ClickFix, ClingSTUN, and MALFEX: Defending Against Newsletter Round 118's Multi-Platform Threat Wave

---
title: ClickFix Run Dialog Script Execution - LUNEXSTEALER Delivery
description: Detects explorer.exe (Run dialog) spawning script interpreters or fetch tools with remote-retrieval arguments, consistent with UAC-0277 ClickFix social engineering delivering LUNEXSTEALER.
references:
  - https://securityaffairs.com/200775/breaking-news/security-affairs-malware-newsletter-round-118.html
  - https://attack.mitre.org/techniques/T1204/002/
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
id: 3f9c1a72-8b44-4e21-9d5a-2c7e6f0a1b93
status: experimental
date: 2026/04/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_cmdline:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'Invoke-Expression'
      - 'iex '
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'DownloadString'
      - 'FromBase64String'
      - ' -enc '
      - ' -e '
  condition: all of selection_*
falsepositives:
  - Rare; administrators pasting commands into Run dialog is atypical in managed environments
level: high
---
title: npm or node Spawning Shell or Network Fetcher During Install
description: Detects npm/node processes spawning shells or network retrieval utilities, consistent with malicious postinstall hooks such as MALFEX.
references:
  - https://securityaffairs.com/200775/breaking-news/security-affairs-malware-newsletter-round-118.html
  - https://attack.mitre.org/techniques/T1195/002/
author: Security Arsenal
id: 7b2e4d61-1a9f-4c38-b502-9e3d8c7f2a46
status: experimental
date: 2026/04/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\npm.cmd'
      - '\npm.exe'
      - '\npx.cmd'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\wscript.exe'
  condition: all of selection_*
falsepositives:
  - A small number of legitimate packages with native build steps (node-gyp); baseline per pipeline and allowlist known-good packages
level: high
---
title: Server Process Initiating Outbound STUN Connection
description: Detects processes on Linux servers initiating connections to STUN ports (3478/5349), consistent with ClingSTUN abusing public STUN infrastructure for C2. Tune to exclude legitimate WebRTC/VoIP workloads.
references:
  - https://securityaffairs.com/200775/breaking-news/security-affairs-malware-newsletter-round-118.html
  - https://attack.mitre.org/techniques/T1071/001/
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
id: c5a8f309-6d21-4b74-a1e8-4f2b9d0c3e57
status: experimental
date: 2026/04/10
logsource:
  category: network_connection
  product: linux
detection:
  selection_port:
    DestinationPort:
      - 3478
      - 5349
  filter_known_rtc:
    Image|endswith:
      - '/chrome'
      - '/firefox'
      - '/zoom'
      - '/asterisk'
      - '/freepbx'
      - '/teams'
  condition: selection_port and not filter_known_rtc
falsepositives:
  - Legitimate VoIP/WebRTC services (Asterisk, FreeSWITCH, coturn); exclude known RTC infrastructure by host group
level: medium

// Hunt 1: ClickFix lineage - Run dialog (explorer) spawning script/fetch tools
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","curl.exe","wscript.exe","cscript.exe")
| where ProcessCommandLine has_any ("http://","https://","iex","Invoke-WebRequest","iwr ","DownloadString","FromBase64String"," -enc")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

// Hunt 2: npm/node spawning shells or fetchers (MALFEX-style postinstall abuse)
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("node.exe","npm.cmd","npm.exe","npx.cmd")
| where FileName in~ ("powershell.exe","cmd.exe","curl.exe","certutil.exe","bitsadmin.exe","wscript.exe","bash.exe","sh.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, FolderPath
| order by TimeGenerated desc;

// Hunt 3: Linux hosts with outbound STUN (3478/5349) from non-RTC processes (ClingSTUN) - via Syslog/CEF ingestion
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationPort in (3478, 5349)
| where DeviceAction !in ("deny","blocked")
| summarize ConnectionCount = count(), DistinctDestinations = dcount(DestinationIP), Destinations = make_set(DestinationIP, 20) by SourceHostName, SourceIP, DestinationPort, bin(TimeGenerated, 1d)
| order by ConnectionCount desc;

