Armorsteal Python Infostealer, FortiBleed Credential Campaign & Agent Tesla Phishing Wave: OTX Pulse Analysis — Enterprise Credential Theft Detection Pack

Classification: TLP:WHITE | Briefing Date: 2026-11-06 | Threat Level: HIGH

1. Threat Summary

Five concurrent OTX pulses published in the last 48 hours paint a consistent and alarming picture: credential theft at industrial scale is the dominant adversary objective across every intrusion vector currently observed in the wild.

The collective intelligence reveals three overlapping threat streams:

Stream One — FortiBleed (Initial Access Broker Operation): A global credential-compromise campaign has verified 86,644+ compromised Fortinet FortiGate firewalls and SSL VPN gateways across 194 countries. Threat actors are exploiting reused and leaked credentials combined with legacy SHA-256 password storage on FortiGate devices, harvesting authentication databases at scale and cracking them offline using distributed GPU clusters (evidenced by Hashtopolis tooling references in the pulse tags). The campaign is directly linked to INC/Lynx ransomware affiliate activity — compromised edge-device credentials are being monetized as initial access by ransomware operators. This is a classic IAB (Initial Access Broker) pipeline: harvest → crack → broker → ransom.

Stream Two — Commodity Infostealer Proliferation (Armorsteal + Agent Tesla): Two distinct stealer families are active simultaneously. Armorsteal is a Python-based, PyArmor-obfuscated malware kit combining infostealing, XMRig cryptomining, keylogging, clipboard hijacking (clipper), and backdoor capabilities, distributed via fake download pages impersonating legitimate software tools. Agent Tesla (ATT&CK S0331) continues to dominate the email threat landscape, with Microsoft's Q3 2026 telemetry showing ~7.3 billion phishing threats in a single quarter — nearly 3 billion in September alone, a 41% month-over-month increase. Agent Tesla campaigns are leveraging SVG attachments, CAPTCHA-gated phishing pages, QR code lures, device code phishing, and Microsoft Teams social engineering to deliver credential-theft payloads against Legal, Retail, Manufacturing, and Finance sectors across the US, Chile, Colombia, Mexico, and Spain.

Stream Three — Opportunistic Exploitation & Social Engineering: F5 Labs recorded 405 exploitation attempts against CVE-2026-0768, an unauthenticated RCE in the Langflow AI development platform — the first observed instance of AI/ML platform exploitation in internet-wide opportunistic scanning. Simultaneously, 121+ newly registered domains themed around the Grand Theft Auto VI release (November 19, 2026) are hosting fake downloads, fraudulent key-code sales, APK trojans, and credential-harvesting content lockers impersonating the leaker persona "CyberLeek."

The connective tissue: every one of these campaigns terminates in the same objective — credential material. Whether cracked from FortiGate config backups, keylogged by Armorsteal, exfiltrated by Agent Tesla SMTP, or phished via GTA VI lures, stolen credentials are the currency feeding the ransomware and BEC economy.

2. Threat Actor / Malware Profile

Armorsteal (Python Infostealer Kit)

Armorsteal's clipper module monitors the clipboard for cryptocurrency wallet address regex patterns and silently substitutes attacker-controlled addresses — a direct financial-theft mechanism that operates even before credential exfiltration completes.

Agent Tesla (ATT&CK S0331)

A mature .NET-based RAT/stealer sold as malware-as-a-service since 2014. Current Q3 2026 variants arrive via phishing emails carrying SVG attachments that redirect through CAPTCHA-gated pages (defeating automated URL detonation), ultimately delivering Agent Tesla payloads that harvest browser, email client (Outlook, Thunderbird), FTP, and VPN credentials. Exfiltration occurs via SMTP, FTP, or Telegram bot API. Device code phishing — abusing OAuth device authorization grant flows — is a notable emerging technique this quarter, bypassing MFA entirely by capturing legitimate Microsoft tokens.

FortiBleed (Campaign, Not Malware)

FortiBleed is an operational campaign rather than a malware family. Actors authenticate to internet-facing FortiGate SSL VPNs using credentials sourced from prior breaches, stealer logs, and dark web markets, then export device configuration files containing SHA-256-hashed local user passwords. These hashes are cracked offline using distributed GPU rigs (Hashtopolis clusters), yielding cleartext credentials subsequently sold to or used by INC/Lynx ransomware affiliates. The IC3 has published joint guidance (CSA 261006).

