SmartApeSG - WidgetTicks Decoded Target URL Call

Ibrahim Saud@tektrix

•updated Jun 19, 2026•0•0•1

Detects network events to the obfuscated api.wigetticks.com domain dynamically resolved by a potentially compromised Okendo script. This rule specifically looks for connections to 'api.wigetticks.com/logout/private-response.php' originating from common browser processes (chrome.exe, msedge.exe) or PowerShell, indicating a potential supply chain attack.