flocmaterials.shop: a new server that handed out PowerShell scripts for VIP Keylogger, and what to do if one ran

What flocmaterials.shop is, and what we know about it

flocmaterials.shop is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists six times, between 5 and 6 October 2026, for PowerShell scripts tagged VIPKeylogger, and two of them also MassLogger. Both names belong to Windows keyloggers that steal passwords. We found no public write-up of this one address, so what follows is what URLhaus shows, what our server saw when it asked for the front page, and what security vendors have published about the malware families named in the tags.

1. 1

   What URLhaus lists

   Six file addresses on flocmaterials.shop, each in its own folder with a short odd name (nzzee6, ceofrnd29, myceo30, ceofrnd1, mrceofrnnd, nzeceo) and each called secured_stub.ps1. A .ps1 file is a PowerShell script, a text file of commands that Windows can run. Five were added on 5 October 2026 within two minutes of each other, and one more on 6 October 2026. All six carry the threat label malware_download and the reporter abuse_ch.

2. 2

   What the tags mean

   VIPKeylogger is on all six, MassLogger on two. powershell and ps1 say what kind of file it is. ascii says the file is plain text. opendir means the folder could be listed in a browser, an open directory, which is how such files are often found by researchers.

3. 3

   Where the files are now

   In the data we read on 6 October 2026, all six entries are marked offline. That means the files no longer answered when URLhaus checked them. It does not mean a PC that already ran one is clean, and the same operator can put new files up at any time.

4. 4

   What this means for you

   If you only saw the name in a list, a log or a news item, nothing on your PC is proven. If a script, an email attachment or a program on your Windows PC asked for one of these addresses, treat the PC as possibly running a keylogger and follow the plan below.

Kind of threat

A server that handed out PowerShell scripts tagged VIPKeylogger, two also tagged MassLogger; both are Windows password stealers

Where the files were

hxxps://flocmaterials[.]shop/<folder>/secured_stub.ps1, six folders, all offline when we read the data

Domain registered

28 September 2026 through Spaceship, Inc., status client transfer prohibited (RDAP, read 6 October 2026)

First and last report

5 October 2026 09:13 UTC and 6 October 2026 08:05 UTC

Front page today

HTTP 200 from a Cloudflare server with the page title Application placeholder (a plain request from our server on 6 October 2026)

Platform

Windows. PowerShell scripts and both malware families are described only for Windows

What we checked on 6 October 2026, and what we could not

Our check was one plain request from our server to the front page of flocmaterials.shop, with no browser, no clicks and no attempt to fetch the reported scripts. It answered, but an answer like that clears nothing: a malware server can show an empty page at its front door and keep its files in folders nobody is meant to guess.

What happened to flocmaterials.shop, from registration to our check

The domain is only days old, and the reports came within a week of the registration. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 28 September 2026

   The domain is registered

   RDAP shows flocmaterials.shop registered at 21:25 UTC on 28 September 2026 through Spaceship, Inc. The name reads like a shop for building or craft materials. We found no shop of that name behind it.

2. 5 October 2026, 09:13

   The first script is reported

   URLhaus adds hxxps://flocmaterials[.]shop/nzeceo/secured_stub.ps1, tagged VIPKeylogger and MassLogger, reporter abuse_ch.

3. 5 October 2026, 09:14

   Four more scripts in one minute

   Four further folders (ceofrnd29, myceo30, ceofrnd1, mrceofrnnd) are added, each with the same file name secured_stub.ps1, all tagged VIPKeylogger.

4. 6 October 2026, 08:05

   A sixth script

   One more, in the folder nzzee6, tagged VIPKeylogger and MassLogger. Like the others, it is marked offline in the data we read.

5. 6 October 2026

   Our check

   Our server asked for the front page once and got a Cloudflare placeholder page. We read the RDAP record the same day.

What the pattern suggests, and what it does not: a new domain, a name that looks harmless, many folders with the same file inside and reports within days are what disposable delivery servers often look like. That is our reading of the dates and names, not something any report on this domain says. The folder names with ceo in them may hint at lures aimed at company staff, but we found nothing that confirms it.

How a PowerShell stub fits into a keylogger attack

A .ps1 file does not infect a PC by being listed on a web page. It does harm when something already running on the PC downloads it and starts PowerShell with it. We did not see a victim's PC; this is how Splunk and Forcepoint describe the chain for VIP Keylogger.

1. 1

   An email with a reason to open it

   Splunk (13 May 2026) says the lures pose as bank payment notifications, procurement orders and logistics updates. Forcepoint (13 December 2024) describes emails with RTF files that look like Office documents.

