A seemingly rare phishing kit that targets Iran’s Keshavarzi Bank (Agribank) users and steals their login + OTP.
A Python script used for sending love messages to any Telegram bots used for exfiltration of stolen data or other cybercrime activity.
X-SniPer phishing kit even tries to steal the victim’s mobile phone carrier PIN to perform a SIM swap attack to “bypass” 2FA.
The malicious domain restore-metamask.com was used to steal existing crypto wallets of metamask.io users. It also allowed new wallets to be created and cryptocurrencies deposited to the new wallet, but it would ultimately go to the attackers.
Utoxic is very likely xcazanova, or at minimum very close to him based on the evidence I will show. A leopard don’t change its spots.