FontPack: A dangerous update

Group-IB examined the FontPack malicious landing-page toolkit (aka Domen) which injects JS into compromised or actor-controlled sites to display fake update prompts and deliver payloads; one campaign used it to distribute RedLine stealer (credential and payment-card theft). The report includes script/code analysis, actor and marketplace attribution (multiple seller/user aliases, MagBo links), observed delivery URLs and repositories, malware detonation results identifying RedLine samples, and a table of IOCs for detection and response.