Threat Summary
These four TLP:white OTX pulses describe the same business model from different angles: industrialized credential and session theft sold or operated as infrastructure. Mirage2FA and Balonx Sistema are Phishing-as-a-Service operations that use adversary-in-the-middle relaying, WebSocket session control, HTML smuggling, fake support flows, and vishing to bypass MFA rather than break it. The T-Mobile rewards-points smishing wave is lower sophistication but high volume, using rotating lookalike hostnames under .top to harvest card and account data. The BlackHatSect0r && DXQRTXX exposure is the most strategically important: a custom Go C2 platform, DXSCAN, queued roughly 2.7 million domains, touched 726,989 hosts, and stored 16,834 harvested credentials while exploiting public-facing edge and application vulnerabilities such as F5 BIG-IP CVE-2020-5902, CVE-2021-22986, CVE-2022-1388, CVE-2023-46747, Laravel CVE-2021-3129 and CVE-2018-15133, Spring Cloud Gateway CVE-2022-22947, and WordPress CVE-2021-29447.
Collectively, the objective is durable identity compromise: steal passwords where possible, steal authenticated sessions where MFA exists, and monetize through fraud, extortion, resale, and follow-on intrusion. Targeting is broad across US technology, manufacturing, education, finance, healthcare, telecom, government, transportation, and Mexican banking. The defensive implication is clear: blocking domains is necessary but insufficient. SOC teams need detections for token replay, impossible travel after phishing clicks, WebSocket-backed session control, OAuth consent anomalies, edge-device exploit probes, and mass credential validation behavior.
Threat Actor / Malware Profile
Mirage2FA / LinX Coders operates a M365 AiTM kit. Distribution is phishing email and lures that imitate corporate identity, HR, benefits, ADP, Microsoft, and document workflows. Payload behavior is proxy-based credential capture plus session-cookie theft; successful victims can be imported directly into attacker-controlled browsers. C2 uses lookalike domains and hostnames such as office.pcvgtech.store, ver.verpox.shop, adp.pslcertlive.site, ans.rsxbenefits.com, and ari.vslbertlive.info. Persistence is not classic malware persistence; it is session persistence through stolen cookies and refresh tokens. Anti-analysis includes rotating infrastructure, benign-looking TLS, HTML smuggling to avoid attachment scanning, and victim filtering by geography and vertical.
Balonx Sistema / Spyroid is a Mexico-focused banking PhaaS with tiered subscriptions and cryptocurrency payment handling. Distribution uses fake security alerts, callflow-driven vishing, and Android side-loading. Spyroid behaves as an Android RAT with overlay, SMS/notification access, accessibility abuse, credential capture, and live session ride-along. The panel infrastructure observed includes balonx.online, callbalonx.info, panelbalonxfs.xyz, and GraphQL/REST/token endpoints under /admin/api/. Persistence on Android commonly depends on accessibility service retention, device-admin style privileges, notification listener access, battery-optimization exemption, and play-protect evasion. Anti-analysis includes emulator checks, WebSocket command channels, and encrypted payload staging.
T-Mobile rewards smishing uses SMS urgency around expiring points, typically 18,400 points, and redirects through rotating hostnames including t-mobile.biktpw.top, t-mobile.cugbjl.top, t-mobile.cymfjd.top, t-mobile.gdikxv.top, t-mobile.hdzcnb.top, t-mobile.koxetp.top, t-mobile.nxdcfp.top, and t-mobile.pkrbai.top. The payload is a credential and payment-card harvesting flow, often with brand cloning, URL shorteners, and fast domain churn. There is no host persistence; detection must focus on SMS gateways, mobile browser telemetry, DNS, and credential reuse after submission.
DXSCAN / BlackHatSect0r && DXQRTXX is a Go-based scanning and C2 stack associated with mass exploitation and credential harvesting. The exposed server suggests operators removed safety constraints from a Nous Research Hermes agent by deleting a memory line described as discernment retained, then used AI-assisted tasking to scale reconnaissance, vishing, extortion, and cloud-storage exploitation. Payload behavior is scanner plus harvester: identify vulnerable edge/app stacks, exploit, collect credentials and configuration secrets, queue new targets, and centralize loot. C2 is HTTP/HTTPS-like with Go binaries, opportunistic CVE probing, and cloud-storage abuse. Anti-analysis is mostly infrastructure hygiene failure in this case, but normally Go static binaries, packed loaders, and cloud-hosted panels complicate attribution.
IOC Analysis
The indicator set is domain-, hostname-, URL-, and CVE-heavy, with no file hashes or IPs in the supplied samples. That means enrichment must move from static blocklisting to infrastructure clustering and identity analytics. Treat every listed domain and hostname as malicious for outbound DNS, proxy, TLS SNI, and browser history hunting. Pivot on registrant patterns, certificate transparency, passive DNS, URL path conventions such as /admin/api/api/gql, /admin/api/api/rest, and /admin/api/api/token, and M365 lure naming patterns using office, adp, benefits, certlive, ver, and helpdesk terms.
Operationalize CVEs by correlating external scan telemetry with WAF, load balancer, VPN, Laravel, WordPress, Spring Gateway, and CMS logs. Do not assume compromise from a single probe; prioritize exploitation evidence such as POST bodies to known vulnerable endpoints, unexpected 200 responses after exploit paths, new outbound connections from DMZ servers, credential file access, or child processes from web services. Feed indicators into SIEM, EDR, DNS firewall, secure web gateway, email security, mobile threat defense, and Entra ID/M365 alerting. Useful tooling: OTX pulses for context, urlscan.io and VirusTotal for detonation, crt.sh for certificate pivots, RDAP/WHOIS for registration clustering, Microsoft Sentinel for identity correlation, Zeek/Suricata for WebSocket and SNI visibility, and YARA only after hashes are obtained from sandbox submissions.
Detection Engineering
---
title: Mirage2FA AiTM Microsoft 365 Session Theft Infrastructure
id: 8c2b7e7d-1f2a-4f41-9b8e-0a4f6f3a1001
status: experimental
description: Detects proxy/DNS/browser network activity to Mirage2FA and related Microsoft 365 adversary-in-the-middle lure infrastructure from OTX pulse data.
references:
- https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
author: Security Arsenal
date: 2026/09/18
logsource:
category: proxy
detection:
selection_domains:
c-uri-host|contains:
- galatasaraydanhaberler.com
- sopbtech.store
- pcvgtech.store
- verpox.shop
- cementslabconstruction.com
- pslcertlive.site
- rsxbenefits.com
- vslbertlive.info
selection_lure_paths:
c-uri|contains:
- /office
- /adp
- /benefits
- /verify
- /login
- /sso
condition: selection_domains or (selection_lure_paths and selection_domains)
falsepositives:
- Rare; branded third-party SSO and benefits portals can use similar path names.
level: high
fields:
- c-uri
- c-uri-host
- src-ip
- user-agent
tags:
- attack.credential_access
- attack.t1557
- attack.t1539
- attack.t1566
---
title: Balonx Spyroid PhaaS Panel And WebSocket Session Control
id: 9d6ad011-83db-4fb7-93f3-b6a6d9132002
status: experimental
description: Identifies network activity to Balonx Sistema PhaaS panels and API endpoints used for Spyroid banking fraud and real-time session hijacking.
references:
- https://www.group-ib.com/blog/balonx-sistema-mexico-phaas
author: Security Arsenal
date: 2026/09/18
logsource:
category: network_connection
detection:
selection_dst:
DestinationHostname|contains:
- soporte-aclaracion.xyz
- balonx.online
- callbalonx.info
- panelbalonxfs.xyz
- phishing-domain.xyz
selection_paths:
Image|endswith:
- chrome.exe
- msedge.exe
- firefox.exe
- okhttp
- android
condition: selection_dst
falsepositives:
- Threat research, sandbox detonation, and CTI enrichment systems.
