AI Agent LLMjacking & QR Code Phishing: OTX Pulse Analysis — Enterprise Detection Pack

Recent intelligence from the AlienVault OTX community highlights two distinct yet concerning trends in credential theft: the weaponization of AI infrastructure and the evolution of QR code phishing. Between May and July 2026, researchers observing unauthenticated Model Context Protocol (MCP) honeypots recorded active exploitation attempts by threat actors scanning for vulnerable AI agent infrastructure. Simultaneously, a significant surge in QR code phishing campaigns has been detected, utilizing URL shorteners and malicious mobile applications (e.g., NagaPocker.apk) to bypass traditional security controls. These campaigns target financial, technology, and retail sectors, with a notable focus on Ukrainian entities amidst ongoing geopolitical conflicts. The collective objective is clear: exfiltration of credentials, session hijacking, and unauthorized access to sensitive cloud and financial accounts.

Threat Actor / Malware Profile

LLMjacking & AI Infrastructure Exploitation: Threat actors are actively scanning for exposed Model Context Protocol (MCP) servers. By interacting with these endpoints, attackers execute arbitrary shell commands and perform secrets-store lookups. This "LLMjacking" technique allows adversaries to leverage AI agents as a bridge to access underlying cloud infrastructure and steal sensitive credentials or API keys stored in the environment.

QR Code Phishing (Quishing): The second vector involves the distribution of malicious Android APKs (such as NagaPocker.apk, ludashi_home.apk) and phishing URLs via QR codes. These codes often use URL shorteners to obfuscate malicious destinations. Once a user scans the code, they are prompted to download a malicious app or visit a credential harvesting site. The malware facilitates account takeover (ATO) by intercepting SMS verification codes or capturing input directly.

• Distribution: Physical QR codes (stickers, flyers) and digital images embedded in emails or forums.
• Payload Behavior: The Android malware acts as a banking trojan, overlaying legitimate apps to capture login credentials and 2FA codes.
• C2 Communication: Connections are established to domains like gui.snitch-dev.site and kzeva2010.sbs to exfiltrated data.
• Persistence: Malicious APKs request extensive permissions upon installation to remain persistent and avoid uninstallation.

IOC Analysis

The provided indicators of compromise (IOCs) include network infrastructure used for both the AI agent exploitation and the QR phishing campaigns.

• IPv4 Addresses (MCP Honeypot Sources): IP addresses such as 115.84.87.150 and 23.27.175.241 represent scanners or bots actively looking for vulnerable AI endpoints. These should be blocked immediately at the perimeter.
• Domains & Hostnames (Phishing Infrastructure): Domains like snitch-dev.space and associated hostnames are used to host the phishing landing pages and malware payloads. SOC teams should operationalize these by feeding them into their DNS firewall and web proxy blocklists.
• Mobile APKs: File hashes for NagaPocker.apk and app-u7cp-release.apk (when available) should be added to mobile threat defense (MTD) allowlists/denylists.

Detection Engineering

Below are detection rules and hunt queries designed to identify exploitation of AI infrastructure and QR-related malware activity.

---
title: Potential MCP/LLM Agent Exploitation via Shell Commands
id: 6e8f2a1d-9b4c-4c8d-9e1f-3a2b1c0d9e8f
description: Detects suspicious shell command execution patterns potentially associated with the exploitation of AI Model Context Protocol (MCP) servers or container escape attempts.
status: experimental
date: 2026/07/28
author: Security Arsenal
references:
    - https://beelzebub.ai/blog/it-thought-it-had-won/
tags:
    - attack.credential_access
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith:
            - '/sh'
            - '/bash'
        CommandLine|contains:
            - 'mcp'
            - 'llm'
            - 'secrets-store'
            - 'env_vars'
    condition: selection
falsepositives:
    - Legitimate administration of AI/ML infrastructure
level: high
---
title: Suspicious Android APK Installation Related to QR Phishing
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
description: Identifies the installation of known malicious APKs associated with recent QR code phishing campaigns (e.g., NagaPocker).
status: experimental
date: 2026/07/28
author: Security Arsenal
references:
    - https://unit42.paloaltonetworks.com/qr-codes-as-attack-vector/
tags:
    - attack.initial_access
    - attack.social_engineering
    - attack.t1204.001
logsource:
    product: android
detection:
    selection:
        SubjectPackageName|contains:
            - 'naga'
            - 'ludashi'
            - 'k12sns'
    condition: selection
falsepositives:
    - Legitimate installation of less common apps with similar names (verify user behavior)
level: critical
---
title: DNS Query to Known QR Phishing Domains
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
description: Detects DNS resolution of domains associated with the QR code phishing infrastructure targeting credentials.
status: experimental
date: 2026/07/28
author: Security Arsenal
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'snitch-dev'
            - 'gui.snitch'
            - 'kzeva2010'
    condition: selection
falsepositives:
    - Rare, unless these domains are whitelisted for testing
level: high


kql
// Hunt for connections to MCP Honeypot source IPs (Potential LLMjacking scanners)
DeviceNetworkEvents
| where RemoteIP in ("115.84.87.150", "23.27.175.241", "102.210.28.96", "103.151.172.25", "108.80.112.16", "115.84.114.84", "152.55.176.13", "222.247.231.147")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemotePort, RemoteUrl

// Hunt for DNS requests to QR Phishing infrastructure
DeviceNetworkEvents
| where ActionType == "DnsQuerySuccess"
| where RemoteUrl has "snitch-dev" or RemoteUrl has "kzeva2010"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl

// Hunt for execution of shell commands referencing secrets or MCP
DeviceProcessEvents
| where ProcessFileName has_any ("sh", "bash", "python") 
| where ProcessCommandLine has_any ("mcp", "secrets", "ModelContextProtocol")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath


powershell
# IOC Hunt Script for QR Phishing Domains in DNS Cache
# Requires Administrator Privileges

$MaliciousDomains = @(
    "snitch-dev.site",
    "snitch-dev.online",
    "snitch-dev.space",
    "gui-snitch.online",
    "kzeva2010.sbs"
)

Write-Host "[+] Checking DNS Cache for malicious QR Phishing domains..."

$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue

if ($DnsCache) {
    foreach ($Domain in $MaliciousDomains) {
        $Matches = $DnsCache | Where-Object { $_.Entry -like "*$Domain*" }
        if ($Matches) {
            Write-Host "[ALERT] Found cache entry for: $Domain" -ForegroundColor Red
            $Matches | Format-List
        }
    }
} else {
    Write-Host "[-] No DNS Cache entries found."
}

Write-Host "[+] Hunt complete."

Response Priorities

• Immediate:

  • Block all listed IPv4 addresses at the firewall.
  • Block the listed domains and hostnames at the DNS resolver and web proxy.
  • Add the listed APK hashes to Mobile Device Management (MDM) blocklists.

• 24 Hours:

  • Review logs for any successful connections to the malicious IPs or resolution of the malicious domains.
  • If credential theft is suspected (specifically related to the MCP exploitation), initiate forced password resets and rotate API keys for exposed AI/ML services.

• 1 Week:

  • Architecture Hardening: Ensure all MCP and AI agent endpoints are authenticated and not exposed to the public internet. Implement network segmentation for AI research environments.
  • User Awareness: Conduct security awareness training specifically focusing on QR code safety and verifying URLs before scanning.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub