Loki Coyote lokkju

Cloaked two-tier recovery-phrase phishing against Ledger and OKX users

Brief, 26 October 2026. Observed 25 to 26 October; public scan data from 27 September. The full report and the .iocs.txt indicator file are the other two files of this gist.

Flow (drawn on the printed page): phishing mail with a SurveyMonkey or Alchemer link → redirector nanosplus.at/‹token› (logs the click per IP; 18 domains, one build) → cloaking check (IP reputation, per-domain rules) → denied: wikipedia.org, every scanner and every datacenter IP; allowed: device.‹word›-ledger.‹tld›, 24 words to a live operator panel.

What it is

A phishing mail links to a short token path on a fresh .at or .to domain. That domain runs a self-hosted Next.js redirector that logs the click, asks a commercial cloaking service whether the visitor is a real person on a residential connection, and forwards only those visitors to a Ledger Live (or OKX) lookalike that collects the 24-word recovery phrase while an operator watches in a live p

Creating a custom ESXi install ISO for HPE gen7 servers

Avoids broken smx driver that is present in the HPE 6.5 U3 image.

All below powershell commands must be run in a VMWare PowerCLI (version 6.5) session

Download the HPE PreGen9 Custom Image for ESXi 6.5 U3 Offline Bundle from https://customerconnect.vmware.com/downloads/details?downloadGroup=OEM-ESXI65U3-HPE&productId=614
Download the smx provider:
wget https://vibsdepot.hpe.com/sdx/downloads/nov2016/gen9v4/esxi-600-vibs/hpe-smx-provider/hpe-smx-provider-600.03.11.00.9-2768847.vib
Add the original 6.5 iso as a depot:

from https://www.rooselaers.be/

for Nvidia GPU

wget https://developer.nvidia.com/compute/cuda/10.1/Prod/local_installers/cuda_10.1.168_418.67_linux.run

sudo sh cuda_10.1.168_418.67_linux.run

Un-check the "Driver" block and then select "Install" and hit "Enter".

┌──────────────────────────────────────────────────────────────────────────────┐

	#!/usr/bin/env python3
	"""
	Reconstruct git history from multiple versions of a Markdown file and a changelog TSV with date and description.
	Reads <name>_version_history.txt and creates commits for each version in chronological order.

	This tool is intended to convert exported markdown docs from each version of a Google Docs Document in a single Markdown document with a git commit history of changes.

	Usage: ./reconstruct_history.py <name>
	Example: ./reconstruct_history.py my_file
	"""

	meta:
	id: hs17
	file-extension: hs17
	endian: be

	seq:
	- id: packet
	type: ccsds_packet
	repeat: expr
	repeat-expr: 6

	# ssh -A hadoop@<masternode>
	# SCRIPT=<yourscriptfile.sh>
	declare nodes=`yarn node -list 2> /dev/null \| grep internal \| cut -d' ' -f1 \| cut -d: -f1`
	for node in $nodes
	do
	ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null hadoop@$node 'bash -s' < $SCRIPT
	done

	import java.time.temporal.{ChronoUnit, Temporal, TemporalAmount}
	import java.time.{Duration, Period}
	import scala.concurrent.duration.FiniteDuration

	object DatesUntilImplicits {

	implicit class DatesUntilExtensions[T <: Temporal with Comparable[_]](val start: T) {
	def datesUntil(end: T, step: TemporalAmount): Iterator[T] = {
	Iterator.iterate(start) {
	_.plus(step).asInstanceOf[T]

	AA:
	codes:
	F: {award_mod: 1.0, bonus_mod: 1.0, qm_mod: 3.0, eqd_mod: .40, eqs_mod: 1.0, name: First}
	A: {award_mod: 1.0, bonus_mod: 1.0, qm_mod: 2.0, eqd_mod: .40, eqs_mod: 1.0, name: First}
	J: {award_mod: 1.0, bonus_mod: 1.0, qm_mod: 3.0, eqd_mod: .40, eqs_mod: 1.0, name: Business}
	R: {award_mod: 1.0, bonus_mod: .75, qm_mod: 2.0, eqd_mod: .35, eqs_mod: 1.0, name: Business}
	D: {award_mod: 1.0, bonus_mod: .50, qm_mod: 2.0, eqd_mod: .30, eqs_mod: 1.0, name: Business}
	I: {award_mod: 1.0, bonus_mod: 0.0, qm_mod: 2.0, eqd_mod: .20, eqs_mod: 1.0, name: Business}
	W: {award_mod: 1.0, bonus_mod: 0.0, qm_mod: 1.5, eqd_mod: .20, eqs_mod: 1.0, name: Premium Economy}
	P: {award_mod: 1.0, bonus_mod: 0.0, qm_mod: 1.5, eqd_mod: .20, eqs_mod: 1.0, name: Premium Economy}

	from itertools import count
	from string import ascii_letters

	_cidx = dict(zip(ascii_letters, count(1)))

	def decipher(key,enc,rot):
	"""
	Deciphers Vigenere cipher with the given key and rotated alphabet

	Parameters: