VBScript downloader beaconing to imageurlgenerator[.]com for staged .txt/ZIP pay

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•4

Detects network communication to 'imageurlgenerator.com' where a VBScript downloader is attempting to retrieve a staged payload. The request pattern targets specific URI structures resembling GUID-based identifiers ending in '.txt', which is characteristic of the XHOPLESS malware delivery chain.