Bumblebee, npm Supply Chain, and ClickFix: OTX Pulse Analysis — Credential Theft & Akira Ransomware

title: Potential ClickFix Activity via Rundll32 WebDAV
id: 481df7f2-1a2c-4b7c-8e9d-1f2a3b4c5d6e
description: Detects suspicious rundll32 execution with ordinal patterns over WebDAV, typical of ClickFix campaigns.
status: experimental
date: 2026/07/29
author: Security Arsenal
references:
    - https://www.cyberproof.com/blog/clickfix-keeps-evolving-rundll32-ordinal-execution-over-webdav/
tags:
    - attack.execution
    - attack.t1204
    - clickfix
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - '#1'
            - 'http://'
            - 'https://'
        CommandLine|contains: '.dll'
    filter_legit:
        CommandLine|contains:
            - 'shell32.dll'
            - 'setupapi.dll'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Suspicious Bun Runtime Execution via NPM
id: 592e8g3-2b3d-5c8d-9f0e-2g3b4c5d6e7f
description: Detects the execution of Bun runtime spawned by npm or node, indicative of the npm supply chain worm targeting GitHub/AWS creds.
status: experimental
date: 2026/07/29
author: Security Arsenal
references:
    - https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
tags:
    - attack.initial_access
    - attack.t1195.002
    - supply-chain
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\bun.exe'
    selection_parent:
        ParentImage|endswith:
            - '\npm.cmd'
            - '\node.exe'
            - '\npx.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate developers using Bun runtime
level: high
---
title: Bumblebee Loader Trojanized Installer Pattern
id: 6a3f9h4-3c4e-6d9e-0g1f-3h4c5d6e7f8g
description: Detects execution of signed binaries often abused by Bumblebee loaders or specific MD5 hashes associated with the campaign.
status: experimental
date: 2026/07/29
author: Security Arsenal
references:
    - https://thedfirreport.com/2025/08/05/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-2/
tags:
    - attack.execution
    - attack.s1059
    - bumblebee
logsource:
    category: file_event
    product: windows
detection:
    selection_hash:
        Hashes|contains:
            - 'a746da514c90f26a187a294fda7edc1b'
            - 'bcee0ab10b23f5999bcdb56c0b4a631a'
    condition: selection_hash
level: critical

// Hunt for ClickFix WebDAV activity and npm compromise indicators
let IOCs = dynamic(["gentletouchchiropracticclinicauroracol.com", "git-tanstack.com", "opmanager.pro", "angryipscanner.org"]);
let SuspiciousHashes = dynamic(["a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96", "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6"]);
// Network Connections to C2/Phishing domains
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort
| union (
    DeviceProcessEvents
    // Hunt for rundll32 with WebDAV/Internet patterns
    | where FileName =~ "rundll32.exe" and (ProcessCommandLine has "http" or ProcessCommandLine has "#1")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine
)
| union (
    DeviceProcessEvents
    // Hunt for Bun runtime spawned by package managers
    | where FileName =~ "bun.exe" and InitiatingProcessFileName has_any ("npm", "node", "npx")
    | project Timestamp, DeviceName, AccountName, FileName, InitiatingProcessFileName
)
| union (
    DeviceFileEvents
    // Hunt for malicious file hashes
    | where SHA256 has_any (SuspiciousHashes) or MD5 has_any (SuspiciousHashes)
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256
)

# IOC Hunter for Bumblebee, npm Worm, and ClickFix Hashes
# Requires Administrator privileges

$TargetHashes = @(
    "a14506c6fb92a5af88a6a44d273edafe10d69ee3d85c8b2a7ac458a22edf68d2", # Bumblebee/Akira
    "186b26df63df3b7334043b47659cba4185c948629d857d47452cc1936f0aa5da", # Bumblebee/Akira
    "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96", # npm Worm
    "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6"  # ClickFix
)

$SearchPaths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp", "C:\Temp")

Write-Host "[+] Starting IOC Hunt for Bumblebee/npm/ClickFix artifacts..." -ForegroundColor Cyan

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path..." -ForegroundColor Yellow
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $FileHash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# Check for running suspicious processes (Bun, Rundll32 remote)
$Procs = @("bun", "rundll32")
foreach ($P in $Procs) {
    $Found = Get-Process -Name $P -ErrorAction SilentlyContinue
    if ($Found) {
        Write-Host "[!] Suspicious process '$P' running. Check parent command line." -ForegroundColor Yellow
        $Found | Select-Object ProcessName, Id, Path, StartTime | Format-Table
    }
}

Write-Host "[+] Hunt complete. Verify findings." -ForegroundColor Green