gitview.sbs: a server handing out a PowerShell script, a 7-Zip tool and a locked zip tagged RedHiveStealer, and what to do on Windows

What gitview.sbs is, and what we know about it

gitview.sbs is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this address or of the name RedHiveStealer, so what follows is what URLhaus shows, what our own request showed, and what Microsoft and other security vendors have published about the way such PowerShell chains reach a PC.

1. 1

   What URLhaus lists

   Three addresses on gitview.sbs, all marked online with the threat label malware_download. The home page https://gitview.sbs/ was added on 17 October 2026 at about 16:24 UTC. The file /assets/2.zip was added on 18 October at about 13:04 UTC and /assets/7za.exe one minute later. The home page was reported by one person and the two files by another, so two people saw it independently.

2. 2

   What the tags mean

   The home page carries the tags powershell, ps1, iex-irm, mops_to and RedHiveStealer. powershell and ps1 say that the page answers with a PowerShell script. iex-irm names a common one line pattern: irm (Invoke-RestMethod) downloads text and iex (Invoke-Expression) runs it at once, so nothing is saved as a file first. RedHiveStealer is the name the reporter gave the payload. We do not know what mops_to means. The zip carries zip and pw-1523; the tool carries exe.

3. 3

   What we could not confirm

   We downloaded none of the files and we did not read the script, so we cannot tell you what it does, what RedHiveStealer takes or where it sends data. We found no vendor report for that name. A tag is a reporter's label, not a proof. We also do not know how a victim's PC is made to ask for the home page.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. The risk is for a Windows PC where someone ran a PowerShell command that pointed to this address. A normal visitor has no reason to request a script, a tool and a zip file from a web server.

Kind of threat

A server that serves a PowerShell script (tagged RedHiveStealer), a 7-Zip command line tool and a password locked zip

Where the files are

hxxps://gitview[.]sbs/ (script), hxxps://gitview[.]sbs/assets/2[.]zip and hxxps://gitview[.]sbs/assets/7za[.]exe

Domain registered

11 September 2026 through Global Domain Group LLC; status server transfer prohibited and client transfer prohibited (RDAP, read 17 October 2026)

URLhaus entries

3 addresses, added 17 and 18 October 2026; all 3 online when we read our copy of the data

Delivery trick

A one line PowerShell command that downloads and runs a script in memory (iex-irm). How the command reaches the victim is not known

Platform

Windows. PowerShell, exe and zip tags all point to Windows. Nothing we read says Mac, iPhone or Android are affected

What we checked on 18 October 2026, and what we could not

Our check was a plain request from our server, not a browser visit, and not a click. It got an answer. That clears nothing: a server that hands out malware often answers visitors differently from the scripts that ask for it.

What happened to gitview.sbs, from registration to our check

The domain is about five weeks old and every report is from the last two days. The dates come from RDAP and from the URLhaus data we hold; times are UTC.

1. 11 September 2026

   The domain is registered

   RDAP shows gitview.sbs created on 11 September 2026 at about 01:01 UTC through Global Domain Group LLC. Transfers are locked on both the registry and the registrar side, which is common and says nothing about intent.

2. 17 October 2026

   The home page is reported as a PowerShell script

   At about 16:24 UTC the home page is added to URLhaus with the tags iex-irm, mops_to, powershell, ps1 and RedHiveStealer. The reporter's handle is ffforward. The status is online.

3. 18 October 2026

   A locked zip and a 7-Zip tool are reported

   At about 13:04 UTC /assets/2.zip is added with the tags pw-1523 and zip, and at about 13:05 UTC /assets/7za.exe is added with the tag exe. The reporter is a different one (NDA0E). Both are online.

   

4. 18 October 2026

   Our plain request

   The home page answers with status 200 from an nginx server on Ubuntu, with no redirect. All three URLhaus entries are still marked online.

What the pattern suggests, and what it does not: a new domain, a script on the front page and two supporting files on a folder called assets within a day looks like a freshly built distribution point. That is our reading of the dates, not something any report says. The domain name looks like a code hosting site, which may be chosen so that a copied command looks harmless; we have no source that says this is the reason.

How a one line PowerShell command can lead to a stealer

We did not see what gitview.sbs does to a PC. The chain below is how Microsoft, Arctic Wolf and SOC Prime describe campaigns that use the same pieces. Whether this address follows it step by step is not known.

1. 1

   A person is made to run a command

   Microsoft describes the ClickFix trick: a fake verification page copies a command to the clipboard and tells the visitor to open the Windows Run box or a terminal, paste it and press Enter. Because the user runs it, many automatic defences never see an attachment. Lures reach people by phishing email, bad ads and hacked websites. We do not know that gitview.sbs is used this way; it is the best documented route for a command like iex-irm.

