ClickFix Campaigns & PAN-OS Exploitation: OTX Pulse Analysis — CastleLoader, macOS Infostealers, and EarthWorm

title: Potential ClickFix Activity - Windows Finger Protocol Execution
id: 48253084-20b4-48a2-8c1d-c41c2a974c3e
description: Detects the use of the legacy finger client, often abused in ClickFix campaigns to initiate download chains.
status: experimental
date: 2026/06/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6658f3c352c4f
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\finger.exe'
            - '\finger.com'
    condition: selection
falsepositives:
    - Legitimate administration (rare in modern environments)
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - clickfix
---
title: macOS ClickFix - Suspicious Terminal Pipe Execution
id: 550d8e21-9b1a-4a5f-b6e2-88f5c31a0e8a
description: Detects macOS Terminal commands piping curl output into osascript or bash, a common pattern in fake utility ClickFix attacks.
status: experimental
date: 2026/06/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6658f3c352c4f
logsource:
    category: process_creation
    product: macos
detection:
    selection_pipe:
        CommandLine|contains: '|'
    selection_tools:
        CommandLine|contains:
            - 'curl '
            - 'wget '
    selection_execution:
        CommandLine|contains:
            - 'osascript'
            - 'bash'
            - 'sh'
    condition: all of selection_*
falsepositives:
    - Legitimate developer scripts
level: medium
tags:
    - attack.execution
    - attack.t1059.004
    - clickfix
---
title: Suspicious Portable Python Execution (CastleLoader Vector)
id: 110c9f3a-7e4d-4c8a-9d0f-123456789abc
description: Detects execution of Python binaries from user profile directories or temp paths, indicative of portable Python payloads like CastleLoader.
status: experimental
date: 2026/06/09
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6658f3c352c4f
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains:
            - 'python.exe'
            - 'python3.exe'
            - 'pythonw.exe'
    selection_path:
        Image|contains:
            - '\AppData\Local\Temp\'
            - '\Downloads\'
            - 'Desktop'
    condition: all of selection_*
falsepositives:
    - Developer environments
level: high
tags:
    - attack.execution
    - attack.t1059.006
    - castleloader


kql
// Hunt for ClickFix related network connections to suspicious domains
let IoCDomains = pack_array("teamsvoicehub.com", "dapala.net", "staruxaproruha.com", "ai-like.net", "mtg-life.net", "novayastaruxa.com", "kevinnotanother.com", "jihiz.com", "kayeart.com", "bintail.com", "wusetail.com", "malext.com", "miappl.com", "pla7ina.cfd", "vagturk.com");
DeviceNetworkEvents
| where RemoteUrl in (IoCDomains) or Url in (IoCDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend ThreatContext = "ClickFix C2 or Lure Domain"
;
// Hunt for usage of Finger protocol (Windows)
DeviceProcessEvents
| where FileName =~ "finger.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend ThreatContext = "Potential ClickFix LOLBIN usage"
;
// Hunt for macOS suspicious script execution
DeviceProcessEvents
| where DeviceType == "Mac"
| where ProcessCommandLine has "curl" and (ProcessCommandLine has "|" and (ProcessCommandLine has "osascript" or ProcessCommandLine has "bash"))
| project Timestamp, DeviceName, AccountName, ProcessCommandLine
| extend ThreatContext = "Potential macOS ClickFix execution"


powershell
# Hunt script for CastleLoader Indicators
# Checks for specific SHA256 hashes in running processes

$TargetHash = "08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4"

Write-Host "[+] Scanning running processes for CastleLoader hash..."

$Processes = Get-Process -IncludeUserName

foreach ($Proc in $Processes) {
    try {
        $FilePath = $Proc.Path
        if ($FilePath -and (Test-Path $FilePath)) {
            $FileHash = (Get-FileHash -Path $FilePath -Algorithm SHA256).Hash
            if ($FileHash -eq $TargetHash) {
                Write-Host "[!] ALERT: Malicious process detected!" -ForegroundColor Red
                Write-Host "    PID: $($Proc.Id)"
                Write-Host "    Name: $($Proc.ProcessName)"
                Write-Host "    Path: $FilePath"
                Write-Host "    User: $($Proc.UserName)"
            }
        }
    } catch {
        # Access denied or system process
        continue
    }
}

Write-Host "[+] Scan complete."