picartmod[.]com

The domain picartmod.com is identified as a generic_phishing threat specializing in the distribution of modified Android application packages (APKs). Analysis confirms the site impersonates the legitimate PicsArt application, offering a counterfeit version labeled "PicsArt Mod APK Download v29.9.7 (Premium Unlocked)." As of the latest assessment, the domain has been taken offline, though residual risk remains due to prior malicious activity. Infrastructure analysis reveals the domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu on October 06, 2025, and resolved to the IP address 145.79.2.218. It appears on three security blocklists and has been flagged by 5 of 95 security vendors on VirusTotal. The domain was also documented in four threat intelligence pulses on a major threat exchange platform. The SSL certificate was issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. Detection engines such as MetaMask, PhishDestroy, and SEAL have actively blocked access to this domain. Current status indicates the domain is offline, reducing immediate exposure. However, the threat actor may re-establish infrastructure under a new domain or IP. Users who downloaded the APK are advised to perform a full device scan using updated antivirus software, revoke any installed permissions from the application, and monitor for unauthorized account access. Organizations should update web filtering rules to block the domain and associated IP, and review logs for connections to 145.79.2.218. Security teams are encouraged to correlate indicators with internal telemetry to identify potential compromise.