2. 2

   A first script runs

   Splunk describes VBS, JavaScript and batch files padded with junk code so scanners miss them, which decode a PowerShell stager. Forcepoint describes RTF files that abuse CVE-2017-11882, an old flaw in Microsoft Office, to download the next file.

3. 3

   PowerShell fetches the next part

   A file called secured_stub.ps1 fits this step by name and type. A stub is a small piece of code whose job is to fetch or unpack the real program. We did not read these files, so we cannot say which exact role they had.

4. 4

   The loader hides in a picture

   Splunk describes the PowerShell stage downloading a PNG picture with the loader hidden inside it, and storing data in an environment variable called INTERNAL_DB_CACHE.

5. 5

   The keylogger runs inside a real Windows program

   Splunk says the final payload is injected into aspnet_compiler.exe, a genuine .NET tool, so it looks like normal activity. It comes back after each sign in through the UserInitMprLogonScript registry value.

Because each step only fetches the next, the server that is offline today may already have done its job on PCs that asked for it earlier. That is why an offline status is not good news for someone who ran the first file.

What VIP Keylogger and MassLogger are

Both are password stealers for Windows written in .NET and sold or passed among criminals. The tags say which family the reporter believed the scripts lead to; the sources describe the families in general, not these six files.

What these keyloggers can take from a Windows PC

A keylogger records what you do and sends it out quietly. Each item below is named by at least one of the sources for VIP Keylogger or MassLogger; no single build is known to do all of them.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where a script fetched one of these files and the keylogger then ran.

• High

  Email and every account it resets

  A stolen email password, or a stolen session cookie, lets someone reset other accounts. The FTC stresses that email deserves special attention for this reason.

• High

  Money

  Bank logins typed on the PC and crypto addresses changed on the clipboard can mean direct loss. Check balances and recent payments from another device.

• High

  Work accounts

  The lures named by Splunk are business emails about payments and orders, so a work PC with company mail, VPN or file sharing logins is a likely target. Tell your IT team at once.

• Medium

  Your contacts

  A stolen mailbox can send the same kind of lure to people who trust you. The FTC advises warning friends and family if an account was taken.

• Medium

  More malware

  A loader chain can fetch anything. We cannot say that these scripts only lead to a keylogger.

What you may notice, and what you may not

Keyloggers are built to be quiet, and most victims notice nothing until an account is misused. The signs below come from the sources or follow from them; none is certain.

How a person ends up with one of these scripts

Nobody visits a folder like ceofrnd29 on flocmaterials.shop on purpose. The request comes from a script or a document, so the real question is how that first file got onto the PC. We cannot say for this server; the routes below are the ones vendors found for these families.

1. 1

   A business email with an attachment

   A payment advice, a purchase order or a shipping update, with a compressed file, a script or an RTF document attached. Splunk and Forcepoint both describe this as the start.

2. 2

   An old Office flaw

   Forcepoint describes RTF files that use CVE-2017-11882. A PC with Office updates missing is the one at risk.

3. 3

   Macros and scripts

   MassLogger has been spread through Office documents with malicious macros and through phishing attachments, according to the vendor write-ups we read.

4. 4

   A link you were told to follow

   A link to a downloadable file that turns out to be a .vbs, .js or .bat file. Showing file endings in File Explorer makes this easier to spot.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact flocmaterials.shop, or did you open an unexpected attachment, script or document in early October 2026? If you saw the name in a firewall or DNS log, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, do not type passwords on this PC. Anything you type may be recorded.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A keylogger needs the connection to send what it collected.

2. 2

   Find which device asked

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question.

3. 3

   Look at the logon script value

   Press Start, type regedit and open it. Go to HKEY_CURRENT_USER\Environment. A value named UserInitMprLogonScript is rarely used on home PCs; if it exists and you did not set it, note what it runs. Also note any very long values or one named INTERNAL_DB_CACHE. Do not delete yet.

4. 4

   Look at startup programs

   Open Settings > Apps > Startup, then the Startup folder (press Win+R, type shell:startup). Forcepoint says VIP Keylogger copies itself to startup folders.

5. 5

   Look at scheduled tasks

   Open Task Scheduler and look in Task Scheduler Library for tasks you do not know that run PowerShell, wscript or a file from a user folder.

6. 6

   Look at running programs

   Open Task Manager and look for aspnet_compiler.exe or PowerShell running with no reason. Their presence is not proof; they are real Windows parts.

7. 7

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for detections with Masslogger, SnakeKeylogger or VIPKeylogger in the name, or for anything blocked around the time you opened the attachment.

8. 8

   Check your accounts from another device

   Look at sign in activity of your email, bank, work and crypto accounts. This is quicker than any file check.

If you use a Mac, an iPhone or an Android phone

The files are PowerShell scripts and every source we read describes Windows malware. We found nothing that says flocmaterials.shop affects anything else.