aksiyononline.best: a server handing out PowerShell stubs for MassLogger and VIP Keylogger, and what to do if a script fetched them

What aksiyononline.best is, and what we know about it

aksiyononline.best is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was handed out: PowerShell scripts named Crypted.ps1 and secured_stub.ps1, and one JavaScript file. Three of the thirteen entries are tagged MassLogger and one VIPKeylogger, Windows keyloggers that steal saved passwords.

We found no public write-up of this one address, so this page sets out what URLhaus shows, what our own request returned, and what security vendors have published about these families and how they are delivered.

1. 1

   What URLhaus lists

   Thirteen file addresses on aksiyononline.best, each in its own folder with a short made up name such as masabikk6, princee255, frndmass1 or cattt25. One was added on 30 September 2026. The other twelve were added within about two minutes on the morning of 6 October 2026, between 08:12 and 08:14 UTC. Every entry carries the threat label malware_download and the reporter abuse_ch.

2. 2

   What the file names say

   Eleven of the files end in .ps1, the ending of a Windows PowerShell script. Six are called Crypted.ps1 and six secured_stub.ps1 (one of those is the September entry). The thirteenth is a JavaScript file with a long random name in the folder cattt25/cat. A stub, in this trade, is the small piece that unpacks and starts the real malware. Crypted is the word sellers of so called crypters use for malware wrapped to get past antivirus. The names fit that use; they do not prove what is inside.

3. 3

   What the tags mean

   powershell, ps1, js and ascii describe the file type: plain text scripts. opendir means the folders could be listed by anyone, which is how so many files were found together. MassLogger is on three entries: the JavaScript file, masabikk4/secured_stub.ps1 and masabikk6/secured_stub.ps1. VIPKeylogger is on one: masabikk6/secured_stub.ps1, the only file still marked online when we read the data.

4. 4

   What we could not confirm

   We did not download any of the files, so we cannot tell you exactly what each script does, which keylogger build it ends in, or where that build sends what it takes. URLhaus tags are the reporter's labels, not a proof. We also do not know which email or file makes a victim's PC ask for these scripts: that first step happens on the victim's side and is not visible from the server.

5. 5

   What this means for you

   If you only saw the name in a firewall log, a DNS log or a blocked request, you are not infected by that alone. The risk is for a Windows PC where a script or attachment already ran and asked for one of these files. Nobody browses to a folder like masabikk6 by hand.

Kind of threat

A server that hands out PowerShell and JavaScript loader files; three are tagged MassLogger and one VIPKeylogger, keyloggers and password stealers for Windows

Where the files are

hxxps://aksiyononline[.]best/<folder>/Crypted.ps1 or secured_stub.ps1, plus one .js file in cattt25/cat

Domain registered

28 July 2026 through Spaceship, Inc., status active (RDAP, read 6 October 2026)

URLhaus entries

13 file addresses: 1 added 30 September 2026, 12 added 6 October 2026; 1 online and 12 offline when we read the data

Home page

Answered our plain request with HTTP 200 and a page titled Application placeholder, served through Cloudflare

Platform

Windows. PowerShell stubs, MassLogger and VIP Keylogger are Windows programs; nothing we read says Mac, iPhone or Android are affected

What we checked on 6 October 2026, and what we could not

Our server sent one plain request to the home page of aksiyononline.best on 6 October 2026. It was not a browser visit: nothing was clicked, no scripts on the page ran, and no screenshot was taken. The answer was an ordinary page titled Application placeholder. That clears nothing, because the reported files sit in subfolders, not on the home page.

What happened to aksiyononline.best, from registration to our check

The domain is about ten weeks old. The dates below come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 28 July 2026

   The domain is registered

   RDAP shows aksiyononline.best registered on 28 July 2026 through Spaceship, Inc. The name reads like a Turkish news or shopping title (aksiyon is Turkish for action), but we found nothing that ties it to any real business, and we do not draw conclusions from the name.

2. 30 September 2026

   The first file is reported

   At 15:00 UTC abuse.ch adds mrmasabikfrnd/secured_stub.ps1, tagged ascii, opendir, powershell and ps1. It is offline by the time we read the data.

3. 6 October 2026, 08:12 UTC

   The one file still online

   masabikk6/secured_stub.ps1 is added with the tags MassLogger and VIPKeylogger as well as opendir and powershell. It is the only one of the thirteen still marked online when we read the data later that day.

4. 6 October 2026, 08:13 to 08:14 UTC

   Eleven more files in two minutes

   Ten more PowerShell files and one JavaScript file are added, each in its own folder. masabikk4/secured_stub.ps1 and the JavaScript file in cattt25/cat are tagged MassLogger. All eleven are offline when we read the data.

   

5. 6 October 2026, evening

   Our check

   Our server's plain request to the home page gets HTTP 200 and a placeholder page through Cloudflare.

What the pattern suggests, and what it does not: many folders with names like masabik, frndmass and prince, each holding the same two file names, look like one operator preparing copies of the same stub for several buyers or campaigns, then pulling most of them again within hours. That is our reading of the names and dates, not something any report says.

How a PowerShell stub turns into a keylogger

A .ps1 file on a server cannot hurt you by sitting there. It works only when something already running on the PC downloads it and hands it to PowerShell. We did not see the files on aksiyononline.best; this is how Splunk and Seqrite describe the chain for VIP Keylogger.

