Aeternum Blockchain C2, ErrTraffic ClickFix, CaptiveCrunch M365 Phishing, GoldDigger Android: OTX Enterprise Detection Pack

Threat Summary

These pulses collectively show credential theft and infostealer operations shifting away from static C2 toward resilient, low-cost infrastructure: public blockchain RPC endpoints, compromised WordPress sites, hospitality captive portals, and Android overlay fraud. The common objective is account takeover and monetization: Microsoft 365 session theft, clipboard or banking credential interception, loader-delivered stealer deployment, and follow-on cryptocurrency mining or botnet enrollment.

The strongest convergence is abuse of trust. Aeternum and ErrTraffic hide instructions or staging logic in Polygon smart contracts and public RPC services, making takedown harder. ErrTraffic uses ClickFix-style fake verification or browser update lures to make users run malicious commands. CaptiveCrunch, attributed to UNC2452 or Midnight Blizzard activity, weaponizes hotel Wi-Fi DNS and captive portal redirects to steal Microsoft 365 credentials and abuse Entra ID device code flows. GoldDigger extends the same credential-theft outcome to mobile banking through accessibility abuse, overlays, anti-debugging, and virtual environment checks.

Threat Actor and Malware Profile

Aeternum loader: C++ botnet loader associated with LenAI activity and distribution of XWorm, XMRig, and ZingoStealer. It queries Polygon blockchain smart contracts through public RPC endpoints such as endpoints.omniatech.io, polygon-zkevm.drpc.org, polygon-mumbai.gateway.tenderly.co, and api.zan.top. Payload instructions may be encrypted or plaintext in contract storage. Weak PBKDF2HMAC and AES-GCM with self-salting passwords can enable payload decryption once the contract data and key schedule are recovered. Expect outbound HTTPS to RPC endpoints, periodic polling, payload staging from lookalike CDN domains, and possible miner or RAT follow-on.
ErrTraffic campaign: malware-as-a-service delivery through compromised WordPress pages, ClickFix social engineering, and EtherHiding. Observed families include Vidar, Okobot, LegionLoader, OnionDrop, BabaDedaLoader, TELEPUZ, and ClipBanker. Delivery chains often push users to paste or run PowerShell, mshta, rundll32, or curl-like commands, then side-load DLLs or fetch binaries from raw IP URLs and disposable .sbs or .beer domains. ClipBanker behavior adds clipboard monitoring for cryptocurrency address replacement.
CaptiveCrunch or Midnight Blizzard: UNC2452-style credential operation targeting travelers on hotel, conference, and hospitality networks. It manipulates captive portal DNS and HTTP redirects, presents Microsoft 365 or OWA lookalike pages such as m365-owa.com, ms365-device.com, ms365-live.com, and owa-ms365.com, and can combine phishing, device code phishing, and ClickFix malware delivery. CornFlake and ChocoShell artifacts should be treated as high-confidence credential theft signals when tied to these domains or 38.146.28.75.
GoldDigger Android banking trojan: targets finance users, especially South Africa and the UK, with expansion indicators. It masquerades as airline or shopping apps, uses dpt-shell packing, anti-debugging, Frida detection, virtual environment checks, accessibility service abuse, and overlay windows over banking apps. Enterprise exposure is strongest for BYOD, mobile banking approval flows, helpdesk fraud, and SMS or push approval interception.

IOC Analysis

The indicator set is mixed and should be operationalized by type, not as a flat blocklist. IPs such as 193.221.200.219, 158.94.208.104, and 38.146.28.75 are suitable for egress blocking, threat intel matching in firewall and proxy logs, and retro hunting in NetFlow, DNS, and EDR network events. Domains and hostnames such as cdnjsdelivr.beer, networksolutionson.sbs, verification-cdn-cloud.beer, istile-c-cloud.beer, ghdnsserverns.beer, mnoskemp.beer, ap7.supportly.au, sekirolegion.duckdns.org, m365-owa.com, ms365-device.com, ms365-live.com, and owa-ms365.com should be blocked at DNS, secure web gateway, and mail or web URL layers. Public RPC endpoints should not be blanket blocked if business blockchain use exists; instead alert on unexpected workstation or server processes connecting to them.

File hashes are best used in EDR reputation, malware quarantine validation, and retro sweep across email, web download, and endpoint stores. URLs such as http://158.94.208.104/x7GkP2mQ9zL4/my_s.bin should be detonated only in a sandbox and used for network-path hunting. Tooling that decodes these campaigns includes EDR process and network telemetry, DNS logs, secure web gateway logs, Microsoft 365 sign-in and audit logs, Zeek or Suricata for JA3 and SNI, YARA for hash and memory matching, CyberChef or custom parsers for smart contract payload extraction, and mobile threat defense for accessibility-service and overlay indicators.

Detection Engineering

YAML

---
title: Suspicious Public Blockchain RPC C2 Polling From Endpoint
id: 9f2a1c54-8c7b-4c1d-9c2a-6e1f0aeternum01
status: experimental
description: Detects endpoint processes initiating network connections to public Polygon or blockchain RPC infrastructure observed in Aeternum, EtherHiding, and ErrTraffic reporting.
author: Security Arsenal
date: 2026/08/12
logsource:
  category: network_connection
  product: windows
detection:
  selection_rpc:
    DestinationHostname|contains:
      - endpoints.omniatech.io
      - polygon-zkevm.drpc.org
      - polygon-mumbai.gateway.tenderly.co
      - api.zan.top
  selection_ioc:
    DestinationHostname|contains:
      - cdnjsdelivr.beer
      - sekirolegion.duckdns.org
  selection_ip:
    DestinationIp:
      - 193.221.200.219
      - 158.94.208.104
  condition: 1 of selection_*
falsepositives:
  - Enterprise Web3 development, blockchain nodes, approved crypto treasury tooling
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1102
---
title: ClickFix Style User-Assisted Script Execution
id: 4b6f0c1d-errtraffic-clickfix-20260812
status: experimental
description: Detects suspicious browser spawned script hosts and clipboard-adjacent execution patterns consistent with ClickFix lures delivering Vidar, LegionLoader, ClipBanker, and related loaders.
author: Security Arsenal
date: 2026/08/12
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - \msedge.exe
      - \chrome.exe
      - \firefox.exe
      - \brave.exe
  selection_child:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
      - \mshta.exe
      - \rundll32.exe
      - \cmd.exe
      - \wscript.exe
      - \cscript.exe
  selection_cmd:
    CommandLine|contains:
      - iwr
      - irm
      - Invoke-WebRequest
      - DownloadString
      - FromBase64String
      - -enc
      - -w hidden
      - bypass
      - .bin
      - my_s.bin
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Admin automation launched from documentation pages, software update helpers
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1218
---
title: Microsoft 365 Lookalike Captive Portal Credential Domain Access
id: 8d7c6b5a-captivecrunch-20260812
status: experimental
description: Detects DNS or web access to Microsoft 365 lookalike domains linked to CaptiveCrunch captive portal credential theft and device code phishing.
author: Security Arsenal
date: 2026/08/12
logsource:
  category: dns
  product: windows
detection:
  selection_domains:
    QueryName|contains:
      - m365-owa.com
      - ms365-device.com
      - ms365-live.com
      - owa-ms365.com
  selection_ip:
    QueryName: 38.146.28.75
  condition: 1 of selection_*
falsepositives:
  - Rare typo navigation, security research, sandbox detonation
level: critical
tags:
  - attack.credential_access
  - attack.t1566
  - attack.t1557
  - attack.t1078

KQL — Microsoft Sentinel / Defender

let iocs = datatable(type:string, value:string)
[
    'IPv4','193.221.200.219',
    'IPv4','158.94.208.104',
    'IPv4','38.146.28.75',
    'domain','cdnjsdelivr.beer',
    'domain','networksolutionson.sbs',
    'domain','verification-cdn-cloud.beer',
    'domain','istile-c-cloud.beer',
    'domain','ghdnsserverns.beer',
    'domain','mnoskemp.beer',
    'domain','m365-owa.com',
    'domain','ms365-device.com',
    'domain','ms365-live.com',
    'domain','owa-ms365.com',
    'hostname','endpoints.omniatech.io',
    'hostname','polygon-zkevm.drpc.org',
    'hostname','polygon-mumbai.gateway.tenderly.co',
    'hostname','api.zan.top',
    'hostname','sekirolegion.duckdns.org',
    'hostname','ap7.supportly.au',
    'url','http://158.94.208.104/x7GkP2mQ9zL4/my_s.bin'
];
let net = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| extend Hit = case(
    RemoteIP in~ (iocs | where type == 'IPv4' | project value), 'IPv4',
    RemoteUrl has_any (iocs | where type in~ ('domain','hostname','url') | project value), 'URL',
    tostring(AdditionalFields) has_any (iocs | project value), 'AdditionalFields',
    'none')
| where Hit != 'none'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, Hit, ReportId;
let proc = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ('iwr','irm','Invoke-WebRequest','DownloadString','FromBase64String','-enc','my_s.bin','.bin')
   or FileName in~ ('powershell.exe','pwsh.exe','mshta.exe','rundll32.exe','wscript.exe','cscript.exe','cmd.exe')
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId;
union net, proc
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Artifacts=make_set(pack('Process', coalesce(InitiatingProcessFileName, FileName), 'Command', coalesce(InitiatingProcessCommandLine, ProcessCommandLine), 'Remote', coalesce(RemoteUrl, RemoteIP))) by DeviceName
| order by LastSeen desc;

