TONResolver RAT LNK-in-ZIP Delivery via photo-*.cfd Phishing Domain

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.