3. IOC Analysis

The pulses contain 98+ indicators across four types:

• IPv4 (e.g., 186.2.163.193): Armorsteal C2. Operationalize via egress firewall block, EDR network IOC sweep, and retroactive NetFlow/DNS log hunt for the last 90 days.
• Domains (e.g., datamons.org, wekash.net, splace.co.za, carloxmextos.org, gta6cyberleek.com, contact-rockstargames.com, cyberleek.*): Mix of stealer C2, phishing infrastructure, and typosquat/lure domains. Push to DNS sinkhole/proxy block lists. Note the GTA VI cluster uses diverse TLDs (.com, .click, .icu, .my, .cfd, .world) — TLD-agnostic blocklisting by domain string is required. contact-rockstargames.com is brand impersonation suitable for takedown referral.
• File Hashes (MD5/SHA1/SHA256): Armorsteal samples and Agent Tesla phishing payloads. SHA256 values should be loaded into EDR block lists (Defender Indicator API, CrowdStrike custom IOC, SentinelOne blacklist). MD5/SHA1 retained for legacy tooling correlation only — hash-only detection is brittle against repacked Python/PyArmor builds; prioritize behavioral detection.
• URLs (e.g., https://splace.co.za/.../onedrive/): OneDrive-themed phishing lure path. Block full URL at proxy; hunt proxy logs for the distinctive 60+ digit path pattern as a regex signature.
• CVEs (CVE-2026-0768, CVE-2024-4577, CVE-2021-26855/ProxyLogon, CVE-2017-9841, CVE-2018-20062, CVE-2021-34523, CVE-2022-41082): The Langflow pulse reveals scanners bundling legacy exploits (PHPUnit CVE-2017-9841, ThinkPHP CVE-2018-20062, Exchange ProxyLogon/ProxyNotShell, PHP CGI CVE-2024-4577) alongside the new AI-platform RCE. Vulnerability management teams should verify patching posture across this entire bundle — scanner traffic indicates these remain profitable.

Tooling: Decode/enrich with OTX DirectConnect API, MISP ingestion of the pulse IDs, ioc-finder or cybrok for extraction, and VirusTotal/AbuseIPDB for reputation pivot. Sigma/KQL below operationalize the behavioral layer since hashes rotate.

4. Detection Engineering

---
title: Armorsteal Infostealer Installation Path and Persistence
id: 8f3a2b91-7c4e-4d1a-9e5b-2a6f8c1d3e47
status: experimental
description: Detects Armorsteal Python infostealer artifacts - execution from SystemHealth\Update directory or creation of scheduled tasks referencing that path
date: 2026/11/06
author: Security Arsenal Threat Intelligence
references:
    - https://www.seqrite.com/blog/armorsteal-unpacked-breaking-down-a-python-malware-kit-that-steals-data-and-mines-crypto/
logsource:
    category: process_creation
    product: windows
detection:
    selection_path:
        Image|contains: 'C:\Windows\SystemHealth\Update\'
    selection_task:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: 'SystemHealth\Update'
    selection_python:
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
        CommandLine|contains: 'SystemHealth'
    condition: selection_path or selection_task or selection_python
falsepositives:
    - Legitimate software using similar paths (unlikely - SystemHealth is not a standard Windows directory)
level: high
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.execution
    - attack.t1059.006
---
title: Armorsteal XMRig Cryptominer Execution Indicators
id: 2c7d4e56-9a1b-4f3c-8d2e-5b9a1c7e3f28
status: experimental
description: Detects XMRig cryptomining payload deployment associated with Armorsteal infections, including common miner command-line arguments
date: 2026/11/06
author: Security Arsenal Threat Intelligence
logsource:
    category: process_creation
    product: windows
detection:
    selection_args:
        CommandLine|contains:
            - '--donate-level'
            - 'stratum+tcp://'
            - '--coin='
            - 'xmrig'
            - '--randomx'
    selection_network_c2:
        CommandLine|contains: '186.2.163.193'
    selection_domain:
        CommandLine|contains: 'datamons.org'
    condition: 1 of selection_*
falsepositives:
    - Legitimate cryptomining (rare in enterprise environments)
level: critical
tags:
    - attack.impact
    - attack.t1496
    - attack.command_and_control
---
title: Agent Tesla Phishing SVG Attachment Execution Chain
id: 5e1a9c38-4b6d-4e2f-9a7c-1d3e5f8b2a46
status: experimental
description: Detects browser or script host execution of SVG attachments followed by suspicious child processes, consistent with Q3 2026 Agent Tesla CAPTCHA-gated phishing delivery
date: 2026/11/06
author: Security Arsenal Threat Intelligence
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/05/email-threat-landscape-q3-2026-trends-and-insights/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\OUTLOOK.EXE'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
    selection_svg:
        CommandLine|contains:
            - '.svg'
            - 'AppData\Local\Temp'
    condition: selection_parent and selection_child and selection_svg
falsepositives:
    - Rare legitimate SVG workflow automation
level: high
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
    - attack.defense_evasion
    - attack.t1218

