<?xml version="1.0" encoding="UTF-8"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:news="http://www.google.com/schemas/sitemap-news/0.9"><url><loc>https://sandboxgazette.com/c/malware/how-does-romulus-use-clickfix-to-install/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-20T05:04:55Z</news:publication_date><news:title>How does ROMULUS use ClickFix to install LegionLoader via fake pages?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/malware/did-a-us-negotiator-help-shinyhunters-extort/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-19T17:49:59Z</news:publication_date><news:title>Did A US Negotiator Help ShinyHunters Extort Targets Via A Dedicated Site?</news:title></news:news></url><url><loc>https://sandboxgazette.com/c/vulnerabilities/can-flycms-admin123-credentials-grant-full-site/</loc><news:news><news:publication><news:name>Sandbox Gazette</news:name><news:language>en</news:language></news:publication><news:publication_date>2026-10-19T14:41:27Z</news:publication_date><news:title>Can flycms:admin123 credentials grant full site control?</news:title></news:news></url></urlset>