# Malware Distribution Platform Exposed via Unsecured /install/install.php Setup Page (micronsoftwares[.]com / wetransfer[.]ICU SEO-Poisoning Operation)

> A live, in-the-wild malware distribution platform was exposed when its PHP/MySQL admin panel left the deployment-time setup script /install/install.php reachable on production with no initialization lockout. Security researcher Jonias Fortuna (potato.id) re-ran the installer against an attacker-controlled database (Docker MySQL exposed via ngrok), provisioned a new administrator, and gained full visibility into a SEO-poisoning operation that masquerades as fake software (micronsoftwares[.]com) and a WeTransfer typosquat (wetransfer[.]ICU) to deliver malware. The infrastructure remained active and continued distributing payloads after disclosure.

- **Published:** 2026-06-15T00:00:00Z
- **Last reviewed:** 2026-06-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0799
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-wetransfer-seo-poisoning-platform-tl-2026-0799.webp?v=4a460093 (Threadlinqs threat intel: WeTransfer Typosquat Malware Platform: Detection & IOCs (TL-2026-0799) — High severity, 15 IOCs, 9 detection rules.)
- **ID:** TL-2026-0799
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 15 (3 shown free below)

## Description

In June 2026, researcher Jonias Fortuna documented ("I Accidentally Logged as Admin Into a Threat Actor Website", potato.id) the accidental full-administrator compromise of a threat actor's malware distribution platform, picked up the same day by Cyber Security News and CyberPress. The platform is a PHP application backed by a MySQL database with local file storage used to host malicious payloads. Its admin dashboard — rendered in Russian — exposes features for keyword/campaign management, visitor activity tracking, download management, and payload configuration, and it generates dynamic download pages driven by URL parameters.

The central security failure is an exposed, functional deployment-time installer at /install/install.php that lacked any guard to detect a prior, completed installation (an improper-initialization / missing-lockfile misconfiguration). While enumerating the web application with the directory brute-forcing tool ffuf, the researcher discovered /admin/login.php, /config/database.php, and /install/install.php. Recognizing that a live installer on a production system is a textbook misconfiguration, the researcher stood up a Docker-hosted MySQL instance, exposed it externally with ngrok, and submitted the installation form with attacker-controlled database credentials. The setup completed with no verification that the application had already been initialized, reconfiguring the backend and creating a new administrator account — granting full panel access.

A second weakness compounded the first: the application stored session state server-side and never invalidated existing sessions on backend reconfiguration. After the threat actors restored their original database configuration, the researcher's previously issued session token remained valid, so access was regained without re-authenticating (insufficient session expiration / lack of session invalidation).

Operationally, the platform is a malware-delivery funnel. Rather than linking victims directly to the malware-hosting domain, the actor relies on SEO poisoning to rank fake software/download lures, then routes victims through intermediate redirectors (including Google Colab-based redirectors) and a multi-stage redirection chain before delivering a compressed archive containing the final Windows payload (reported SHA256 7b03fb383a5ce784a3cb9b0f8a76a84e984d14e553de5d98faff3d07d9793085). The lure domains impersonate trusted brands: micronsoftwares[.]com evokes Microsoft software, and wetransfer[.]ICU typosquats the WeTransfer file-sharing service. The episode mirrors the broader pattern of threat-actor operational-security failures highlighted by Vectra AI research in December 2025. No CVE or CVSS was assigned by the source; this is an operational exposure of criminal infrastructure rather than a vendor-product vulnerability.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583.001 Domains
- T1583.006 Web Services
- T1608.001 Upload Malware
- T1608.005 Link Target
- T1608.006 SEO Poisoning
- T1608.004 Drive-by Target
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1204.002 Malicious File
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1550.004 Web Session Cookie
- T1552.001 Credentials In Files
- T1102 Web Service
- T1104 Multi-Stage Channels
- T1105 Ingress Tool Transfer

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Exposed Deployment Installer Access After Directory Brute-Force — /install/install.php on Production** (`TL-2026-0799-SPL-001`)

Detects the exploitation signature behind the TL-2026-0799 platform compromise: a single client performing ffuf-style directory brute-forcing (high 404 volume / wordlist user-agent) that subsequently reaches a live deployment-time installer (/install/install.php) and the admin/config endpoints (/admin/login.php, /config/database.php) on a production web server. A re-runnable installer on production (CWE-665/CWE-1188) lets an attacker reconfigure the backend and provision a new admin. This rule fires when enumeration is followed by a successful (200/302) hit to the installer path.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1595.003
- **Data sources:** web_proxy, iis_logs, apache_access_logs
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype="access_combined" (uri_path="/install/install.php" OR uri_path="/admin/login.php" OR uri_path="/config/database.php")
| eval is_installer=if(uri_path=="/install/install.php" AND (status=="200" OR status=="302"),1,0)
| stats count, dc(uri_path) AS distinct_sensitive_paths, sum(is_installer) AS installer_hits, values(uri_path) AS paths, values(useragent) AS agents, values(status) AS statuses by clientip, src
| join type=left clientip [ search index=web sourcetype="access_combined" status=404 earliest=-1h | stats count AS notfound_count by clientip ]
| where installer_hits>0 AND (distinct_sensitive_paths>=2 OR notfound_count>=50)
| eval risk="Production installer reached after enumeration — possible re-initialization / admin takeover"
| table _time, clientip, src, paths, statuses, agents, notfound_count, risk
```

### Microsoft KQL

```kql
let window = 1h;
let bruteforce = W3CIISLog
| where TimeGenerated > ago(window)
| where scStatus == 404
| summarize NotFound = count() by cIP
| where NotFound >= 50;
W3CIISLog
| where TimeGenerated > ago(window)
| where csUriStem in~ ("/install/install.php", "/admin/login.php", "/config/database.php")
| summarize Hits = count(), Paths = make_set(csUriStem), Statuses = make_set(scStatus), Agents = make_set(csUserAgent),
           InstallerHit = countif(csUriStem =~ "/install/install.php" and scStatus in (200, 302)) by cIP
| where InstallerHit > 0 and array_length(Paths) >= 2
| join kind=leftouter (bruteforce) on cIP
| project TimeGenerated = now(), cIP, Paths, Statuses, Agents, InstallerHit, NotFound,
          Risk = "Live installer reached after enumeration — possible backend re-init / admin takeover"
```

### Sigma

```yaml
title: Production Deployment Installer Access After Directory Brute-Force
id: 6a1f0c2e-7b94-4d51-9a3e-0f7c1d2b8e44
status: experimental
description: Detects access to a live deployment-time installer (/install/install.php) and admin/config endpoints on a production web server, indicative of the TL-2026-0799 re-runnable installer misconfiguration (CWE-665/CWE-1188) enabling backend reconfiguration and admin provisioning.
references:
  - https://potato.id/en/posts/i-accidentally-logged-into-threat-actor-website/
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1595/003/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1190
  - attack.reconnaissance
  - attack.t1595.003
logsource:
  category: webserver
detection:
  installer:
    cs-uri-stem|endswith: '/install/install.php'
    sc-status:
      - 200
      - 302
  sensitive:
    cs-uri-stem|contains:
      - '/admin/login.php'
      - '/config/database.php'
  condition: installer and sensitive
falsepositives:
  - Legitimate first-time deployment or staging environment where the installer has not yet been removed
  - Authorized vulnerability scanners and penetration tests
level: high
```

**Known false positives:**

- Legitimate first-time deployment before the installer is removed
- Authorized scanners or penetration testing
- Staging hosts that intentionally retain the installer

**Tuning notes:** Tune the 404 brute-force threshold (default 50/hour) to your site's baseline and exclude known scanner/monitoring source IPs. On legitimately new deployments, suppress until the /install path returns 404/410 after lockdown.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Sentinel — Live Installer Reached After Wordlist Enumeration (locked: unlock with TL Creds)
- Sentinel — Outbound Connections to Impersonation Lure / Typosquat Domains (locked: unlock with TL Creds)
- Sentinel — Archive Extraction Spawning EXE Then Network Beacon (Delivery to Execution) (locked: unlock with TL Creds)
- Sigma — Exposed Database Config and Installer Path Access in Web Root (locked: unlock with TL Creds)
- Sigma — ngrok / External Tunnel Egress During Backend Reconfiguration (locked: unlock with TL Creds)
- Sigma — Browser-Spawned Archive Extraction of Brand-Impersonation Named Installer (locked: unlock with TL Creds)
- Admin Session Reuse and New-Admin Provisioning After Backend Reconfiguration (locked: unlock with TL Creds)
- SEO-Poisoned Fake-Software Archive Download and [indicator] Execution from Downloads (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 15)

Defanged, TLP:CLEAR.

- Domain: `micronsoftwares[.]com`
- File hash: `7b03fb383a5ce784a3cb9b0f8a76a84e984d14e553de5d98faff3d07d9793085`
- Domain: `wetransfer[.]ICU`

Full set of 15 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Malware Platform Unlocked via PHP Installation Page](https://cybersecuritynews.com/malware-platform-unlocked-php-installation-page/)
- [I Accidentally Logged as Admin Into a Threat Actor Website - Jonias Fortuna](https://potato.id/en/posts/i-accidentally-logged-into-threat-actor-website/)
- [Threat Actor Malware Platform Exposed by Unsecured PHP Install Page](https://cyberpress.org/threat-actor-malware-platform-exposed/)
- [MITRE ATT&CK T1608.006 - Stage Capabilities: SEO Poisoning](https://attack.mitre.org/techniques/T1608/006/)
- [MITRE ATT&CK S0508 - ngrok](https://attack.mitre.org/software/S0508/)
- [MITRE ATT&CK T1036.005 - Masquerading: Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0799