Malware Distribution Platform Exposed via Unsecured /install/install.php Setup Page (micronsoftwares[.]com / wetransfer[.]ICU SEO-Poisoning Operation)

Key facts for WeTransfer SEO poisoning platform

Detection coverage for WeTransfer SEO poisoning platform

As of 2026-06-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0799 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Exposed Deployment Installer Access After Directory Brute-Force — /install/install.php on Production

Detects the exploitation signature behind the TL-2026-0799 platform compromise: a single client performing ffuf-style directory brute-forcing (high 404 volume / wordlist user-agent) that subsequently reaches a live deployment-time installer (/install/install.php) and the admin/config endpoints (/admin/login.php, /config/database.php) on a production web server. A re-runnable installer on production (CWE-665/CWE-1188) lets an attacker reconfigure the backend and provision a new admin. This rule fires when enumeration is followed by a successful (200/302) hit to the installer path.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1595.003
• Data sources: web_proxy, iis_logs, apache_access_logs
• Severity: high
• Confidence: high

Splunk SPL

index=web sourcetype="access_combined" (uri_path="/install/install.php" OR uri_path="/admin/login.php" OR uri_path="/config/database.php")
| eval is_installer=if(uri_path=="/install/install.php" AND (status=="200" OR status=="302"),1,0)
| stats count, dc(uri_path) AS distinct_sensitive_paths, sum(is_installer) AS installer_hits, values(uri_path) AS paths, values(useragent) AS agents, values(status) AS statuses by clientip, src
| join type=left clientip [ search index=web sourcetype="access_combined" status=404 earliest=-1h | stats count AS notfound_count by clientip ]
| where installer_hits>0 AND (distinct_sensitive_paths>=2 OR notfound_count>=50)
| eval risk="Production installer reached after enumeration — possible re-initialization / admin takeover"
| table _time, clientip, src, paths, statuses, agents, notfound_count, risk

Microsoft KQL

let window = 1h;
let bruteforce = W3CIISLog
| where TimeGenerated > ago(window)
| where scStatus == 404
| summarize NotFound = count() by cIP
| where NotFound >= 50;
W3CIISLog
| where TimeGenerated > ago(window)
| where csUriStem in~ ("/install/install.php", "/admin/login.php", "/config/database.php")
| summarize Hits = count(), Paths = make_set(csUriStem), Statuses = make_set(scStatus), Agents = make_set(csUserAgent),
           InstallerHit = countif(csUriStem =~ "/install/install.php" and scStatus in (200, 302)) by cIP
| where InstallerHit > 0 and array_length(Paths) >= 2
| join kind=leftouter (bruteforce) on cIP
| project TimeGenerated = now(), cIP, Paths, Statuses, Agents, InstallerHit, NotFound,
          Risk = "Live installer reached after enumeration — possible backend re-init / admin takeover"

Sigma

title: Production Deployment Installer Access After Directory Brute-Force
id: 6a1f0c2e-7b94-4d51-9a3e-0f7c1d2b8e44
status: experimental
description: Detects access to a live deployment-time installer (/install/install.php) and admin/config endpoints on a production web server, indicative of the TL-2026-0799 re-runnable installer misconfiguration (CWE-665/CWE-1188) enabling backend reconfiguration and admin provisioning.
references:
  - https://potato.id/en/posts/i-accidentally-logged-into-threat-actor-website/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1595/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.003
logsource:
  category: webserver
detection:
  installer:
    cs-uri-stem|endswith: '/install/install.php'
    sc-status:
      - 200
      - 302
  sensitive:
    cs-uri-stem|contains:
      - '/admin/login.php'
      - '/config/database.php'
  condition: installer and sensitive
falsepositives:
  - Legitimate first-time deployment or staging environment where the installer has not yet been removed
  - Authorized vulnerability scanners and penetration tests
level: high

Known false positives:

• Legitimate first-time deployment before the installer is removed
• Authorized scanners or penetration testing
• Staging hosts that intentionally retain the installer

Tuning notes: Tune the 404 brute-force threshold (default 50/hour) to your site's baseline and exclude known scanner/monitoring source IPs. On legitimately new deployments, suppress until the /install path returns 404/410 after lockdown.