// Security Arsenal — Armorsteal / Agent Tesla / FortiBleed Hunt (Sentinel)
// Hunts C2 IOCs, Armorsteal install path, scheduled task persistence, and phishing lure domains
let Ipv4IOC = dynamic(["186.2.163.193"]);
let DomainIOC = dynamic(["datamons.org","wekash.net","splace.co.za","carloxmextos.org","gta6cyberleek.com","cyberleek.click","mygta6.icu","gta6keycodes.com","cyberleek.my","contact-rockstargames.com","cyberleek.cfd","cyberleek.world"]);
let HashIOC = dynamic(["e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690","253653f645b9c89e7e7e7e967926b0cf0f9adda98ac9d6ba4aa1eb354d80ab9d","bedd2297739632da8ee470367295fe976e55be74d628dcaee7fa98121ee530f1","ce832350c165522db03db040ca07917976d1a91f97e7016ea36dcc6b53e0eb13","f8b49891d15a578e4de28fecf99d0d78db6b2c3da81cd51c931b8d128e60c187","c438b9a3bb67e2c10eff0d01513422dc17dce7c5508303a680e46f3dcec886ef"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(90d)
 | where RemoteIP in~ (Ipv4IOC) or RemoteUrl has_any (DomainIOC)
 | extend HuntHit = "Network-C2"
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, HuntHit),
(DeviceProcessEvents
 | where TimeGenerated > ago(90d)
 | where FolderPath has @"SystemHealth\Update"
    or ProcessCommandLine has_any (DomainIOC)
    or ProcessCommandLine has_any (dynamic(["--donate-level","stratum+tcp://","--coin="]))
    or SHA256 in~ (HashIOC)
 | extend HuntHit = "Process-Armorsteal"
 | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName, HuntHit),
(DeviceEvents
 | where TimeGenerated > ago(30d)
 | where ActionType == "ScheduledTaskCreated"
 | where AdditionalFields has "SystemHealth"
 | extend HuntHit = "Persistence-SchedTask"
 | project TimeGenerated, DeviceName, FileName, FolderPath, AdditionalFields, InitiatingProcessFileName, HuntHit),
(EmailUrlInfo
 | where TimeGenerated > ago(30d)
 | where Url has_any (DomainIOC) or UrlDomain in~ (DomainIOC)
 | extend HuntHit = "Phish-URL"
 | project TimeGenerated, Url, UrlDomain, HuntHit)
| sort by TimeGenerated desc

# Security Arsenal — Armorsteal / FortiBleed / Agent Tesla Endpoint Hunt
# Run elevated on endpoints or deploy via RMM/Intune. Outputs findings to console + CSV.

$Findings = @()

# --- 1. Armorsteal install path ---
$ArmorPath = "$env:SystemRoot\SystemHealth\Update"
if (Test-Path $ArmorPath) {
    Get-ChildItem -Path $ArmorPath -Recurse -Force -ErrorAction SilentlyContinue | ForEach-Object {
        $hash = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        $Findings += [PSCustomObject]@{ Check='Armorsteal-Path'; Host=$env:COMPUTERNAME; Detail=$_.FullName; Hash=$hash }
    }
}

# --- 2. Suspicious scheduled tasks (Armorsteal persistence) ---
Get-ScheduledTask | ForEach-Object {
    $actions = ($_.Actions | Out-String)
    if ($actions -match 'SystemHealth' -or $_.TaskName -match 'SystemHealth|HealthUpdate|WinHealth') {
        $Findings += [PSCustomObject]@{ Check='Persistence-Task'; Host=$env:COMPUTERNAME; Detail="$($_.TaskName) :: $actions"; Hash='' }
    }
}

