REFUNDEE: Inside a Shadow Panel Phishing-as-a-Service Operation

Reported 13 Apr 2026 by otx · Severity: medium

An open directory discovery at refundonex[.]com exposed a complete Phishing-as-a-Service and RAT-as-a-Service platform targeting Spanish and Portuguese-speaking victims. The investigation uncovered 3,788 files including weaponized LNK, VBS, and AES-encrypted PowerShell payloads d