains inside the cluster using paths of the form /curl/<64-hex-token>. The names are deliberately dull: chisel-perch[.]com, lens-kite[.]com, shelter47[.]com. Those hosts hand the victim to 11 stager domains. The stagers use the constrained keyboard-like names we had already pulled out of the linguistic pass on the 1,585, including rcqwr12c541wa421q[.]com and qwcrsarc15qewc51[.]com.

Ten plus 11 is the 21. The naming family and the malware chain are the same nexus. That is the finding an IOC list of two malware domains cannot make. We did not invent that nexus for this post. It was already hanging off the same cluster we opened for the paper.

The stager wrapper, loader.sh, is regenerated per build. Variable names change. Hashes change. The behavior stays. On macOS it checks Apple Silicon against Intel, downloads the matching payload, strips the quarantine attribute, applies an ad-hoc signature, and installs under ~/Library/Caches/com.apple.securityd/com.apple.periodic. It launches outside the Terminal session, reports the stages back to the operator, and deletes the pasted command from shell history.

The path is built to look like an Apple component. The history wipe removes the one line a person would recognize. By the time an endpoint detection looks for the command the victim was told to paste, the command is gone. The IoPA was earlier: the cloaker site id, the t.js gate, the /curl/ hosts, the stager names that match the factory's "random" template.

The Bottom Line

Two domains were the malware IOC. Twenty-one hosts were the delivery infrastructure, and they already sat in the cluster with the phishing pages and the ticket shops. The gate is 889 bytes, and it is written to hide from the tools that would label it malicious.

We opened one cluster out of 80,000. This hallway was already inside it. Pre-Attack Intelligence is following that hallway while the lure still looks like a job board.

Technical paper and indicators: The Anatomy of a Russian-Speaking Cybercrime Cluster. Domain corpus: Malanta's public GitHub.

Tomorrow: the open directory that showed us the drainer was a product, with a buyer who is not the builder.