Single $10 Domain Could Have Given Hackers Control Over 25,000 Endpoints Worldwide

Key Points

• A $10 unregistered domain could have controlled over 25,000 endpoints globally
• 324 compromised hosts belonged to sensitive networks including government, OT, and healthcare
• Attack used PowerShell payloads to disable security products and block updates

Full Details

Huntress researchers uncovered a sophisticated threat hidden within what appeared to be adware, revealing that a single unregistered domain available for as little as $10 could have granted malicious actors silent control over more than 25,000 compromised endpoints worldwide. Starting in March 2025, the threat deployed a PowerShell-based payload that runs with elevated privileges to disable cybersecurity products, block their update servers, and prevent their reinstallation. Of the hosts observed, 324 belonged to sensitive networks, including 221 universities and colleges, 41 operational technology (OT) networks, 35 government entities, and three healthcare organizations. The discovery highlights how inexpensive domain registration can be exploited for large-scale, stealthy attacks across critical infrastructure sectors.