TSforge - Tool

Threat entity extracted from intelligence sources

Frequency
1
occurrences
First Seen
December 24, 2025
Last Seen
December 24, 2025

TSforge is a tool tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed December 24, 2025; most recent activity December 24, 2025.

Related Threat Clusters

  • Typosquatted Domains Spread Cosmali Loader via PowerShell Malware

    Users of the Microsoft Activation Scripts (MAS) tool have reported receiving pop-up warnings about a Cosmali Loader infection after mistakenly entering a typosquatted domain. The malicious domain 'get.activate[.]win'…

    2 articles · Updated December 26, 2025

Recent Intelligence Reports

  • Fake MAS Windows activation domain used to spread PowerShell malware — Bleepingcomputer · December 24, 2025

Related Entities

Malware Trojan Cosmali Loader XWorm T1059.001 - PowerShell Windows Ohook PowerShell

CVSS v3.1 Breakdown