BigBear 2.0 Evilginx2 PhaaS + Fake AI Ads BitB Campaign: Credential Theft & Cloud Token-Jacking Wave — OTX Pulse Analysis

---
title: Evilginx2 BigBear 2.0 AiTM Phishing Infrastructure Access
id: 8f3a1c2e-7b4d-4e91-a5c6-2d9f8e1a3b01
status: experimental
description: Detects network connections to known BigBear 2.0 / Evilginx2 PhaaS nodes and fake AI advertising phishing domains observed in OTX pulses
author: Security Arsenal
references:
  - https://www.cloudsek.com/blog/tracking-bigbear-2-0-evilginx2-phishing-campaign
  - https://www.island.io/blog/behind-the-connect-button-the-fake-ai-ads-campaign
date: 2026/10/07
logsource:
  category: dns
detection:
  selection_bigbear:
    query|contains:
      - 'dronalms.com'
      - 'ccpipharma.com'
      - 'knowncontractor.com'
      - 'hnospascualfadon.com'
      - 'annastudios-paros.com'
      - 'arrmmy.com'
      - 'captelind.com'
      - 'daengrentacar.com'
  selection_bitb:
    query|contains:
      - 'sync-account.com'
      - 'verification-security.com'
      - 'payment-confirm.com'
      - 'claude-ads.ai'
      - 'claude-advertisers.ai'
      - 'gemini-ads-team.com'
      - 'gemini-advertisers.com'
      - 'manusbymeta.com'
  condition: 1 of selection_*
falsepositives:
  - Threat research and sandbox detonation
level: high
tags:
  - attack.credential_access
  - attack.t1557
  - attack.t1566.002
---
title: Suspicious AWS Credential Validation for Amazon Bedrock Access
id: 2c7d9e4a-1f6b-4c83-b7e2-5a3d6f9c1e02
status: experimental
description: Detects the KMON_NOC-style validation sequence where stolen AWS keys are tested via GetCallerIdentity followed by Bedrock ListFoundationModels or model invocation, potentially from external infrastructure
author: Security Arsenal
references:
  - https://securitylabs.datadoghq.com/articles/beyond-valid-credentials-how-exposed-aws-keys-are-tested-for-amazon-bedrock-access
date: 2026/10/07
logsource:
  product: aws
  service: cloudtrail
detection:
  selection_bedrock:
    eventSource: 'bedrock.amazonaws.com'
    eventName:
      - 'ListFoundationModels'
      - 'Converse'
      - 'InvokeModel'
  filter_known_automation:
    userIdentity.type: 'AssumedRole'
    userIdentity.principalId|contains: 'deploy-pipeline'
  condition: selection_bedrock and not filter_known_automation
falsepositives:
  - Legitimate developer experimentation with Bedrock from corporate IP ranges
level: medium
tags:
  - attack.discovery
  - attack.t1526
  - attack.t1078.004
---
title: Browser-in-the-BitB Phishing Artifact - Suspicious OAuth Window Spawn
id: 6e1b4a8d-3c9f-4d72-a8e5-7b2c4d6e9f03
status: experimental
description: Detects browsers establishing websocket connections to known fake-AI-ads phishing domains, consistent with the socket.io Browser-in-the-Browser credential theft platform
author: Security Arsenal
references:
  - https://www.island.io/blog/behind-the-connect-button-the-fake-ai-ads-campaign
date: 2026/10/07
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - 'socket.io'
    cs-host|contains:
      - 'claude-ads.ai'
      - 'claude-advertisers.ai'
      - 'gemini-ads-team.com'
      - 'gemini-advertisers.com'
      - 'manusbymeta.com'
      - 'sync-account.com'
      - 'verification-security.com'
      - 'payment-confirm.com'
  condition: selection
falsepositives:
  - None expected; these domains are confirmed phishing infrastructure
level: critical
tags:
  - attack.credential_access
  - attack.t1556
  - attack.t1566

// Hunt: Evilginx2/BigBear 2.0 AiTM + BitB phishing access and anomalous M365 sign-ins
let PhishDomains = dynamic(["dronalms.com","ccpipharma.com","knowncontractor.com","hnospascualfadon.com","annastudios-paros.com","arrmmy.com","captelind.com","daengrentacar.com","sync-account.com","verification-security.com","payment-confirm.com","claude-ads.ai","claude-advertisers.ai","gemini-ads-team.com","gemini-advertisers.com","manusbymeta.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (PhishDomains)
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessFileName;
let SuspiciousSignins = SigninLogs
| where TimeGenerated > ago(30d)
| where ResultType == 0
| summarize FirstToken=arg_min(TimeGenerated, *) by UserPrincipalName, SessionId
| project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, SessionId, UserAgent, AppDisplayName;
NetworkHits
| join kind=leftouter (SuspiciousSignins) on $left.InitiatingProcessAccountName contains tostring($right.UserPrincipalName)
| extend AiTM_Suspect = iff(isnotempty(IPAddress) and IPAddress != RemoteIP, "Possible session replay from different IP", "Review")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, UserPrincipalName, IPAddress, UserAgent, AiTM_Suspect
| order by TimeGenerated desc;

# Security Arsenal - Credential Theft IOC Hunt (BigBear 2.0 / BitB / AWS key testers)
# Run as admin on endpoints or via EDR live response
$phishDomains = @("dronalms.com","ccpipharma.com","knowncontractor.com","arrmmy.com","captelind.com",`
  "sync-account.com","verification-security.com","payment-confirm.com","claude-ads.ai",`
  "gemini-ads-team.com","gemini-advertisers.com","manusbymeta.com")
$badIPs = @("112.78.151.90","78.109.78.211","83.194.172.248","103.160.185.100","109.146.93.39","115.138.247.83")
$badHashes = @("923641364ef0ce3a6f1d944890244082b8c7f29c9600c0433b2a0ca9822c0608",`
  "c9335bb8a21bd2c568d03b040fb86a0e72145691e54a33495ee0cfaac55835dc")

Write-Host "=== [1] DNS cache check for phishing domains ===" -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $e=$_.Entry; $phishDomains | Where-Object { $e -like "*$_*" } } |
  Select-Object Entry, Data, TimeToLive

Write-Host "=== [2] Active/historical connections to AWS-key-tester IPs ===" -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $badIPs -contains $_.RemoteAddress } |
  Select-Object LocalAddress, LocalPort, RemoteAddress, State, OwningProcess

Write-Host "=== [3] Hash sweep of common drop locations ===" -ForegroundColor Cyan
$paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA\Temp","$env:USERPROFILE\Downloads")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -lt 50MB } |
    ForEach-Object {
      $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
      if ($badHashes -contains $h) { Write-Host "HIT: $($_.FullName) -> $h" -ForegroundColor Red }
    }
}

Write-Host "=== [4] Browser cache artifacts referencing phishing domains (Chrome) ===" -ForegroundColor Cyan
$chromeCache = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Cache"
if (Test-Path $chromeCache) {
  Get-ChildItem $chromeCache -Recurse -File -ErrorAction SilentlyContinue | Select-String -List `
    -Pattern ($phishDomains -join '|') -ErrorAction SilentlyContinue |
    Select-Object Path, LineNumber
}

Write-Host "=== [5] AWS CLI credential files present (review for unexpected keys) ===" -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\.aws" -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime
Write-Host "Hunt complete. Escalate any HITs to IR immediately." -ForegroundColor Green