Reports Reports

The Fake Zero-Day Trap: How a Crypto Exploit Became a Wallet Hijacking Scheme

This report is about ‘PHP2Shell’.

Download Report

ThreatMon identified a suspicious campaign across dark web forums and Telegram channels promoting a fake zero-day vulnerability in the Changelly cryptocurrency exchange. The campaign used misleading claims of profitable cryptocurrency swaps to lure users into executing malicious JavaScript.

The investigation uncovered a multi-stage JavaScript payload designed to intercept exchange API requests, replace destination wallet addresses, and manipulate displayed transaction values. While these capabilities were identified, no confirmed cryptocurrency theft or victim transactions were observed.

PHP2Shell

Relevant Reports

We see the full picture of the evolving cyber threat landscape thanks to unique tools for monitoring the infrastructure used by cybercriminals and data from battlefields:

The Fake Zero-Day Trap-How a Crypto Exploit Became a Wallet Hijacking Scheme

Stealer/Malware

The Fake Zero-Day Trap: How a Crypto Exploit Became a Wallet Hijacking Scheme

ThreatMon's investigation uncovered a cryptocurrency transaction hijacking campaign disguised as a Changelly...

C2 Environment and Targeted Data Extraction_TLPWhite

Global Threat

C2 Environment and Targeted Data Extraction

ThreatMon investigates a suspected C2 environment targeting five organizations in Mexico, uncovering...

CCDS C2 Infrastructure and Payload Analysis

Stealer/Malware

CCDS C2: Infrastructure and Payload Analysis

ThreatMon investigates the CCDS C2 framework, uncovering remote command execution, agent management,...

ThreatMon From Underground Forums to SOC: PHP2Shell

Global Threat

ThreatMon From Underground Forums to SOC: PHP2Shell

PHP patched the two original PHP2Shell vulnerabilities on 21 October 2026, but underground discussion...

Ransomware Threat Landscape in Türkiye

Global Threat

Ransomware Threat Landscape in Türkiye

The report examines six ransomware and data-extortion claims involving organizations in Türkiye: Ömür...

Mosad Threat Actor Report

Threat Actor

Mosad Threat Actor Report

Mosad is an underground actor primarily involved in the trade and disclosure of sensitive information...