ClickFix & Armorsteal Credential-Theft Wave: DarkGate, Amadey, and WordPress Backdoor Campaigns — OTX Pulse Analysis & Detection Pack | Security Arsenal

Threat Summary

Four concurrent OTX pulses published on 2026-10-23 paint a coherent picture of the current credential-theft and initial-access ecosystem. While attributed to distinct, unattributed operators, these campaigns share a common strategic thread: abuse of user trust in legitimate-looking verification and business workflows to deliver infostealers and persistent access tooling.

The most operationally significant finding is the "Disposable Domains, Durable Hosting" pulse, which documents five months of activity across four malware families — DarkGate, Matanbuchus, Amatera, Wacatac, and Amadey — all routed through a single bulletproof hosting provider: AS202412 (OMEGATECH LTD, Seychelles). Every chain begins with a ClickFix fake CAPTCHA lure instructing victims to paste malicious commands into the Windows Run dialog, converting the victim into their own malware installer. Notably, the infrastructure leverages EtherHiding (blockchain-based C2), making traditional domain takedowns ineffective against the C2 layer.

The Armorsteal campaign uses SEO poisoning and typosquatting against users searching for Chocolatey and Microsoft Activation Scripts (MAS) — precisely the IT-savvy audience least likely to expect a trap. The payload is PyArmor-obfuscated Python malware with clipboard hijacking, remote access, and credential theft components. The massgravel.net typosquat of the legitimate MAS project (massgrave.dev) is a deliberate targeting of administrators and power users.

TRUST#GRAFT pivots the model: JavaScript loaders on compromised sites present fake Cloudflare verification screens while fingerprinting the browser and harvesting credentials from browser storage. When an authenticated WordPress administrator visits, the script abuses their live session to install a persistent PHP backdoor — converting a client-side lure into server-side persistence.

Finally, the 2026 Year End Phishing Lures pulse confirms mass social-engineering against Finance, Technology, Telecommunications, Manufacturing, Real Estate, and Aviation sectors, impersonating SharePoint, DocuSign, compensation adjustments, Q4 invoices, and access reviews — prime cover for credential harvesting during fiscal close.

Collective objective: bulk credential harvesting (browser stores, clipboard, session tokens) and durable initial access for resale or downstream ransomware deployment.

Threat Actor / Malware Profile

DarkGate / Amadey / Matanbuchus / Amatera Cluster (AS202412)

Distribution: ClickFix fake CAPTCHA pages on disposable domains (.shop, .sbs, .beer TLDs) and compromised legitimate sites; trojanized installers.
Payload behavior: Multi-stage loaders; DarkGate provides RAT functionality and credential theft; Amadey acts as a downloader for secondary stealers; Amatera and Matanbuchus serve as loader/RAT hybrids commonly resold to ransomware affiliates.
C2: Bulletproof hosting on AS202412 (OMEGATECH LTD, Seychelles); EtherHiding technique stores C2 configuration in blockchain smart contracts, making C2 rotation resilient to takedown.
Persistence: Registry Run keys and scheduled tasks established by the initial mshta/powershell execution chain.
Anti-analysis: Frequent domain rotation with consistent naming patterns; payload staging only after user-driven execution (evades sandbox detonation).

Armorsteal

Distribution: SEO poisoning; typosquatted domains impersonating Chocolatey and Microsoft Activation Scripts (massgravel.net).
Payload behavior: Three-component Python malware: remote access module, clipboard hijacker (cryptocurrency address substitution), and credential stealer.
C2: Hardcoded IPv4 infrastructure (186.2.163.185, 190.115.31.69, 186.2.175.183, 82.153.135.80) — predominantly offshore VPS ranges.
Persistence: Python interpreter bundled via installer; startup folder and registry persistence.
Anti-analysis: PyArmor obfuscation frustrates static analysis and string extraction.

TRUST#GRAFT (Web Media Optimizer Backdoor)

Distribution: JavaScript loaders injected into compromised websites; fake Cloudflare verification screens.
Payload behavior: Browser fingerprinting, credential harvesting from browser storage, environment profiling. Conditional pivot: if the victim holds an authenticated WordPress admin session, a PHP backdoor is written to the server.
Persistence: Server-side PHP backdoor — survives client remediation entirely.
Anti-analysis: Selective payload delivery based on profiling; benign behavior for non-admin visitors.

