viewgit.sbs: a server listed for a PowerShell script tagged RedHiveStealer, and what to do if you ran a command from it

What viewgit.sbs is, and what we know about it

viewgit.sbs is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware was served. We found no public write-up of this address or of the name RedHiveStealer, so what follows is what URLhaus shows, what our server saw, and what Microsoft has published about the way such PowerShell commands usually reach a PC.

1. 1

   What URLhaus lists

   Three addresses. The first is the home address, hxxps://viewgit[.]sbs/, added on 17 October 2026 at about 16:24 UTC by a reporter who goes by ffforward. The other two sit in a folder called assets: hxxps://viewgit[.]sbs/assets/2.zip, added on 18 October at about 13:04 UTC, and hxxps://viewgit[.]sbs/assets/7za.exe, added a minute later. All three are marked online and carry the threat label malware_download.

2. 2

   What the tags on the home address say

   The tags are powershell, ps1, iex-irm, mops_to and RedHiveStealer. ps1 and powershell say the address serves a PowerShell script. iex-irm is the name of a common pattern: a command that downloads text from an address and runs it at once, written with the PowerShell words irm (Invoke-RestMethod) and iex (Invoke-Expression). RedHiveStealer is the malware name the reporter chose; it looks like an information stealer from the name, but that is our reading. We could not find what mops_to means and will not guess.

3. 3

   What the tags on the two files say

   2.zip carries the tags zip and pw-1523. The tag pw-1523 most likely means the archive is locked with the password 1523, which is how criminals stop scanners from looking inside; that is our reading of the tag, not something we tested. 7za.exe is tagged exe. The name matches the stand alone command line version of the legitimate 7-Zip archiver, which unpacks password protected zip files. Whether this copy is the real 7-Zip or something else, we do not know.

4. 4

   What we could not confirm

   We did not download any file, so we cannot tell you what is inside the script, the archive or the program, what it steals, or where it sends the data. We also do not know how people end up running a command that points here. That first step is not visible from the server side.

5. 5

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a security alert, you are not infected by that alone. The risk is for a PC where someone ran a PowerShell line that fetched from this address, or ran a file that came from it.

Kind of threat

A server that hands out a PowerShell script tagged RedHiveStealer, a password protected zip and an exe, for Windows

Where the files are

hxxps://viewgit[.]sbs/ (the script), hxxps://viewgit[.]sbs/assets/2.zip and hxxps://viewgit[.]sbs/assets/7za.exe

Domain registered

11 September 2026, registrar Global Domain Group LLC; status server transfer prohibited and client transfer prohibited (RDAP, read 17 October 2026)

URLhaus entries

3 addresses, added 17 and 18 October 2026; all 3 online in our copy of the data on 18 October 2026

Delivery pattern

A PowerShell download and run command (tag iex-irm). How the command reaches a victim is not known for this address

Platform

Windows, because the tags name PowerShell and an exe. Nothing we read says Mac, iPhone or Android phones are affected

What we checked on 18 October 2026, and what we could not

Our check was one plain request to https://viewgit.sbs/ from our server, with no browser, no clicks and no PowerShell. The server answered with status 200, no redirect and no page title. That clears nothing: a server that serves malware can show an empty or ordinary page to a visitor and a script to a PowerShell client.

What happened to viewgit.sbs, from registration to our check

The domain was registered five weeks before the first report, and the reports came in two bursts a day apart. The dates come from RDAP and from the URLhaus data we hold; the times are UTC.

1. 11 September 2026

   The domain is registered

   RDAP shows viewgit.sbs created on 11 September 2026 at about 01:01 UTC through Global Domain Group LLC. Both transfer prohibited statuses are set. A new domain is not proof of anything, but a name that is 36 days old at its first report is typical of addresses made for one campaign.

2. 17 October 2026

   The home address is listed

   At about 16:24 UTC the reporter ffforward adds https://viewgit.sbs/ with the tags iex-irm, mops_to, powershell, ps1 and RedHiveStealer. The status is online.

3. 18 October 2026

   A zip and an exe are listed, then our check

   At about 13:04 UTC the reporter NDA0E adds /assets/2.zip (tags pw-1523 and zip), and at about 13:05 UTC /assets/7za.exe (tag exe). All three addresses are still online when we read the data. Our plain request the same day gets status 200.

   

What the pattern suggests, and what it does not: two different reporters listed three different kinds of file on the same server within a day. A script, a locked archive and an archiver would fit a chain in which the script downloads the archive and unpacks it with 7za.exe. That is our reading of the file names and tags, and no report says it.

How a download and run command reaches a PC

A PowerShell line of the iex-irm kind does nothing until a person or a program runs it. We do not know which route led to viewgit.sbs. Microsoft describes the route most often seen with this kind of command, and we use it only as background.

1. 1

   A page tells you to fix something

   Microsoft Threat Intelligence (21 August 2025) describes ClickFix, a technique in which a fake error, a fake CAPTCHA or a fake human check tells the visitor to copy a command and paste it into the Windows Run box, Windows Terminal or PowerShell. The page often puts the command on the clipboard by itself.

2. 2

   The command fetches a script and runs it

   The pasted line downloads text from a server and runs it in memory. Microsoft says many of these payloads are fileless and run through built in programs such as PowerShell, msbuild.exe or regasm.exe. This is the same shape as the tag iex-irm.

3. 3

   The script brings in the rest

   Microsoft names infostealers such as Lumma Stealer and Lampion as the most common final payload, and remote access tools such as AsyncRAT among others. For viewgit.sbs the tag says RedHiveStealer; we found no description of that family.

4. 4

   Why the pasted command matters

   Because you ran the command yourself, a download filter and a mail scanner never saw a file arrive. That is why removal begins with what the PC did, not with a file you can see.

A separate report, from SOC Prime (summarising EclecticIQ), describes a different campaign in which fake installer pages for AI coding tools gave victims a single irm and iex command that loaded an information stealer in memory. It is not linked to viewgit.sbs or to RedHiveStealer by any source we read. We mention it only because it shows the same command shape in use in 2026.

What an information stealer can take from a Windows PC

We do not know what RedHiveStealer takes, because we found no analysis of it. The list below is what the sources say about stealers delivered by this kind of command. Treat it as the worst case to plan for, not as a finding about this server.

What this can cost you

Reading about the site or seeing its name costs nothing. The risks below apply to a Windows PC where a command from this address ran, and they are stated as possibilities, because we do not know what the script does.

• High

  Passwords and logged in sessions

  A stealer that copies saved logins and session cookies can let a stranger into your accounts without the password. Changing a password on the same PC does not help while the malware is still there.

• High

  Crypto and banking

  If a wallet file or seed phrase was on the PC, assume it is known. Crypto sent from a stolen wallet cannot be reversed.

• Medium

  Files and documents

  Stealers often look for documents and sensitive files. Anything personal or from work that sat on the PC may have left it.

• Medium

  More malware on the same PC

  Microsoft says a pasted command may also bring remote access tools or loaders. The zip and the exe on this server mean the chain may have more than one stage.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Stealers are built to be quick and quiet. They may finish their work within minutes and leave nothing behind, so most victims notice the damage in their accounts, not on the PC.

How a person ends up running a command from this address

Nobody visits viewgit.sbs on purpose, and a normal visitor has no reason to request its files. The request comes from a pasted command or from a program. We cannot say how it was spread; these are the routes Microsoft describes for the same kind of command.

1. 1

   A fake check or fake error on a web page

   Microsoft says the lures include fake error messages and fake CAPTCHA or human verification prompts that copy Cloudflare Turnstile or Google reCAPTCHA, and fake pages for platforms such as Discord. A real CAPTCHA never asks you to open the Run box or a terminal and paste something.

2. 2

   A link from email, an ad or a hacked site

   Microsoft names phishing emails with links or attachments, malvertising that leads to scam pages and compromised legitimate websites as the ways people reach those pages.

3. 3

   A guide or comment that says to paste a line

   Any page, video description or chat message that tells you to paste a PowerShell line to install a program or fix a problem is the same trick. Install software from its maker's own site or the Microsoft Store.

Check your PC before you delete anything

Start with the question that matters: did you or a program on this PC run a PowerShell command that fetched from viewgit.sbs, or a file that came from it? If you saw the name in a firewall or DNS log from your network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and do the account steps on another device.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. A stealer or a remote tool needs the connection to send data or to be used.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined around the time of the first contact, and for detection names that mention PowerShell, a stealer or a trojan. Microsoft says offline scan results also appear there.

4. 4

   Look at Startup apps

   Open Settings > Apps > Startup and look for names you did not install. A stealer that runs once will not be here, so a clean list clears nothing.

5. 5

   Look at running processes

   Open Task Manager and look at the Processes tab for programs you do not know, or for powershell.exe, msbuild.exe or regasm.exe running with no reason. Microsoft names the last two as programs these chains use. They are real Windows files, so their presence is not proof.

6. 6

   Check your accounts from another device

   Look at the sign in activity of your email, bank, social and exchange accounts, and at crypto balances. This is quicker than any file check, and the FTC lists the signs: a changed password or phone number, login alerts, messages you did not send, and mail forwarding rules you did not create.

7. 7

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result like a clean site test: one data point. No vendor publishes a removal procedure for this server's files and we did not infect a PC, so the order of the plan is our judgement from Microsoft's and the FTC's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags describe a Windows threat: PowerShell and an exe file. We found nothing that says viewgit.sbs affects anything else. Microsoft notes that ClickFix campaigns have also targeted Mac users, but with a different command, and no source links that to this address.