Updated the @ifin@infosec.exchange thread here. Blackfile-suspected list (attached) up to 59. Medium-high confidence. Also attached CSV of 134 domains connected or adjacent to Blackfile/ShinyHunters from Sept 11-14, all worth blocking preemptively. The following is provided for intelligence purposes only, inclusion does not necessarily indicate criminality. New activity: passkeyoptions[.]com (Fleetcor, Bainco, Global-E, Dechert, Lendio, BigCommerce, Ring) register-passkeys[.]com (Ciena) installpasskey[.]com (Billcom) Newly seen: Blackfile/Helix campaign high confidence: add-mfa[.]com hashkey-exchange[.]com passkey-auth[.]com Medium confidence: globalkeysec[.]com https://ifin.network/t/blackfile-related-emerging-domains/826/9?u=neurovagrant