2. 2

   The command downloads a script and runs it in memory

   Arctic Wolf describes a ClickFix command that builds the word irm out of pieces, downloads text and passes it to iex, so the content runs without being saved to disk first. The tag iex-irm on the gitview.sbs home page is the same pattern. In memory means a file scan of the disk may find nothing.

3. 3

   The script fetches tools and a payload

   Arctic Wolf describes another ClickFix command that downloads the 7-Zip archive manager together with a password protected archive that holds a remote access trojan. The files on gitview.sbs look similar: 7za.exe is the name of the stand alone command line version of 7-Zip, and the tag pw-1523 suggests the zip is locked with the password 1523. That is our reading of a tag. A locked zip also stops many mail and web filters from looking inside.

4. 4

   A stealer starts

   SOC Prime describes a ClickFix chain where PowerShell pulls shellcode that loads a downloader and injects the StealC information stealer into svchost.exe. We do not know that RedHiveStealer works like this. For any stealer in these chains, the goal is browser data, wallets and accounts, sent to the operator.

5. 5

   The operator uses what was taken

   Microsoft lists infostealers (Lumma Stealer as the most common), remote access tools and loaders among what ClickFix delivers. The same PC may get more than one.

Microsoft says the technique works because the user performs the action, and advises, among other things, teaching people to check what they copy and paste, turning on network and web protection and SmartScreen, and checking the RunMRU registry key for odd entries.

What RedHiveStealer is, and what is not known

We searched for a report on RedHiveStealer and found none. The name comes from one URLhaus tag. Everything below separates what that tag lets us say from what we would only be guessing.

What a stealer of this kind usually goes after

We do not know what RedHiveStealer takes. The list below is what Microsoft and the vendors name for the stealers and remote tools that ClickFix chains deliver, so treat it as what is possible, not what is proven for this server.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where a command that points to gitview.sbs was run.

• High

  Passwords and logged in accounts

  A stealer takes what the browser stores. Change passwords from another device, because anything typed on the PC after the infection can be seen too.

• High

  Crypto and banking

  Wallet data is a stated target of stealers. Funds sent out of a wallet cannot be called back.

• Medium

  Your files

  Documents and photos on the PC may be copied. We cannot say which, because we did not read the script.

• Medium

  More malware on the same PC

  The chain fetches several files. A PC that ran it may have received more than the stealer.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers are built to be quiet and to finish quickly. The signs below come from the way the chain works; none is certain, and many victims notice nothing until an account is misused.

How a person ends up running a command from gitview.sbs

Nobody visits gitview.sbs on purpose. The request comes from a command, so the real question is how the command got in front of the person. We cannot say for this server. The routes below are the ones that Microsoft and other vendors document for the same kind of command.

1. 1

   A fake verification page

   A page that says you must prove you are human or fix an error, then asks you to press Windows key and R, paste, and press Enter. Microsoft describes fake CAPTCHA and Cloudflare Turnstile style pages. Real checks never ask you to run a command.

2. 2

   A phishing email or a bad ad

   Microsoft names phishing email, malicious ads and compromised websites as the ways people reach these pages. Arctic Wolf also describes a lure that pretends to be GitHub, which fits a domain called gitview, but we have no proof that this is how gitview.sbs is used.

3. 3

   A guide or a post that tells you to paste a command

   A forum answer, a video description or a comment that says to open PowerShell and paste a line starting with irm or iwr. If you do not understand the line, do not run it.

Check your PC before you delete anything

Start with the question that matters: did you, or anyone using this PC, paste or run a command that mentions gitview.sbs, or one that started with irm or iex? If you saw the name in a firewall or DNS log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto. Disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A stealer needs the connection to send what it took.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Look at the Run box history

   Microsoft names the RunMRU registry key as a place to look for suspicious pasted commands. Open Registry Editor and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU. Entries that start with powershell, irm, iex or mshta, or that mention gitview.sbs, are a strong sign. Do not edit anything here yet; write down what you see.

4. 4

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of the first contact, especially a script or a trojan name.

5. 5

   Look for files you did not make

   Search File Explorer for 7za.exe and for zip files with names like 2.zip in Downloads, Temp and your user folder. A 7za.exe that you did not put there is worth noting. Do not open or run any zip you find.

6. 6

   Look at Startup apps and Task Scheduler

   Open Settings > Apps > Startup and switch off entries you do not recognise. In Task Scheduler Library, look for tasks with random names that run a script. Many stealers run once and leave nothing, so a clean list does not clear the PC.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts and at crypto balances. This is quicker than any file check, and it is the part that tells you if data was used.

8. 8

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. We did not infect a PC with these files, so the order of this plan is our judgement from Microsoft's and the FTC's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags describe a Windows threat: a PowerShell script, an exe and a zip. We found nothing that says gitview.sbs affects anything else.