# --- 3. Known-bad file hashes (Armorsteal / Agent Tesla samples) ---
$BadHashes = @(
 'e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690',
 '253653f645b9c89e7e7e7e967926b0cf0f9adda98ac9d6ba4aa1eb354d80ab9d',
 'bedd2297739632da8ee470367295fe976e55be74d628dcaee7fa98121ee530f1',
 'ce832350c165522db03db040ca07917976d1a91f97e7016ea36dcc6b53e0eb13',
 'f8b49891d15a578e4de28fecf99d0d78db6b2c3da81cd51c931b8d128e60c187',
 'c438b9a3bb67e2c10eff0d01513422dc17dce7c5508303a680e46f3dcec886ef'
)
$ScanDirs = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads")
foreach ($dir in $ScanDirs) {
    Get-ChildItem $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($BadHashes -contains $h) {
            $Findings += [PSCustomObject]@{ Check='Malicious-Hash'; Host=$env:COMPUTERNAME; Detail=$_.FullName; Hash=$h }
        }
    }
}

# --- 4. Active connections to Armorsteal C2 ---
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -eq '186.2.163.193' } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
    $Findings += [PSCustomObject]@{ Check='C2-Connection'; Host=$env:COMPUTERNAME; Detail="$($_.RemoteAddress):$($_.RemotePort) PID=$($_.OwningProcess) Proc=$proc"; Hash='' }
}

# --- 5. XMRig miner process artifacts ---
Get-Process -ErrorAction SilentlyContinue | Where-Object {
    $_.ProcessName -match 'xmrig|miner' -or $_.Path -match 'SystemHealth'
} | ForEach-Object {
    $Findings += [PSCustomObject]@{ Check='Miner-Process'; Host=$env:COMPUTERNAME; Detail="$($_.ProcessName) :: $($_.Path)"; Hash='' }
}

# --- Output ---
if ($Findings.Count -gt 0) {
    $Findings | Format-Table -AutoSize
    $Findings | Export-Csv -Path ".\OTX-Hunt-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMdd-HHmm').csv" -NoTypeInformation
    Write-Host "[!] $($Findings.Count) findings — investigate immediately." -ForegroundColor Red
} else {
    Write-Host "[+] No Armorsteal/AgentTesla/C2 artifacts found on $env:COMPUTERNAME." -ForegroundColor Green
}

5. Response Priorities

Immediate (0–4 hours)

• Block all IOCs at every control plane: push 186.2.163.193 and the 12+ phishing/C2 domains to egress firewall, DNS sinkhole, and secure web gateway; load the six SHA256 hashes into EDR block policy.
• Hunt for Armorsteal artifacts: sweep the fleet for C:\Windows\SystemHealth\Update\, associated scheduled tasks, and PyArmor-packed Python processes using the Sigma and PowerShell detections above.
• FortiGate exposure audit: identify all internet-facing FortiGate/SSL VPN appliances; force credential rotation on any device whose config has ever been exportable via VPN-authenticated sessions; verify no local accounts use legacy SHA-256 storage.
• Email gateway tuning: flag/quarantine SVG attachments and OneDrive-themed URLs with long numeric paths; alert on inbound mail from the GTA VI lure domain cluster.

24 Hours

• Credential reset at scale: given the credential-theft focus of all five pulses, any host with an Armorsteal or Agent Tesla hit requires full identity compromise protocol — reset all credentials ever stored in browsers/mail clients on that host, revoke active sessions and OAuth grants (device code phishing makes token revocation mandatory), and rotate any FortiGate-admin credentials used from that machine.
• Retroactive 90-day network hunt: run the Sentinel KQL query for historical C2 contact; a single hit implies staged theft that may predate current logs.
• Phishing exposure review: pull mail-flow logs for delivery of the listed phishing URLs/domains; identify clickers via proxy logs and enroll them in the same reset protocol.

1 Week

• Edge architecture hardening: move FortiGate admin interfaces off the public internet, enforce MFA + PKI on SSL VPN, disable legacy password hashing, and implement config-export alerting. Treat edge-device credential stores as Tier-0 assets.
• Browser credential hygiene: deploy enterprise password managers and disable local browser credential storage via GPO — this directly degrades Armorsteal and Agent Tesla collection capability.
• AI platform exposure review: inventory Langflow and similar AI/ML dev platforms (Gradio, MLflow, JupyterHub) for internet exposure; patch CVE-2026-0768 and place behind authenticated gateways. The first opportunistic scanning of AI platforms has begun — assume it becomes routine.
• Brand monitoring: establish newly-registered-domain monitoring for your brand plus event-driven lure themes (major product launches) to preempt the next GTA VI-style campaign cycle.
• Detection validation: purple-team the Sigma rules above against a controlled Armorsteal sample in an isolated lab to confirm telemetry coverage before the next wave.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub