Last Updated: 2026-09-12T15:06:12Z (UTC) What’s Happening While reviewing some recent ClickFix/Etherhiding domains on ThreatFox, I noticed a bizarre sample with weirdo strings in it. Turns out it was part of the Lorem Ipsum malware family, which uses nonsense strings as a sort of encoding mechanism for its C2 commands. This is a known technique. Also known is the use of letsdiskuss[.]com, an Indian social media site, to host C2 data. For example, this user profile. The malware’s ...