1. 1

   A lure arrives by email

   Splunk (13 May 2026) describes phishing lures such as fake bank payment notices. Seqrite's VIP Keylogger white paper describes an email posing as a buyer, with an RTF document named like an order inquiry. Opening the document makes it connect to a web address and fetch a script.

2. 2

   A first script runs

   Splunk reviewed more than 200 loader samples from March and April 2026 and found VBS, JavaScript and batch files with heavy junk code. In Seqrite's chain a first VBScript decrypts an address and downloads a second VBScript, which then starts PowerShell.

3. 3

   PowerShell fetches the next stage

   This is where a file like Crypted.ps1 or secured_stub.ps1 fits. Splunk found the decoded PowerShell script being written into a user environment variable and run from there, so no script file needs to stay on the disk.

4. 4

   The loader is pulled out of hiding

   Splunk describes PNG pictures whose hidden part starts at a marker and is decoded from reversed base64. Seqrite describes picture files with the markers BASE64_START and BASE64_END around a .NET library. The library is loaded straight into memory.

5. 5

   The keylogger runs inside a trusted program

   Splunk saw the final payload injected into aspnet_compiler.exe; Seqrite saw dxdiag.exe used for process hollowing, where a genuine Windows program is started and its contents replaced. In Task Manager the keylogger then wears a Microsoft name.

Because every stage after the first is a script or a file loaded into memory, there may be very little to find on the disk afterwards. That is why the advice on this page starts with your accounts, not with a file hunt.

What MassLogger and VIP Keylogger are

Both names stand for commercial keyloggers written in .NET for Windows. They are sold to criminals, not written by one group, so the same family turns up behind many different servers. Vendors treat VIP Keylogger as a close relative of Snake Keylogger, and URLhaus put the MassLogger and VIPKeylogger tags on the same file here.

What these keyloggers take from a Windows PC

A keylogger of this kind works on its own once it runs: it collects and sends without anyone watching. Each item below is named by at least one of the sources; which ones a given build collects depends on how the buyer set it up.

What this can cost you

Seeing the name costs nothing. The risks below apply to a Windows PC where a script fetched one of these files and the keylogger then ran.

• High

  Passwords and accounts

  Saved browser passwords go out in the first minutes, and every new password typed afterwards is recorded too. Changing passwords on the infected PC hands the new ones over.

• High

  Logged in sessions

  Stolen cookies can let someone use an account that is already signed in, sometimes without the password or the second sign in step. Signing out of all sessions matters as much as the new password.

• High

  Cards and crypto

  Seqrite lists saved card details; Splunk describes clipboard swapping of wallet addresses, so a payment you paste can go to the wrong wallet. Crypto sent that way cannot be reversed.

• Medium

  Work email and company access

  The lures are business themed (orders, payments), and Outlook credentials are on every list. A work mailbox taken this way is often used for invoice fraud against your contacts.

• Medium

  Your Wi-Fi and other devices

  Saved Wi-Fi passwords are taken, so the network itself is known to the attacker.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

These keyloggers are built to stay quiet. The signs below come from the sources and from what they imply; none is certain, and most victims notice nothing until an account is misused.

How a person ends up asking for these files

Nobody visits aksiyononline.best on purpose. The request comes from a script on the PC, so the real question is how that script got there. We cannot say for this server; the routes below are the ones the vendors found for the same families.

1. 1

   A business email with an attachment

   Seqrite describes an order inquiry with an RTF file; Fortinet describes an Excel file called swift copy claiming money was sent to you; Splunk describes fake bank payment alerts. Opening the attachment is the step that starts it.

2. 2

   A script inside an archive

   Splunk's loaders are VBS, JavaScript and batch files. They usually arrive packed in an archive or attachment and look like a document if file endings are hidden in File Explorer.

3. 3

   Cracked software

   Seqrite notes that the same kind of keylogger is also spread through software cracks.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact aksiyononline.best, or did you open an unexpected attachment, script or archive in the last weeks? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto. Use a phone or another computer for anything that needs a password.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A keylogger needs the connection to send what it took.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for Trojan:MSIL/Masslogger!MTB, any detection with PowerShell or a script in its name, or anything blocked around the time of the first contact.

4. 4

   Look at what starts with Windows

   Open Settings > Apps > Startup and look for names you did not install. Then open Task Scheduler and look in Task Scheduler Library for tasks with odd names that run PowerShell, wscript or a program from a user folder. Write down what you find; do not delete yet.

5. 5

   Look for the logon script value

   Splunk found VIP Keylogger in the value UserInitMprLogonScript under HKEY_CURRENT_USER\Environment. Open Registry Editor, go to that key and see whether the value exists. On most home PCs it does not. While you are there, look for any other value with a very long text.

6. 6

   Look for trusted programs that should not be running

   Open Task Manager and look for aspnet_compiler.exe, dxdiag.exe, RegSvcs.exe or a PowerShell process running with no reason. Right click and choose Open file location to see where it lives. Their presence is not proof, and their absence does not clear the PC.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank, work and exchange accounts, and at mail forwarding rules. This is faster and more telling than any file check.

8. 8

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result as one data point. No vendor publishes a removal procedure for this server's files and we did not infect a PC, so the order of the plan is our judgement from Microsoft's pages and the vendor reports, not a tested result.

If you use a Mac, an iPhone or an Android phone

The file types, the tags and every source we read describe a Windows threat. We found nothing that says the files on aksiyononline.best affect anything else.