Python SDK, YouTube DMCA Phishing Revisited, and ClickFix/Remus Research

Welcome back to Validin’s monthly newsletter and thank you for inviting us into your inbox. As always, we appreciate any feedback! - The Validin Team

PLATFORM UPDATES

💬 Introducing the Validin Python SDK

Validin has introduced a new Python SDK to support large-scale monitoring and enrichment workflows built on top of the Validin platform. The SDK includes bulk query and enrichment tools, along with ready-to-use monitoring scripts for ingesting data across Validin's data sources.

👉 Read the full product update blog here

IN CASE YOU MISSED IT

YouTube DMCA Phishing Infrastructure: Six Months Later

This month, Validin took a second look at a YouTube-themed DMCA phishing campaign, revisiting earlier pivots and uncovering new ones. The results show the campaign is still ongoing. Read the full write-up here.

Introducing a New Advanced Search Experience

Last month, Validin introduced its new Advanced Search experience, allowing analysts to combine search criteria across host response, registration, and DNS data. Read more here.

SPOT VALIDIN IN...

📸 ClickFix Removes Your Background but Leaves the Malware

Researcher Anna Pham at Huntress uncovered "BackgroundFix", a new variant of ClickFix that uses malicious background-remover sites and fake verification flows to trick victims into running malware. The campaign delivered a stealer targeting credentials, crypto wallets, Discord, and Telegram sessions. Read the full Huntress analysis here.

🗺️ Mapping Remus Infostealer

Researcher Vasilis Orlof maps Remus infostealer infrastructure and used Validin to connect shared certificate fingerprints, synchronized .biz registrations, and Ethereum smart contract pivots to an automated campaign with multiple live C2 domains. Read the full writeup here.

BY THE NUMBERS

Top-viewed threat actor profiles and how their ranking changed from last month. If you're logged into Validin, you can view the full profiles:

1. Kimsuky (+2)
2. ClickFix
3. Lazarus Group (+2)
4. Fake Software Downloads (-3)
5. Scattered Spider (new)