IOC Analysis

The indicator set spans four types with different operational lifespans:

Domains (highest volume): Disposable TLDs (.shop, .sbs, .beer, .icu, .me) dominate. These are short-lived but share naming patterns (capcha-cdn-js.beer, cdn-plugin-js.beer, cdn-2faclov.sbs) that enable regex-based predictive blocking. The massgravel.net typosquat warrants permanent blocking.
IPv4: Two distinct clusters — Armorsteal C2 (offshore VPS: 186.2.x, 190.115.x, 82.153.x) and Japanese consumer/hosting IP space (AS7506 GMO, AS4713 NTT, AS4721 J:COM) used for year-end phishing. The Japanese IPs indicate compromised hosting rather than actor-owned infrastructure; block with alerting rather than assuming all traffic is malicious.
File hashes (MD5/SHA1/SHA256): Armorsteal PyArmor payloads and TRUST#GRAFT backdoor artifacts. MD5s have low re-use value against repacked Python malware — prioritize the SHA256 values for the PHP backdoor and push all hashes to EDR blocklists as a defense-in-depth measure.
ASN-level intelligence: AS202412 (OMEGATECH LTD) should be treated as hostile infrastructure wholesale — consider blocking the entire ASN at the egress proxy if business requirements permit.

Operationalization: Ingest domains/IPs into DNS sinkhole and proxy blocklists; push hashes to EDR; add the ClickFix behavioral pattern (Run dialog → mshta/powershell) to detection content regardless of IOC freshness, since domain turnover outpaces indicator distribution.

Detection Engineering

YAML

---
title: ClickFix Fake CAPTCHA Run Dialog Execution
description: Detects ClickFix-style social engineering where victims paste commands into the Windows Run dialog, spawning mshta or powershell from explorer.exe with suspicious LOLBin chains. Associated with DarkGate, Amadey, Matanbuchus campaigns on AS202412.
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'Invoke-Expression'
      - 'iex'
      - 'DownloadString'
      - 'ms-hta'
  condition: selection_parent and selection_image and selection_cmd
fields:
  - CommandLine
  - ParentCommandLine
  - User
falsepositives:
  - Rare legitimate admin tooling; validate against IT change records
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
  - attack.t1218.005
status: experimental
date: 2026/10/23
author: Security Arsenal Threat Intelligence
---
title: Armorsteal PyArmor Python Infostealer Execution
description: Detects Python processes performing clipboard access or browser credential store access consistent with Armorsteal infostealer delivered via SEO poisoning against Chocolatey and MAS search terms.
logsource:
  category: process_creation
  product: windows
detection:
  selection_python:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Login Data'
      - 'cookies.sqlite'
      - 'key4.db'
      - 'pyperclip'
      - 'ctypes.windll.user32'
      - 'OpenClipboard'
      - 'web_data'
  filter_legit:
    CommandLine|contains:
      - 'site-packages'
      - 'conda'
  condition: selection_python and selection_cmd and not filter_legit
fields:
  - CommandLine
  - Image
  - User
falsepositives:
  - Legitimate Python automation touching clipboard APIs
level: medium
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.collection
  - attack.t1115
status: experimental
date: 2026/10/23
author: Security Arsenal Threat Intelligence
---
title: WordPress PHP Backdoor Written via Web Server Process
description: Detects web server worker processes writing PHP files to WordPress content directories, consistent with TRUST#GRAFT PHP backdoor deployment via hijacked admin sessions.
logsource:
  category: file_event
  product: windows
detection:
  selection_writer:
    Image|endswith:
      - '\php-cgi.exe'
      - '\php.exe'
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  selection_target:
    TargetFilename|contains:
      - '\wp-content\'
      - '\wp-includes\'
      - '\wp-admin\'
    TargetFilename|endswith: '.php'
  filter_uploads_known:
    TargetFilename|contains:
      - '\uploads\2026\'
  condition: selection_writer and selection_target and not filter_uploads_known
fields:
  - TargetFilename
  - Image
  - User
falsepositives:
  - Legitimate theme/plugin installations; correlate with admin change tickets
level: high
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.t1071.001
status: experimental
date: 2026/10/23
author: Security Arsenal Threat Intelligence

KQL — Microsoft Sentinel / Defender

// Hunt: ClickFix execution chains + OTX campaign infrastructure
// Security Arsenal — DarkGate/Amadey/Armorsteal campaign hunt (OTX 2026-10-23)
let ClickFixDomains = dynamic([
    "alianzeg.shop","newtdsone.shop","ai-nexora.sbs","cdn-2faclov.sbs",
    "lcates-vs.beer","capcha-cdn-js.beer","cdn-plugin-js.beer","carrotbunnies.com",
    "massgravel.net","gerlace.com","caapman.me","okuneva.sbs","vtevens.icu",
    "englaus.sbs","rsfashionsdesignbd.com","bvlbetonvloeren.be","tropical100.com.do"]);
let CampaignIPs = dynamic([
    "186.2.163.185","190.115.31.69","186.2.175.183","82.153.135.80",
    "157.7.189.101","157.7.44.119","118.20.84.128","123.98.253.31"]);
let NetHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl in~ (ClickFixDomains) or RemoteIP in (CampaignIPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
    | extend MatchType = "Network IOC";
let RunDialogExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("mshta.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe")
    | where ProcessCommandLine has_any ("http://","https://","iex","DownloadString")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessFileName, AccountName
    | extend MatchType = "ClickFix Run-Dialog Execution";
union NetHits, RunDialogExec
| sort by TimeGenerated desc

PowerShell

# Security Arsenal — OTX 2026-10-23 IOC Hunt
# Checks persistence artifacts, network connections, and hashes for
# DarkGate/Amadey ClickFix chains, Armorsteal, and TRUST#GRAFT indicators.
# Run elevated on endpoints; output CSV per host for SIEM ingestion.