PowerShell

$ErrorActionPreference = 'SilentlyContinue'
$domains = @('cdnjsdelivr.beer','networksolutionson.sbs','verification-cdn-cloud.beer','istile-c-cloud.beer','ghdnsserverns.beer','mnoskemp.beer','m365-owa.com','ms365-device.com','ms365-live.com','owa-ms365.com','endpoints.omniatech.io','polygon-zkevm.drpc.org','polygon-mumbai.gateway.tenderly.co','api.zan.top','sekirolegion.duckdns.org','ap7.supportly.au')
$ips = @('193.221.200.219','158.94.208.104','38.146.28.75')
$hashes = @('5bfb25b8255b61e5ffdf6804451534bcfa9f1dfd225e6c8cdcefb5f50d846898','918fa52ae45ed60ba7cc8bdc99c3cbe9ab92e0375ec31fc05d0d4513be11c593','be99857449d2856dd5a84e21c8a3d5e0e01456adb44062ddec5a6b4970d8d42c','392b8ecce716ff0645d53f8831be46946cf4931f9124469c1f38b7d3e413aaf9','9688608017f35b48a719f529046172261af1d28a4ab2e80bc119cd1998f9bc6d','d873c2f85b4bc95f639aec333cfc977a89c2ec36d06a545f59a35f16e4c41685')

Write-Output '[+] Active or recent TCP connections to campaign IPs'
Get-NetTCPConnection | Where-Object { $ips -contains $_.RemoteAddress -or $ips -contains $_.OwningProcess } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}}

Write-Output '[+] DNS cache hits for campaign domains'
$dns = Get-DnsClientCache | Where-Object { $d = $_.Entry; $domains | Where-Object { $d -like ('*' + $_ + '*') } }
$dns | Select-Object Entry,Data,Type,Status

Write-Output '[+] Run keys and startup persistence review'
$runPaths = @('HKCU:/Software/Microsoft/Windows/CurrentVersion/Run','HKLM:/Software/Microsoft/Windows/CurrentVersion/Run','HKCU:/Software/Microsoft/Windows/CurrentVersion/RunOnce','HKLM:/Software/Microsoft/Windows/CurrentVersion/RunOnce')
foreach ($p in $runPaths) { Get-ItemProperty -Path $p | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Name -notmatch 'PS' -and ($_.Value -match 'powershell|mshta|rundll32|wscript|cscript|AppData|Temp|http') } | Select-Object @{n='Path';e={$p}},Name,Value } }

Write-Output '[+] Scheduled tasks with suspicious actions'
Get-ScheduledTask | ForEach-Object { $t=$_; $t.Actions | Where-Object { $_.Execute -match 'powershell|pwsh|mshta|rundll32|wscript|cscript|cmd' -or $_.Arguments -match 'iwr|irm|DownloadString|FromBase64String|-enc|http|\.bin' } | Select-Object @{n='Task';e={$t.TaskName}},@{n='Path';e={$t.TaskPath}},Execute,Arguments }

Write-Output '[+] Hosts file tamper check for M365 and blockchain lookalikes'
$hostsFile = Join-Path $env:SystemRoot 'System32/drivers/etc/hosts'
Get-Content $hostsFile | Where-Object { $line=$_; $domains | Where-Object { $line -like ('*' + $_ + '*') } }

Write-Output '[+] Hash sweep in high-risk user writable locations'
$roots = @($env:TEMP, $env:LOCALAPPDATA, $env:APPDATA, $env:USERPROFILE)
foreach ($root in $roots) { Get-ChildItem -Path $root -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.Length -lt 75MB } | ForEach-Object { $h = (Get-FileHash -Algorithm SHA256 -Path $_.FullName).Hash; if ($hashes -contains $h) { [pscustomobject]@{Path=$_.FullName;SHA256=$h;LastWriteTime=$_.LastWriteTime} } } }

Write-Output '[+] Process command lines matching ClickFix or blockchain C2 behavior'
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'iwr|irm|Invoke-WebRequest|DownloadString|FromBase64String|-enc|endpoints\.omniatech|polygon|drpc|zan\.top|my_s\.bin|\.beer|ms365|m365-owa' } | Select-Object ProcessId,Name,CommandLine

Response Priorities

Immediate: Block the listed IPs, domains, hostnames, and URL path at DNS, proxy, EDR network control, and mail or web filtering. Add EDR block or detect-only rules for browser-spawned PowerShell, mshta, rundll32, wscript, and cscript execution with encoded or download cradle command lines. Retro-hunt 7 to 30 days across endpoint network events, DNS cache, proxy logs, Microsoft 365 sign-ins, and hospitality VPN or guest network egress. Isolate hosts that contacted 193.221.200.219, 158.94.208.104, 38.146.28.75, or the M365 lookalike domains.
24h: Treat any user present on a captive portal during exposure, or any endpoint hitting m365-owa.com, ms365-device.com, ms365-live.com, or owa-ms365.com, as potentially compromised. Force password reset, revoke refresh tokens and sessions in Microsoft Entra ID, review device code authentication events, audit mailbox rules and OAuth grants, and require phishing-resistant MFA re-registration where feasible. For infostealer endpoints, rotate exposed credentials from a clean device, invalidate browser cookies and tokens, and check cryptocurrency clipboard hijacking reports for ClipBanker behavior.
1 week: Harden architecture by restricting public blockchain RPC access to approved workloads, adding detections for smart contract polling from non-server assets, blocking newly registered .sbs and .beer lookalike CDN patterns where business risk allows, enforcing captive portal user education for traveling staff, deploying conditional access and token protection for M365, and tightening mobile controls for banking approval flows with accessibility-service anomaly detection and Play Integrity or MDM signals.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub