gitsl.xyz: a server listed for a PowerShell script tagged RedHiveStealer, and what to do if you ran its command on Windows

What gitsl.xyz is, and what we know about it

gitsl.xyz is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this address or of a family called RedHiveStealer, so what follows is what URLhaus shows, what our own request showed, and what Microsoft and Kaspersky have published about the technique the tags point to.

1. 1

   What URLhaus lists

   Three addresses on gitsl.xyz. The home page, https://gitsl.xyz/, was added on 17 October 2026 at about 16:24 UTC by a reporter named ffforward. Two files in a folder called assets followed on 18 October 2026: 2.zip at about 13:04 UTC and 7za.exe at about 13:05 UTC, both by a reporter named NDA0E. All three are marked online and carry the threat label malware_download.

2. 2

   What the tags on the home page mean

   powershell and ps1 say the address returns a PowerShell script. iex-irm names the pattern: irm is short for Invoke-RestMethod, which downloads text from an address, and iex is short for Invoke-Expression, which runs that text as a command. RedHiveStealer is the name the reporter gave to the malware; mops_to is a tag we cannot explain, and we found nothing that defines it. A stealer is a program built to collect saved logins and other data from a PC and send it away.

3. 3

   What the two files are

   The zip carries the tags zip and pw-1523. We read pw-1523 as a password, 1523, for the archive; that is our reading, not something a report states. The exe is named 7za.exe, which is also the name of the command line version of the genuine 7-Zip tool. We did not download it, so we cannot say whether this file is the real tool or something posing under that name. A script that needs to open a password protected zip would need such a tool, but that, too, is our reasoning from the names.

4. 4

   What we could not confirm

   We did not download the script, the zip or the exe. We cannot tell you what RedHiveStealer takes, which malware is inside the archive, or where stolen data is sent. We also do not know how people are led to run the command. URLhaus shows tags and dates, not a proof.

5. 5

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a PC where somebody ran a command that fetched the script. A normal visitor has no reason to ask this server for a script or a zip.

Kind of threat

A server that hands out a PowerShell script tagged RedHiveStealer (an information stealer), a password protected zip and a file named 7za.exe

Where the files are

hxxps://gitsl[.]xyz/ (the script), hxxps://gitsl[.]xyz/assets/2[.]zip and hxxps://gitsl[.]xyz/assets/7za[.]exe

Domain registered

11 September 2026 through Global Domain Group LLC; RDAP shows the status server transfer prohibited and client transfer prohibited (read 17 October 2026)

URLhaus entries

3 addresses, added 17 and 18 October 2026; all 3 online when we read our copy of the data

Delivery pattern

iex-irm: a PowerShell command downloads a script and runs it at once. How a victim is led to run it is not known for this server

Platform

Windows. PowerShell scripts and a Windows exe point there. Nothing we read says Mac, iPhone or Android are affected

What we checked on 18 October 2026, and what we could not

Our server sent one plain request to https://gitsl.xyz/ on 18 October 2026. It is not a browser: it does not run scripts, click or look like a visitor. The answer was a normal reply, and that clears nothing.

What happened to gitsl.xyz, from registration to our test

The domain is young: registered five weeks before the first report. The dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 11 September 2026

   The domain is registered

   RDAP shows gitsl.xyz registered on 11 September 2026 at about 01:01 UTC through Global Domain Group LLC. A domain this new that is used for malware within weeks is common, but the date alone proves nothing about intent.

2. 17 October 2026

   The home page is reported as a script

   At about 16:24 UTC the reporter ffforward adds https://gitsl.xyz/ with the tags powershell, ps1, iex-irm, mops_to and RedHiveStealer. The entry is for the root address, which means a request to the front door itself is what returns the script.

3. 18 October 2026

   A zip and an exe are added

   At about 13:04 UTC the reporter NDA0E adds /assets/2.zip with the tags zip and pw-1523. About a minute later the same reporter adds /assets/7za.exe, tagged exe. A second reporter finding the same server the next day suggests it was still handing out files, though we cannot say how many people were reached.

   

4. 18 October 2026

   Our request

   Later the same day our server asks for the home page once and gets status 200 with no title. All three URLhaus entries are still marked online in our copy of the data.

What the pattern suggests, and what it does not: a script at the front door, then an archive and a tool in an assets folder, looks like one operator who stages a chain of files on one server. That is our reading of names and dates, not something any report says.

How a PowerShell command pulls a stealer onto a PC

The tag iex-irm describes a way to run code without saving a file first. It needs a person to paste or run a command; looking at the address in a browser is not that. We did not see this server's script; this is how Microsoft and Kaspersky describe the technique.

1. 1

   A page or message asks you to run a command

   Microsoft Threat Intelligence calls the technique ClickFix. In its post of 21 August 2025 it says the victim is nudged to solve a fake check such as a CAPTCHA and then to run a command in the Run dialog, in Windows Terminal or in PowerShell. Microsoft says it saw campaigns reaching thousands of enterprise and consumer devices every day.

2. 2

   irm downloads, iex runs

   Kaspersky describes a campaign that told people to open PowerShell with administrator rights and run a command of the form iex (irm address). The irm part fetches a script from a server the attacker controls, and iex runs it. Nothing needs to be saved to the disk first, so a file scanner sees little.

3. 3

   The script fetches the real payload

   In the campaigns Microsoft describes, the final payload is most often an information stealer; Lumma Stealer is the one it names, and it also saw remote access trojans and loaders. For gitsl.xyz the tag says RedHiveStealer. The zip and exe on the same server may be part of that chain, but we have no source that says so.

4. 4

   Why the exe and the password protected zip stand out

   A zip with a password cannot be opened by a mail or web filter, which is a reason attackers use it. A copy of a tool like 7za.exe lets a script unpack it without asking the user. We offer this as our reasoning from the file names; no report we read describes the files on gitsl.xyz.

The useful defence is earlier than any scan: do not paste into PowerShell, Run or Terminal a command that a web page, a message or a stranger gave you, unless you understand every part of it.

What RedHiveStealer is, and what we do not know about it

RedHiveStealer is the name in the URLhaus tags. We searched for an analysis of it and found none, so we cannot describe its code, its targets or its server. We will not borrow the features of another stealer and pass them off as its own.

What an information stealer is built to take from a Windows PC

The list below describes the class of program, not RedHiveStealer in particular. It is our general description, not a finding about this server, and any one stealer takes some of it, not all.

The reason cookies matter: a stolen session can let someone into an account without the password and sometimes without the second factor. After a stealer, changing only the password is not enough; you also sign out of all devices, which kills the stolen sessions. The FTC advises the same sign out step after any account takeover.

What this can cost you

Reading the site or seeing its name costs nothing. The risks below apply to a Windows PC where someone ran the command and the script worked.

• High

  Passwords and accounts

  Saved logins in the browser are the first thing a stealer goes for. Change them from another device, not from the PC you suspect, because anything typed on it may be seen.

• High

  Crypto and banking

  A seed phrase or a wallet file on the PC should be treated as known. Crypto sent from a stolen wallet cannot be reversed.

• Medium

  Stolen sessions

  Cookies can keep an account open after you change the password. Signing out on all devices, as the FTC advises, closes them.

• Medium

  More malware on the same PC

  Microsoft says the payload of this kind of command can also be a remote access trojan or a loader. Whether this server delivers one is not known.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers are built to be quiet and often run once, so most victims notice nothing on the PC. The signs below follow from the technique; none is certain.

How a person ends up running a command that mentions this address

Nobody visits gitsl.xyz on purpose. The request comes from a command, so the real question is where the command came from. We cannot say for this server; the routes below are those the vendors found with the same technique.

1. 1

   A fake check on a web page

   Microsoft describes pages that imitate a CAPTCHA or a human verification and then tell the visitor to press keys that open the Run dialog, paste, and press Enter. The text pasted is the command.

2. 2

   A video or a post that says to run PowerShell

   Kaspersky describes a TikTok campaign that told viewers to run PowerShell as administrator and paste an iex (irm address) command, presented as a way to activate or unlock software.

3. 3

   A fix for an error that is itself fake

   Microsoft's post covers lures that claim something is broken and offer a command as the repair. A real repair for a real Windows error does not start with a command from a stranger's web page.

Check your PC before you delete anything

Start with the question that matters: did you or anyone using this PC paste or run a PowerShell command that mentioned gitsl.xyz, or a command from a web page that asked you to verify yourself? If you saw the name only in a log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. Stolen data leaves through the connection.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for a detection or a blocked item at the time you ran the command. Microsoft says the results of an offline scan also appear there.

4. 4

   Look for the downloaded files

   Open File Explorer and look in Downloads and in the Temp folder for a file named 2.zip or 7za.exe that you did not put there. Do not open or run them. Write down the path and the time.

5. 5

   Look at startup apps and Task Manager

   Open Settings > Apps > Startup and look for names you did not install. In Task Manager, look for a program you do not know using much network or CPU. A stealer often leaves nothing behind, so an empty list clears nothing.

6. 6

   Check your accounts from another device

   Look at the sign in activity of your email, bank, exchange and social accounts, and at crypto balances. This is quicker than any file check, and it shows whether anything was taken.

7. 7

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. No vendor publishes a removal procedure for this server's files and we infected no PC, so the plan below is our judgement from Microsoft and FTC pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags describe a Windows threat: a PowerShell script and an exe. We found nothing that says the files on gitsl.xyz affect anything else.