• 🔒 Sentinel — Live Installer Reached After Wordlist Enumeration · unlock with TL Creds
• 🔒 Sentinel — Outbound Connections to Impersonation Lure / Typosquat Domains · unlock with TL Creds
• 🔒 Sentinel — Archive Extraction Spawning EXE Then Network Beacon (Delivery to Execution) · unlock with TL Creds
• 🔒 Sigma — Exposed Database Config and Installer Path Access in Web Root · unlock with TL Creds
• 🔒 Sigma — ngrok / External Tunnel Egress During Backend Reconfiguration · unlock with TL Creds
• 🔒 Sigma — Browser-Spawned Archive Extraction of Brand-Impersonation Named Installer · unlock with TL Creds
• 🔒 Admin Session Reuse and New-Admin Provisioning After Backend Reconfiguration · unlock with TL Creds
• 🔒 SEO-Poisoned Fake-Software Archive Download and [indicator] Execution from Downloads · unlock with TL Creds

Indicators of compromise for WeTransfer SEO poisoning platform

As of 2026-06-15, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-0799.

Sample indicators (3 of 15)

• Domain: micronsoftwares[.]com
• File hash: 7b03fb383a5ce784a3cb9b0f8a76a84e984d14e553de5d98faff3d07d9793085
• Domain: wetransfer[.]ICU

Defanged, TLP:CLEAR. Full set of 15 indicators: unlock with TL Creds.

Community OSINT corroboration for WeTransfer SEO poisoning platform

2 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How WeTransfer SEO poisoning platform works

The infrastructure remained active and continued distributing payloads after disclosure.

In June 2026, researcher Jonias Fortuna documented ("I Accidentally Logged as Admin Into a Threat Actor Website", potato.id) the accidental full-administrator compromise of a threat actor's malware distribution platform, picked up the same day by Cyber Security News and CyberPress. The platform is a PHP application backed by a MySQL database with local file storage used to host malicious payloads. Its admin dashboard — rendered in Russian — exposes features for keyword/campaign management, visitor activity tracking, download management, and payload configuration, and it generates dynamic download pages driven by URL parameters.

The central security failure is an exposed, functional deployment-time installer at /install/install.php that lacked any guard to detect a prior, completed installation (an improper-initialization / missing-lockfile misconfiguration). While enumerating the web application with the directory brute-forcing tool ffuf, the researcher discovered /admin/login.php, /config/database.php, and /install/install.php. Recognizing that a live installer on a production system is a textbook misconfiguration, the researcher stood up a Docker-hosted MySQL instance, exposed it externally with ngrok, and submitted the installation form with attacker-controlled database credentials. The setup completed with no verification that the application had already been initialized, reconfiguring the backend and creating a new administrator account — granting full panel access.

A second weakness compounded the first: the application stored session state server-side and never invalidated existing sessions on backend reconfiguration. After the threat actors restored their original database configuration, the researcher's previously issued session token remained valid, so access was regained without re-authenticating (insufficient session expiration / lack of session invalidation).

Operationally, the platform is a malware-delivery funnel. Rather than linking victims directly to the malware-hosting domain, the actor relies on SEO poisoning to rank fake software/download lures, then routes victims through intermediate redirectors (including Google Colab-based redirectors) and a multi-stage redirection chain before delivering a compressed archive containing the final Windows payload (reported SHA256 7b03fb383a5ce784a3cb9b0f8a76a84e984d14e553de5d98faff3d07d9793085). The lure domains impersonate trusted brands: micronsoftwares[.]com evokes Microsoft software, and wetransfer[.]ICU typosquats the WeTransfer file-sharing service. The episode mirrors the broader pattern of threat-actor operational-security failures highlighted by Vectra AI research in December 2025. No CVE or CVSS was assigned by the source; this is an operational exposure of criminal infrastructure rather than a vendor-product vulnerability.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location

Command and Control

T1102 Web Service; T1104 Multi-Stage Channels; T1105 Ingress Tool Transfer

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application

Execution

T1204.002 Malicious File

lateral-movement

T1550.004 Web Session Cookie

Credential Access

T1552.001 Credentials In Files

Resource Development

T1583.001 Domains; T1583.006 Web Services; T1608.001 Upload Malware; T1608.004 Drive-by Target; T1608.005 Link Target; T1608.006 SEO Poisoning