level: critical
tags:
- attack.command_and_control
- attack.t1071.001
- attack.t1573
- attack.t1557
---
title: DXSCAN Mass Exploit Probe Against Edge And App CVE Surface
id: 51aef2a2-0d7e-4cd0-a552-7f312f283003
status: experimental
description: Hunts for exploit patterns associated with DXSCAN mass credential harvesting against F5, Laravel, WordPress, and Spring Cloud Gateway exposure.
references:
- https://socradar.io/blog/blackhatsect0r-dxqrtxx-operation-server
author: Security Arsenal
date: 2026/09/18
logsource:
category: webserver
detection:
selection_f5:
c-uri|contains:
- /tmui/login.jsp/..;/
- /hsqldb
- /iControl
selection_frameworks:
c-uri|contains:
- /_ignition/execute-solution
- /actuator/gateway/routes
- /wp-json/wp/v2/users
- /xmlrpc.php
selection_methods:
cs-method:
- POST
- PUT
- GET
condition: selection_methods and (selection_f5 or selection_frameworks)
falsepositives:
- Vulnerability scanners, bug bounty traffic, and internet-wide research scans.
level: high
tags:
- attack.initial_access
- attack.t1190
- attack.credential_access
- attack.t1552
let AiTM_Domains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info"]);
let PhaaS_Domains = dynamic(["soporte-aclaracion.xyz","balonx.online","callbalonx.info","panelbalonxfs.xyz","phishing-domain.xyz"]);
let Smish_Hosts = dynamic(["t-mobile.biktpw.top","t-mobile.cugbjl.top","t-mobile.cymfjd.top","t-mobile.gdikxv.top","t-mobile.hdzcnb.top","t-mobile.koxetp.top","t-mobile.nxdcfp.top","t-mobile.pkrbai.top"]);
let Suspicious = union(AiTM_Domains, PhaaS_Domains, Smish_Hosts);
let Net = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (Suspicious) or RemoteUrl endswith ".top"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType;
let Proc = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any ("msedge","chrome","firefox","powershell","rundll32","mshta","curl","wget","bitsadmin")
| where InitiatingProcessCommandLine has_any ("http","https",".top","office","adp","benefits","verify","login")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
Net
| join kind=leftouter Proc on DeviceName, $left.TimeGenerated >= $right.TimeGenerated - 2m and $left.TimeGenerated <= $right.TimeGenerated + 2m
| extend Campaign = case(RemoteUrl has_any (AiTM_Domains), "Mirage2FA-AiTM", RemoteUrl has_any (PhaaS_Domains), "Balonx-Spyroid", RemoteUrl has_any (Smish_Hosts), "T-Mobile-Smishing", "unknown")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Hits=count(), Users=dcount(InitiatingProcessAccountName), Processes=make_set(InitiatingProcessFileName), Commands=make_set(InitiatingProcessCommandLine) by Campaign, DeviceName, RemoteUrl, RemoteIP
| order by LastSeen desc;
$ErrorActionPreference = 'SilentlyContinue'
$iocs = @('galatasaraydanhaberler.com','sopbtech.store','pcvgtech.store','verpox.shop','cementslabconstruction.com','pslcertlive.site','rsxbenefits.com','vslbertlive.info','soporte-aclaracion.xyz','balonx.online','callbalonx.info','panelbalonxfs.xyz','phishing-domain.xyz','t-mobile.biktpw.top','t-mobile.cugbjl.top','t-mobile.cymfjd.top','t-mobile.gdikxv.top','t-mobile.hdzcnb.top','t-mobile.koxetp.top','t-mobile.nxdcfp.top','t-mobile.pkrbai.top')
$findings = New-Object System.Collections.Generic.List[object]
foreach ($ioc in $iocs) {
$dns = Get-DnsClientCache | Where-Object { $_.Entry -like ('*' + $ioc + '*') -or $_.Data -like ('*' + $ioc + '*') }
foreach ($d in $dns) { $findings.Add([pscustomobject]@{Type='DNSCache'; Indicator=$ioc; Evidence=($d.Entry + ' -> ' + $d.Data); Path='DNSClientCache'}) }
$conn = Get-NetTCPConnection | Where-Object { $_.RemotePort -in 80,443,8080,8443 } | ForEach-Object { $_; try { Resolve-DnsName -Name $ioc -DnsOnly -QuickTimeout | Out-Null } catch {} }
