KeePass malvertising campaign (01-11-2026)
- Description: Malicious Google Search ad for KeePass
- Severity: Medium
- Reporter: Jérôme Segura
- Reported to Google: 01/11/2026
Google Search Ad
Traffic view
Fake Cloudflare
Decoy page
Payload
IOCs
| Cloaking domain | hxxps[://]www[.]magyarrobot[.]hu/ |
| Decoy wbesite | hxxps[://]keepacexc[.]com/ |
| Payload URL | hxxps[://]keepacexc[.]com/dl[.]php?w=ok |
| Payload SHA256 | 94307191dba3962e5dc121fa2a984a784a951af0c0fc9229571898667e320578 |