Reconnaissance

T1595 Active Scanning

Remediation for WeTransfer SEO poisoning platform

Immediate actions

• Block and sinkhole the lure/host domains micronsoftwares.com and wetransfer.ICU at DNS, proxy, and email-gateway layers
• Hunt for and quarantine the payload SHA256 7b03fb383a5ce784a3cb9b0f8a76a84e984d14e553de5d98faff3d07d9793085 across endpoints
• Alert users that 'WeTransfer' / Microsoft-software download lures may be typosquats; verify the canonical wetransfer.com and microsoft.com domains

Workarounds

• Enforce allowlists for software acquisition; block downloads of executables/archives from uncategorized or newly-registered domains

Longer-term hardening

• Deploy EDR with behavioral detection for archive-delivered executables sourced from search-result downloads
• Implement web-content filtering and DNS reputation to interdict SEO-poisoning redirect chains and Google Colab-based redirectors
• User awareness training on fake-software / cracked-installer SEO poisoning and brand-impersonation typosquats

Affected and fixed versions

• Threat actor infrastructure (criminal) — Custom PHP/MySQL malware distribution admin panel
  Vulnerable versions: production deployment with live /install/install.php and server-side sessions
• End users / organizations — Windows endpoints exposed to SEO-poisoned fake-software downloads
  Vulnerable versions: any user downloading from impersonation lure domains

Timeline of WeTransfer SEO poisoning platform

• 2025-12-01 Vectra AI research documents recurring threat-actor operational-security failures, the broader pattern this exposure exemplifies.
• 2026-06-15 Despite the disclosed misconfiguration, the malware distribution infrastructure remains active and continues distributing malware.
• 2026-06-15 Findings published on potato.id and reported by Cyber Security News and CyberPress; IOCs released (locked-ioc-11, locked-ioc-13, SHA256 7b03fb3...3085).
• 2026-06-15 Internal Russian-language admin dashboard observed: keyword/campaign management, visitor tracking, download management, dynamic URL-parameter-driven download pages, and SEO-poisoning + multi-stage redirector delivery (incl. locked-ioc-8).
• 2026-06-15 After the actors restore their original database configuration, the previously issued server-side session token remains valid, so admin access is regained without re-authentication (no session invalidation).
• 2026-06-15 Researcher spins up a Docker-hosted MySQL instance, exposes it externally via locked-ioc-15, and submits the install form with controlled database credentials; setup completes without checking for prior initialization, reconfiguring the backend and creating a new administrator account.
• 2026-06-15 A live deployment-time installer on production is recognized as a textbook misconfiguration with no initialization lockout.
• 2026-06-15 Researcher Jonias Fortuna enumerates the target web application with ffuf and discovers locked-ioc-12, locked-ioc-10, and a live locked-ioc-9 on the production server.

Sources cited for WeTransfer SEO poisoning platform

• I Accidentally Logged as Admin Into a Threat Actor Website - Jonias Fortuna potato.id · Research · 2026-06-15
• MITRE ATT&CK T1608.006 - Stage Capabilities: SEO Poisoning MITRE · Research · 2026-06-15
• MITRE ATT&CK S0508 - ngrok MITRE · Research · 2026-06-15
• MITRE ATT&CK T1036.005 - Masquerading: Match Legitimate Name or Location MITRE · Research · 2026-06-15
• Malware Platform Unlocked via PHP Installation Page cybersecuritynews.com · News · 2026-06-15
• Threat Actor Malware Platform Exposed by Unsecured PHP Install Page cyberpress.org · News · 2026-06-15

Threats related to WeTransfer SEO poisoning platform

• Squirrel Threat Cluster Weaponizes Dropcatch/Expired Domains for RAT C2, SocGholish and Streaming-Gambling Fraud

Previous and next in malware

• GoFlateLoader: Golang Infostealer Loader Using Massive PE Overlay Inflation (700-950 MB) to Evade Antivirus and VirusTotal Scanning Previous report
• Velvet Ant (Operation Highland): Backdoored Linux PAM and OpenSSH for ~Decade-Long Espionage Persistence Next report