}
$hostsPath = "$env:WINDIR\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
foreach ($line in Get-Content $hostsPath) {
foreach ($ioc in $iocs) { if ($line -match [regex]::Escape($ioc)) { $findings.Add([pscustomobject]@{Type='HostsFile'; Indicator=$ioc; Evidence=$line; Path=$hostsPath}) } }
}
}
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($key in $runKeys) {
if (Test-Path $key) {
$props = Get-ItemProperty $key
foreach ($p in $props.PSObject.Properties) {
$value = [string]$p.Value
if ($value -match '(?i)(appdata|temp|roaming|mshta|rundll32|powershell|chrome|edge|update|service)') { $findings.Add([pscustomobject]@{Type='RunKey'; Indicator='persistence-review'; Evidence=($p.Name + '=' + $value); Path=$key}) }
}
}
}
Get-ScheduledTask | Where-Object { $_.TaskName -match '(?i)(update|sync|edge|chrome|office|adobe|support|service)' -and $_.Actions.Execute -match '(?i)(powershell|mshta|rundll32|wscript|cmd)' } | ForEach-Object { $findings.Add([pscustomobject]@{Type='ScheduledTask'; Indicator='persistence-review'; Evidence=($_.TaskName + ' -> ' + $_.Actions.Execute + ' ' + $_.Actions.Arguments); Path=$_.TaskPath}) }
$browserPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History","$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\History")
foreach ($bp in $browserPaths) { if (Test-Path $bp) { $findings.Add([pscustomobject]@{Type='BrowserArtifact'; Indicator='manual-sqlite-review'; Evidence='Copy history to isolated analysis host and query urls for IOC domains'; Path=$bp}) } }
$findings | Sort-Object Type, Evidence | Format-List
Response Priorities
Immediate: Block the listed domains, hostnames, and URL paths at DNS, secure web gateway, email, and mobile controls. Search proxy, DNS cache, browser history, EDR network events, and SMS gateway logs for the .top T-Mobile lure hosts and Mirage2FA/Balonx infrastructure. Isolate endpoints with AiTM or PhaaS hits, capture volatile browser/session data, and revoke active sessions before imaging. For possible DXSCAN exposure, lock down F5, Laravel, WordPress, and Spring Gateway interfaces and inspect DMZ egress for scanner callbacks.
24h: Force Entra ID/M365 sign-out and token revocation for impacted users; reset passwords only after session revocation, because password reset alone does not invalidate stolen cookies. Review sign-in logs for token replay, unfamiliar ASN, impossible travel, new inbox rules, OAuth grants, MFA registration changes, and session persistence. For Spyroid/Balonx victims, notify fraud teams, freeze at-risk banking sessions, check SMS forwarding and accessibility service changes on Android devices, and rotate any credentials entered during the lure window. Validate whether harvested credentials appear in internal AD, VPN, Okta/Entra, SaaS, and customer portal authentication attempts.
1 week: Move M365 to phishing-resistant MFA using FIDO2/passkeys or certificate-based authentication for high-risk users; enforce conditional access with token protection where available and block legacy auth. Add detections for AiTM markers: same session ID used from distant ASNs, sign-in after click without MFA challenge completion, and consent to unfamiliar enterprise apps. Patch and virtual-patch CVE-2020-5902, CVE-2021-22986, CVE-2022-1388, CVE-2023-46747, CVE-2021-3129, CVE-2018-15133, CVE-2022-22947, and CVE-2021-29447; restrict management interfaces; alert on web-server child processes and egress from DMZ application servers. For mobile fleets, block side-loading, alert on accessibility plus notification-listener enablement, and deploy SMS phishing reporting.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.