============================================================================== CYBER THREAT INTELLIGENCE - INDICATORS OF COMPROMISE (IOC) LIST ============================================================================== Generated: 2026-09-10 12:15 UTC Report ID: IOC-20260910-121536 Total Indicators: 28 Classification: OPEN - Law Enforcement / DFIR use Sources: CISA KEV Catalog, OpenPhish SUMMARY ------------------------------------------------------------------------------ CISA KEV (Known Exploited Vulnerability): 10 Phishing URL: 9 Domain: 9 Severity: CRITICAL=28 ============================================================================== [CISA KEV (KNOWN EXPLOITED VULNERABILITY)] - 10 indicator(s) ============================================================================== #1 CVE-2026-19490 Severity: CRITICAL Description: Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Pr Product: NetScaler (Citrix) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-19490 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-09 Tags: kev,cisa,active-exploitation #2 CVE-2025-25249 Severity: CRITICAL Description: Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. Product: Multiple Products (Fortinet) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-25249 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-09 Tags: kev,cisa,active-exploitation #3 CVE-2026-87491 Severity: CRITICAL Description: Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, includin Product: Chromium V8 (Google) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-87491 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-09 Tags: kev,cisa,active-exploitation #4 CVE-2026-20079 Severity: CRITICAL Description: Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker t Product: Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management (Cisco) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-20079 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-09 Tags: kev,cisa,active-exploitation #5 CVE-2026-75650 Severity: CRITICAL Description: Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Product: Commerce and Magento (Adobe) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-75650 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #6 CVE-2026-81963 Severity: CRITICAL Description: Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. Product: Windows (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81963 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #7 CVE-2026-86218 Severity: CRITICAL Description: N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. Product: N-central (N-able) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86218 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #8 CVE-2026-85880 Severity: CRITICAL Description: Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. Product: Windows (Microsoft) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85880 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-08 Tags: kev,cisa,active-exploitation #9 CVE-2026-85046 Severity: CRITICAL Description: Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but Product: Chromium V8 (Google) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85046 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-04 Tags: kev,cisa,active-exploitation #10 CVE-2026-59822 Severity: CRITICAL Description: BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. Product: LiteLLM (BerriAI) Source: CISA KEV Catalog NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59822 URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog Date: 2026-09-02 Tags: kev,cisa,active-exploitation ============================================================================== [PHISHING URL] - 9 indicator(s) ============================================================================== #11 http://sso---secure-robinhood--coms.webflow.io/ Severity: CRITICAL Description: Active phishing URL: http://sso---secure-robinhood--coms.webflow.io/ Source: OpenPhish URL: http://sso---secure-robinhood--coms.webflow.io/ Date: Tags: phishing,openphish #12 http://www.transfer-to-click.vercel.app/ Severity: CRITICAL Description: Active phishing URL: http://www.transfer-to-click.vercel.app/ Source: OpenPhish URL: http://www.transfer-to-click.vercel.app/ Date: Tags: phishing,openphish #13 https://mail-email-ionos--refactored-octo-computing-machine-production.up.railway.app/ Severity: CRITICAL Description: Active phishing URL: https://mail-email-ionos--refactored-octo-computing-machine-production.up.railway.app/ Source: OpenPhish URL: https://mail-email-ionos--refactored-octo-computing-machine-production.up.railway.app/ Date: Tags: phishing,openphish #14 http://metamask-update.github.io/ Severity: CRITICAL Description: Active phishing URL: http://metamask-update.github.io/ Source: OpenPhish URL: http://metamask-update.github.io/ Date: Tags: phishing,openphish #15 https://pembatalan-pinjamaanz.vrr.my.id/ Severity: CRITICAL Description: Active phishing URL: https://pembatalan-pinjamaanz.vrr.my.id/ Source: OpenPhish URL: https://pembatalan-pinjamaanz.vrr.my.id/ Date: Tags: phishing,openphish #16 https://hjhbrl.com/cdq/11.php Severity: CRITICAL Description: Active phishing URL: https://hjhbrl.com/cdq/11.php Source: OpenPhish URL: https://hjhbrl.com/cdq/11.php Date: Tags: phishing,openphish #17 https://checkslogin.netlify.app/ Severity: CRITICAL Description: Active phishing URL: https://checkslogin.netlify.app/ Source: OpenPhish URL: https://checkslogin.netlify.app/ Date: Tags: phishing,openphish #18 https://www.metamask2-eight.vercel.app/ Severity: CRITICAL Description: Active phishing URL: https://www.metamask2-eight.vercel.app/ Source: OpenPhish URL: https://www.metamask2-eight.vercel.app/ Date: Tags: phishing,openphish #19 https://tiktok-coin-page.vercel.app/ Severity: CRITICAL Description: Active phishing URL: https://tiktok-coin-page.vercel.app/ Source: OpenPhish URL: https://tiktok-coin-page.vercel.app/ Date: Tags: phishing,openphish ============================================================================== [DOMAIN] - 9 indicator(s) ============================================================================== #20 sso---secure-robinhood--coms.webflow Severity: CRITICAL Description: Phishing domain: sso---secure-robinhood--coms.webflow Source: OpenPhish URL: http://sso---secure-robinhood--coms.webflow.io/ Date: Tags: phishing,openphish,domain #21 www.transfer Severity: CRITICAL Description: Phishing domain: www.transfer Source: OpenPhish URL: http://www.transfer-to-click.vercel.app/ Date: Tags: phishing,openphish,domain #22 mail-email-ionos--refactored-octo-computing-machine-production.up Severity: CRITICAL Description: Phishing domain: mail-email-ionos--refactored-octo-computing-machine-production.up Source: OpenPhish URL: https://mail-email-ionos--refactored-octo-computing-machine-production.up.railway.app/ Date: Tags: phishing,openphish,domain #23 metamask-update.github Severity: CRITICAL Description: Phishing domain: metamask-update.github Source: OpenPhish URL: http://metamask-update.github.io/ Date: Tags: phishing,openphish,domain #24 pembatalan-pinjamaanz.vrr Severity: CRITICAL Description: Phishing domain: pembatalan-pinjamaanz.vrr Source: OpenPhish URL: https://pembatalan-pinjamaanz.vrr.my.id/ Date: Tags: phishing,openphish,domain #25 hjhbrl.com Severity: CRITICAL Description: Phishing domain: hjhbrl.com Source: OpenPhish URL: https://hjhbrl.com/cdq/11.php Date: Tags: phishing,openphish,domain #26 checkslogin.netlify Severity: CRITICAL Description: Phishing domain: checkslogin.netlify Source: OpenPhish URL: https://checkslogin.netlify.app/ Date: Tags: phishing,openphish,domain #27 metamask2-eight.vercel Severity: CRITICAL Description: Phishing domain: metamask2-eight.vercel Source: OpenPhish URL: https://www.metamask2-eight.vercel.app/ Date: Tags: phishing,openphish,domain #28 tiktok-coin-page.vercel Severity: CRITICAL Description: Phishing domain: tiktok-coin-page.vercel Source: OpenPhish URL: https://tiktok-coin-page.vercel.app/ Date: Tags: phishing,openphish,domain ============================================================================== RECOMMENDED ACTIONS ============================================================================== 1. Search SIEM/network logs for all listed indicators 2. Block listed domains at DNS/proxy immediately 3. Scan endpoints for listed SHA256 hashes 4. Check email gateways for listed sender addresses/links 5. Block listed IP addresses at the firewall 6. Share IOCs with partner agencies and ISACs 7. Update detection rules (Sigma/YARA/Suricata/Splunk) 8. Monitor for indicator rotation (new domains, IP changes) ============================================================================== END OF IOC LIST - IOC-20260910-121536 ==============================================================================