$results = @()
$badIPs   = @("186.2.163.185","190.115.31.69","186.2.175.183","82.153.135.80",
              "157.7.189.101","157.7.44.119","118.20.84.128","123.98.253.31")
$badHashes = @("7324066f5825c125c351ab7ccebad14d","d0bbb176db499a05ab91c2bea826043d",
               "e4cedb7e809bb4335f25ddf16ec1f4c4","197f6a5103870ab3bb1a213f27a63c73")

# 1) Active connections to campaign C2
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $results += [pscustomobject]@{Host=$env:COMPUTERNAME; Type="C2-Connection";
      Detail="$($_.LocalPort)->$($_.RemoteAddress):$($_.RemotePort) PID=$($_.OwningProcess)"}
  }

# 2) Persistence: Run keys with script/LOLBIN references (ClickFix droppers)
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
  if (Test-Path $k) {
    (Get-ItemProperty $k).PSObject.Properties | Where-Object {
      $_.Value -match 'mshta|powershell|wscript|cscript|pythonw?\.exe.*http'
    } | ForEach-Object {
      $results += [pscustomobject]@{Host=$env:COMPUTERNAME; Type="Persistence-RunKey";
        Detail="$k :: $($_.Name) = $($_.Value)"}
    }
  }
}

# 3) Persistence: suspicious scheduled tasks spawned by explorer-spawned LOLBins
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'mshta|powershell|wscript' -and
  ($_.Actions.Arguments -match 'http|iex|DownloadString')
} | ForEach-Object {
  $results += [pscustomobject]@{Host=$env:COMPUTERNAME; Type="Persistence-SchedTask";
    Detail="$($_.TaskName) :: $($_.Actions.Execute) $($_.Actions.Arguments)"}
}

# 4) Hash sweep: Armorsteal / TRUST#GRAFT payload artifacts in common staging paths
$paths = @("$env:TEMP","$env:LOCALAPPDATA\Temp","$env:APPDATA","C:\Users\Public")
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
    if ($badHashes -contains $h.ToLower()) {
      $results += [pscustomobject]@{Host=$env:COMPUTERNAME; Type="MaliciousFile";
        Detail="$($_.FullName) MD5=$h"}
    }
  }
}

$results | Export-Csv ".\otx_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation
$results | Format-Table -AutoSize

Response Priorities

Immediate (0–4 hours)

Block all listed domains and IPv4 indicators at DNS, proxy, and EDR network layers; block AS202412 wholesale at egress if feasible.
Deploy the ClickFix Sigma rule environment-wide — the behavioral pattern outlives any individual IOC.
Push SHA256/MD5 hashes to EDR prevention (not just detection) policy.
Sweep WordPress estates for unauthorized .php files in wp-content/wp-includes modified in the last 90 days; audit admin accounts for unrecognized sessions.

Within 24 hours

All four campaigns harvest credentials — treat any host with a detection hit as a full credential compromise: force password resets for the affected user, revoke active sessions and tokens (including Entra ID/O365 refresh tokens), and rotate any credentials stored in the browser profile.
Hunt for clipboard-hijacking outcomes: review recent cryptocurrency transactions initiated from affected hosts if Armorsteal is confirmed.
Verify whether any phishing-lure clicks (SharePoint/DocuSign impersonation) resulted in MFA fatigue prompts or token consent grants; audit OAuth application consents.

Within 1 week

Neutralize ClickFix as a class: restrict or alert on mshta.exe child processes of explorer.exe via WDAC/AppLocker; consider disabling the Run dialog for standard users via GPO where operationally viable.
Harden WordPress: enforce MFA for admins, restrict admin panel access by IP/VPN, and deploy file-integrity monitoring on web roots.
Deploy DNS filtering rules flagging newly registered .sbs, .beer, .shop, and .icu domains in HTTP referer chains.
Brief Finance and HR on the year-end phishing themes (fake raises, Q4 invoices, access reviews) before fiscal-close communications peak.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

ClickFix & Armorsteal Credential-Theft Wave: DarkGate, Amadey, and WordPress Backdoor Campaigns — OTX Pulse Analysis & Detection Pack