cablewireltd.site: a Windows VIP Keylogger host serving Crypted.ps1 PowerShell files, and what to do if one ran

What cablewireltd.site is, and what we know about it

cablewireltd.site is not a program on your PC. It is a web address where, according to the abuse.ch project URLhaus, nine malware files were hosted in September 2026: seven PowerShell scripts all called Crypted.ps1 and two JavaScript files with long random names. Three of the PowerShell files are tagged VIPKeylogger, a password and keystroke stealer for Windows. We found no public write-up of this one address, so this page sets out what URLhaus lists, what our server saw, and what researchers have published about VIP Keylogger and its loaders.

1. 1

   What URLhaus lists

   Nine file addresses on cablewireltd.site, each inside its own folder. The folders carry names such as masabik23, mrprince, prince23, masfrnd and frndmass244. Seven hold a file named Crypted.ps1; one folder, ppriincefil21, holds two .js files. All nine were added between 23 and 24 September 2026, all carry the label malware_download and the reporter is abuse_ch.

2. 2

   What the tags mean

   ps1 and powershell mean the file is a PowerShell script, a plain text program that Windows can run. js means JavaScript, which Windows can run outside a browser when a person opens the file. ascii means the content is readable text. opendir means the folder could be listed by anyone who asked, which is how so many files were found at once. VIPKeylogger is the name of the malware family the reporter linked to three files.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot say which VIP Keylogger build they lead to, where it sends stolen data, or whether the six files without the family tag do the same thing. We also do not know which email or download made a victim's PC ask for these files.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a DNS log or a browser warning, that alone is not an infection. The risk is for a Windows PC where a script was opened and went to fetch one of these files. A normal visitor has no reason to request a file called Crypted.ps1.

Kind of threat

A malware host serving PowerShell and JavaScript stages; three files tagged VIPKeylogger, an information stealer for Windows

Where the files were

hxxps://cablewireltd[.]site/<folder>/Crypted.ps1 and two .js files in /ppriincefil21/

Domain registered

21 September 2026 through Spaceship, Inc.; the registry status now shows server hold (RDAP, read 10 October 2026)

URLhaus entries

9 file addresses added on 23 and 24 September 2026; all 9 offline when we read our copy of the data

Delivery trick

Script stages that fetch further code; VIP Keylogger chains hide the last parts in image files. The first step on a victim's PC is not known

Platform

Windows. PowerShell stages and the .NET stealer are Windows software. Nothing we read says Mac, iPhone or Android are affected

What we checked on 10 October 2026, and what we could not

Our server asked for cablewireltd.site once on 10 October 2026 with a plain request. The name did not resolve at all: the answer was getaddrinfo ENOTFOUND, which means no DNS server gave an address for it. That fits the registry status server hold, which takes a domain out of the DNS. It clears nothing about the files that were served in September.

What happened to cablewireltd.site, from registration to our check

The whole life of this address fits into three days of activity and a quick shutdown. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 21 September 2026

   The domain is registered

   RDAP shows cablewireltd.site registered on 21 September 2026 at about 12:18 UTC through Spaceship, Inc. The name sounds like a cable and wire company, a common way to make a malware host look like a business.

2. 23 September 2026, morning

   Five files are reported

   At about 08:09 and 08:10 UTC abuse.ch adds Crypted.ps1 in the folders masabik23, mrprince and masfrnd, and two long .js files in ppriincefil21. The file in masabik23 is tagged VIPKeylogger. All five carry the opendir tag, so the folders were open to browse.

3. 23 September 2026, afternoon

   Three more PowerShell files

   At about 13:59 UTC Crypted.ps1 is added in prince23, masabik232 and massfrnd232. The one in masabik232 is tagged VIPKeylogger. The new folder names are the old ones with a number added, which looks like fresh batches.

4. 24 September 2026

   The last file

   At about 13:41 UTC Crypted.ps1 in frndmass244 is added, again tagged VIPKeylogger. No later report exists in our data.

   

5. 10 October 2026

   Our check

   All nine entries are marked offline. The domain shows server hold in RDAP and our server cannot resolve the name.

Our reading of the pattern, not a statement from any report: folder names such as prince, mrprince, ppriincefil21 and masabik look like labels for different customers or campaigns of the same operator, each given its own copy of the stage. That is common when a loader is sold or shared, but we cannot prove it here.

What VIP Keylogger is

VIP Keylogger is a stealer written in .NET for Windows. Seqrite describes it as similar to Snake Keylogger, almost down to the variable names. Splunk's Threat Research Team studied more than 200 of its script loaders captured between March and April 2026 and published the results on 13 May 2026.

How a Crypted.ps1 file fits into the infection chain

A file named Crypted.ps1 is a middle step. It does nothing unless something already on the PC downloads it and runs it. The two .js files on the same host are the kind of first step that does that. This is how the researchers describe the chain; we did not see it run from this host.

1. 1

   A person opens an attachment

   Splunk's samples start with a .vbs, .js or .bat file sent as if it were an order or a payment notice. Seqrite's start with an RTF document named like an order inquiry. Double clicking the file is the step that starts everything.

2. 2

   The script calls PowerShell

   Splunk found the .js loaders heavily obfuscated, pulling a PowerShell stager that is unpacked with base64 and AES. In the .vbs path, the PowerShell code is written into a user environment variable called INTERNAL_DB_CACHE, run, and deleted.

3. 3

   The PowerShell stage downloads pictures

   Splunk's stager downloaded two .png files. The script looks for the markers IN- and -in1, swaps every # for A, reverses the text and decodes it. The result is not a picture at all but the next program.

4. 4

   The stealer is loaded into a trusted program

   Splunk saw VIP Keylogger injected into aspnet_compiler.exe, a normal .NET tool. Seqrite saw a loader start dxdiag.exe and swap its contents. In Task Manager the stealer then wears a Microsoft name.

5. 5

   The data leaves, and the file may vanish

   The stealer sends what it found to a Telegram bot or a server. Both reports describe it deleting itself afterwards. Splunk saw a hidden command prompt use choice.exe for a three second pause before the file is removed.

The nine files: what each name suggests, and what we do not know

File names and tags are weak evidence. The third column below is our reading and is marked as such.

What VIP Keylogger takes from a Windows PC

Unlike a remote access trojan, a stealer does not wait for a person to sit at your PC. It collects and sends in one go, often within a minute of starting. Everything below is named in the Splunk or Seqrite analysis.

What this can cost you

Seeing the name costs nothing. The risks below apply to a Windows PC where a script from this host ran and the stealer started.

• High

  Your accounts

  Saved passwords and live session cookies let someone sign in as you, sometimes without needing the password again. Email is the most dangerous loss, because it resets everything else.

• High

  Money and crypto

  Saved cards can be used online. Splunk describes the clipboard swap: you paste a wallet address and the stealer has quietly put its own there. Crypto sent that way cannot be reversed.

• High

  Work mail

  These campaigns target businesses with order and invoice lures. Stolen Outlook logins are used for invoice fraud against your customers and suppliers.

• Medium

  Your home or office network

  Wi-Fi passwords leave the building with the rest of the data. Anyone near your premises could then join the network.

• Medium

  Discord and Telegram

  Tokens and session data let someone post as you and send the same lure to your contacts.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

A stealer is built to finish its work before anyone notices. Most people learn of it from their accounts, not from the PC.

How a person ends up fetching files from this host

Nobody types cablewireltd.site into a browser. The request comes from a script. We do not know which email or download pointed to this host; the routes below are the ones the researchers found for VIP Keylogger.

1. 1

   A business email with an attachment

   Splunk lists bank payment notifications, procurement orders and logistics updates as the lures. The attachment is a script file, sometimes inside an archive, with a name that reads like a document.

2. 2

   An Office or RTF document

   Seqrite describes an email from a supposed buyer with an RTF file named as an order inquiry. Opening it made the PC download a VBScript, which led to PowerShell and a picture hiding the loader.

3. 3

   Cracked software

   Seqrite's conclusion adds software cracks as a route. A crack that runs a script in the background can start the same chain.

Check your PC before you delete anything

Start with one question: did you open an unexpected attachment, a .js, .vbs or .bat file, or a cracked program around 23 and 24 September 2026, or did a log show a device asking for cablewireltd.site? If yes or not sure, do the checks below. None of them deletes anything.

While you check, do not use the PC for email, banking, work or crypto. A stealer may already have taken what it wanted, but a logon script can run it again at the next sign in.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable on the PC in question. The stealer needs the connection to send data.

2. 2

   Find which device asked for the address

   If you came from a router page, a DNS log or a security alert, note the device and the time. Only that device is in question.

3. 3

   Look for the logon script value

   Press Windows key + R, type regedit and open HKEY_CURRENT_USER\Environment. Look for a value named UserInitMprLogonScript and for any unusually long value such as INTERNAL_DB_CACHE. Splunk names both. Write down what the logon script points to; do not delete yet.

4. 4

   Look in the user folders

   Open %appdata%\Microsoft\Windows\Libraries in File Explorer and look for script files that are not library files. Splunk found the .bat path dropping a hidden file there. Also look in Documents for a VIPRecovery folder.

5. 5

   Check Startup apps and Task Scheduler

   In Settings > Apps > Startup look for names you did not install. Then press Start, type Task Scheduler and look in Task Scheduler Library for tasks that run PowerShell, wscript or a script from a user folder. Seqrite's loader had options for a startup task and a startup registry entry.

6. 6

   Look at running programs

   Open Task Manager and look for aspnet_compiler.exe or dxdiag.exe running when you did not start them. Right click and choose Open file location to see where they run from. Their presence alone proves nothing.

7. 7

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything found or blocked around the time you opened the file, especially names with VIPKeylogger, Snake or PowerShell in them.

8. 8

   Check your accounts from another device

   Look at the recent sign in activity of your email, bank, work, Discord and Telegram accounts. This tells you faster than any file check whether data was used.

Scan from outside Windows with Microsoft Defender Offline

Microsoft Defender Offline starts from a trusted environment outside the normal Windows, so malware running inside Windows cannot hide from it as easily. It is built into Windows 10 version 1607 and later and into Windows 11 on x64 PCs.

1. 1

   Prepare

   Save your work and close programs. Microsoft says the scan takes about 15 minutes and restarts the PC. You need a local administrator account, and the Windows Recovery Environment must be on: in an administrator Command Prompt, reagentc /info shows the state and reagentc /enable switches it on. With it off, Microsoft says, nothing happens and no error shows.

2. 2

   Suspend BitLocker if it is on

   Microsoft warns that with BitLocker on the system drive, the restart into the scan may ask for the recovery key. Suspend protection first, or have the key ready.

3. 3

   Start the scan

   Open Windows Security > Virus & threat protection > Scan options, choose Microsoft Defender Offline scan and select Scan now. Confirm the prompts. Windows signs you out, scans and boots back normally. In an administrator PowerShell window, Start-MpWDOScan does the same.

4. 4

   Read the result

   After the restart open Windows Security > Virus & threat protection > Protection history. Microsoft notes the offline scan is not available on ARM versions of Windows and only updates when Microsoft Defender Antivirus is your main antivirus.

5. 5

   A clean scan is not the end

   A stealer may have run once, sent its data and deleted itself. No scan can undo that. The account steps below matter more than the scan result.

If you use a Mac, an iPhone or an Android phone

The files on cablewireltd.site are PowerShell and Windows script stages, and VIP Keylogger is a .NET program for Windows. Nothing we read says it affects other systems.