CARNIVAL / cclpromos.com MALVERTISING - PUBLIC EVIDENCE PACKAGE
================================================================

Author:   Daniel Jones, Tuxxin LLC  (https://tuxxin.com)
Contact:  contact@tuxxin.com
Bio:      https://tuxxin.com/founder

Full write-up (canonical):
  https://tuxxin.com/carnival-cclpromos-malvertising


WHAT THIS IS
------------
Supporting evidence for the security findings report on a device-aware
malvertising vector reached through an authenticated Carnival Cruise Line
email, via the lapsed brand domain cclpromos.com. The vector was disclosed
to Carnival and resolved on 2026-08-27 (Carnival re-acquired the domain and
severed it from the third-party network).


CONTENTS
--------
  Carnival-cclpromos-Security-Findings.pdf   The full findings report.
  Screenshots/                               13 exhibits (desktop, iOS,
                                             cloaked skeleton, lockers).
  Network-Captures-HAR/                      6 sanitized HAR captures of
                                             the de-cloaked chain.


MALWARE SAMPLES
---------------
- No live malware samples are included in this package. The malicious
  .msix / .appinstaller payloads are referenced by SHA-256 in the report
  and are available to CERTs and law enforcement on request.


PRIVACY / SANITIZATION
----------------------
This package is a sanitized public derivative. Recipient identifiers
(name, booking reference, email address) and the researcher's source IP
have been redacted from the screenshots and network captures. Personal
correspondence is not included.


TIMESTAMP / PRIORITY
--------------------
The original findings bundle was assembled and cryptographically hashed on
2026-06-25. That sealed original is retained unmodified. Its SHA-256, which
proves the evidence existed on that date, is:

  C7183F66E1981525FECCB6681F4990463907BFD638E7DD89972885DBC0237BAC
  (Carnival-cclpromos-Findings-Evidence.zip, sealed original, 2026-06-25)

The SHA-256 of THIS sanitized public package is published alongside it in
Carnival-cclpromos-Findings-Evidence.sha256.txt.
