Hidden iframe loads /config.html exploit loader from decoy site

Ankit Mehta@Secvyn

•updated Sep 22, 2026•0•0•2

Detects outbound network connections to specific IOCs associated with UTA0565 threat activity, including the use of an exploit-loader path (/config.html) on impersonated decoy sites.