// Hunt 4: Defender network events to STUN ports from server-class devices
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort in (3478, 5349)
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe","Teams.exe","Zoom.exe")
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, bin(TimeGenerated, 1d)
| order by Connections desc;

-- Hunt: ClickFix-style execution lineage and postinstall abuse artifacts
-- Part A: Processes whose parent is explorer with script/fetch tooling and remote URLs
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime,
       get_member(field='Exe') AS ProcessPath
FROM pslist()
WHERE CommandLine =~ '(?i)(https?://|FromBase64String|DownloadString|Invoke-Expression|iex | -enc)'
  AND Name =~ '(?i)(powershell|pwsh|mshta|curl|wscript|cscript)'

-- Part B: npm/node parents spawning shells (MALFEX-style postinstall)
SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(powershell|cmd|curl|certutil|sh|bash)'
  AND Ppid IN (
       SELECT Pid FROM pslist()
       WHERE Name =~ '(?i)(node|npm|npx)'
     )

-- Part C: npm lifecycle scripts present in recently modified node_modules (triage artifact)
SELECT FullPath, Mtime, Size
FROM glob(globs='C:\Users\*\**\node_modules\**\package.json')
WHERE Mtime > timestamp(epoch=win32time_to_unix(now() - 12096000000000))

# ClickFix / LUNEXSTEALER hardening + verification (run elevated)
# 1) Audit RunMRU for evidence of pasted commands (ClickFix artifacts live here)
Get-ChildItem 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -ErrorAction SilentlyContinue |
  ForEach-Object { $_.Property } | ForEach-Object {
    $v = (Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU').$_
    if ($v -match 'http|iex|Invoke|certutil|bitsadmin|mshta') {
      Write-Warning "Suspicious RunMRU entry: $_ = $v"
    }
  }

# 2) Enforce PowerShell Constrained Language + Script Block Logging on endpoints
Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -Value 1 -Force
New-Item 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Force | Out-Null
Set-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name EnableTranscripting -Value 1 -Force

# 3) Disable mshta via WDAC/AppLocker is ideal; at minimum enable audit of mshta execution
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

# 4) Verify no unauthorized outbound STUN from Windows hosts (defense-in-depth)
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -in 3478,5349 } |
  Select-Object LocalAddress,RemoteAddress,RemotePort,OwningProcess,
    @{N='Process';E={(Get-Process -Id $_.OwningProcess).ProcessName}}

#!/bin/bash
# ClingSTUN / MALFEX hardening for Linux servers and build runners
# 1) Identify current outbound STUN connections from non-RTC processes
ss -uapn | awk '$5 ~ /:(3478|5349)$/ {print}'

# 2) Egress-filter STUN on server VLANs (keep only on designated RTC hosts)
# iptables -A OUTPUT -p udp --dport 3478 -j LOG --log-prefix "STUN-EGRESS: "
# iptables -A OUTPUT -p udp --dport 3478 -j DROP
# iptables -A OUTPUT -p tcp --dport 3478:5349 -j DROP

# 3) Alert historically: search auth/syslog for repeated STUN destinations
grep -Ei '3478|5349' /var/log/syslog* 2>/dev/null | tail -50

# 4) npm supply-chain hardening: disable lifecycle scripts globally on CI/dev hosts
npm config set ignore-scripts true --location=global
echo 'ignore-scripts=true' > ~/.npmrc

# 5) Audit installed trees for postinstall hooks (MALFEX-style)
find . -name package.json -path '*node_modules*' -mtime -60 2>/dev/null | \
  xargs grep -l '"postinstall"' 2>/dev/null

# 6) Verify lockfile integrity before installs in CI
npm ci --ignore-scripts --audit --audit-level=high