Skip to content
Bulwark Black Bulwark Black LLC
Latest
FakeAgent Shows Why Trusted AI Brands Are Now Malware Delivery InfrastructureJadeProx Shows Why China-Nexus Intrusions Still Start With Basic ExposureAPT34 Shows Why Identity Infrastructure Is Iran’s Quietest Attack PathAI Malware Analysis Agents Need Human-Led Quality GatesTrickBot DNS Tunneling Shows Why DNS Is a Malware Control PlaneBitLocker Extortion Shows Why Misconfiguration Is Still Ransomware’s ShortcutProject CAV3RN Turns Outlook Calendars and DNS Into Covert C2Qilin Turns GlobalProtect VPN Exposure Into Ransomware Initial AccessHugging Face Breach Shows AI Pipelines Are Now Production Attack SurfaceTELESHIM Shows Why Telegram C2 Belongs in Government Intrusion HuntsGoSerpent Shows Why Quiet Data Collection Is the Real Espionage RiskNGINX CVE-2026-42533 Turns Reverse Proxy Configs Into Patch PrioritiesChrome Critical Fixes Put Browser Patch Cadence Back on the Clock7-Zip XZ RCE Fix Turns Archive Handling Into a Patch Priority

Indicator of Compromise

1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664

SHA-256 hash Seen in 1 report Watch this →

A SHA-256 file hash identifying a specific malicious sample. Match it against files on disk or in your EDR.

Included in the Hashes feed (live, machine-readable).

Seen in these reports

General CTI · Jul 23, 2026

FakeAgent Shows Why Trusted AI Brands Are Now Malware Delivery Infrastructure

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

0xc1907d7be91f95903ad66d775c397302e7dd92280xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228104[.]194[.]133[.]210107[.]189[.]17[.]143107[.]189[.]20[.]32107[.]189[.]20[.]95107[.]189[.]21[.]86107[.]189[.]22[.]118107[.]189[.]24[.]255107[.]189[.]24[.]67107[.]189[.]26[.]86191[.]101[.]80[.]211195[.]110[.]58[.]222 1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb 2[.]24[.]131[.]246 26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a 45[.]59[.]114[.]19045[.]59[.]117[.]14545[.]59[.]117[.]6745[.]59[.]122[.]13445[.]59[.]122[.]23545[.]59[.]122[.]8245[.]59[.]123[.]12245[.]59[.]124[.]1745[.]59[.]125[.]2285ca8758c-02d0-4a72-89c8-d468b66dda41[.]com Claude[.]ai claude[.]ai[.]download-app[.]usclaude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877download-app[.]usdownloading-api[.]itdownloading-api[.]it[.]com f8acb8f5cf88b77a4c27d7fd6856aa299bb178e85f9963c2fbd447d818da3ed0 fd826215add30c1319eefa291b6eaf8ddfa7720cfe816c49aef6fe8a88de7939 it[.]com/html/claude/winpolse[.]us
Browse all indicators → Machine-readable feeds → Extract IOCs from text →