ClickFix Clipboard Poisoning via third-party.com, Galago Ransomware Emergence, and TACACS+ Pre-Auth RCE: OTX Pulse Analysis — Enterprise Detection Pack

Threat Summary

Three converging threat streams surfaced in OTX telemetry this cycle, each representing a distinct intrusion vector that enterprise defenders must treat as active and operational:

1. ClickFix campaign abusing third-party[.]com. The domain third-party.com — historically a documentation placeholder akin to example.com and therefore embedded in countless developer docs, test harnesses, and training materials — has been compromised. Since at least June 2026, the domain serves OS-conditional content: Windows visitors receive a fake Cloudflare verification page that silently poisons the clipboard with a malicious PowerShell command and instructs the user to paste and execute it (the classic ClickFix / fake-CAPTCHA social engineering chain). Non-Windows visitors see benign content, a simple but effective anti-analysis gate. Staging infrastructure resolves through elxxvvx.xyz, which serves the payload fetch path /f.

2. Galago ransomware — a new RaaS entrant with Panzer lineage. Galago emerged in September 2026 claiming operational partnership with the Panzer ransomware crew. The link is corroborated by shared Tor leak-site infrastructure: both operations use onion addresses with the pnzr prefix (pnzr4del... for Galago, pnzr7uro... for Panzer). Galago's first publicly claimed victim is an Icelandic healthcare organization, and the operation runs a double-extortion model — encryption plus data-leak threats via its Tor portal. Healthcare targeting by a RaaS affiliate program signals an aggressive recruitment phase, which historically precedes victim-count surges.

3. CVE cluster in TACACS+ (CVE-2026-48842, CVE-2026-42542, CVE-2026-87902). Australian firm Elttam disclosed a critical pre-authentication remote code execution flaw in TACACS+, the 33-year-old AAA protocol released by Cisco in 1993 that remains embedded in nearly all modern routers, switches, and firewalls. Large enterprises, ISPs, data centers, and cloud providers are exposed. The pulse attribution context names Salt Typhoon and Fire Ant — Chinese state-nexus actors with a documented history of hollowing out telecommunications core infrastructure for persistence and lateral movement. Pre-auth RCE on network edge/AAA equipment is precisely the access class these actors monetize: no credentials needed, no endpoint agent present, minimal logging.

Collective read: defenders face a three-front problem — user-layer social engineering (ClickFix), criminal extortion pressure against healthcare (Galago/Panzer), and nation-state-grade exploitation of un-agentable network infrastructure (TACACS+). The common thread is trust abuse: a trusted placeholder domain, a trusted affiliate brand, a trusted protocol.

Threat Actor / Malware Profile

ClickFix (social engineering technique, unattributed operator)

• Distribution: Compromised third-party[.]com serving a fake Cloudflare verification challenge; OS fingerprinting gates delivery to Windows hosts only. Secondary staging at elxxvvx[.]xyz with payload path /f. The /token and /widget.js endpoints on third-party.com suggest the lure is embedded via a JavaScript widget — meaning any third-party site that embedded this 'harmless' placeholder widget may be an unwitting distribution node.
• Payload behavior: JavaScript writes a malicious PowerShell command to the Windows clipboard (navigator.clipboard.writeText or legacy execCommand('copy')), then instructs the victim to press Win+R / paste / Enter — achieving code execution with zero file drop and zero exploit. The executed command typically spawns powershell.exe (or pwsh, mshta, curl) from explorer.exe / run dialog parentage with encoded or download-cradle arguments.
• Anti-analysis: OS-conditional content serving; clipboard content never written to disk by the browser in an inspectable way; execution is user-initiated, defeating sandbox detonation that doesn't simulate the paste action.

Galago Ransomware (RaaS, Panzer-affiliated)

• Distribution: Unknown initial vector; RaaS affiliate model implies brokered access (phishing, exposed RDP/VPN, or purchased IAB access).
• Payload behavior: File encryption plus data exfiltration for double extortion; victim shaming via Tor leak portal.
• C2 / extortion infrastructure: Tor-based leak sites — pnzr4delgur5dlhtqcy7qqm6m7dkivxwh742enezpks5kswfpx7qrsid.onion (Galago), pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion (Panzer). Tor connectivity from corporate endpoints to known leak-site or RaaS infrastructure is a high-fidelity signal.
• Persistence: RaaS payloads commonly stage via scheduled tasks, run keys, or service creation prior to the encryption detonation phase — hunt broadly, not just for the encryptor.

Salt Typhoon / Fire Ant (nation-state, TACACS+ exploitation)

• Distribution/Vector: Pre-authentication RCE against TACACS+ services (CVE-2026-48842 et al.) on network devices — no endpoint telemetry, no user interaction.
• Post-exploitation: Consistent with documented tradecraft — persistence on network devices via config manipulation and rogue accounts, lateral movement across core routing infrastructure, long-dwell espionage against telecommunications providers.
• Anti-analysis: Operates below the EDR plane; detection depends on network telemetry, config integrity monitoring, and AAA log anomaly analysis.

IOC Analysis

Tooling: MISP/OpenCTI for indicator lifecycle; Suricata/Zeek for elxxvvx.xyz and /f URI matching at the network edge; Sigma + your SIEM for endpoint behavior; Nmap/vuln scanner authenticated scans for TACACS+ service discovery (TCP/49); Tenable/Qualys plugins as CVE detections ship.

Detection Engineering

---
title: ClickFix Fake CAPTCHA Clipboard PowerShell Execution
id: 9f2a1c4e-7b3d-4e5a-9c1f-2d8e6a0b5f71
status: experimental
description: Detects PowerShell spawned from Run dialog / explorer parentage with download-cradle or encoded arguments, consistent with ClickFix clipboard-poisoning execution (third-party.com campaign)
author: Security Arsenal Threat Intel
references:
    - https://www.manifold.security/blog/third-party-com-placeholder-clickfix
date: 2026/09/26
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\winver.exe'
            - '\RunDLL32.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\curl.exe'
    selection_args:
        CommandLine|contains:
            - ' -enc'
            - ' -e '
            - 'FromBase64String'
            - 'Invoke-Expression'
            - 'IEX'
            - 'DownloadString'
            - 'elxxvvx.xyz'
            - 'third-party.com'
    condition: selection_parent and selection_child and selection_args
falsepositives:
    - Admin tooling launched via Run dialog
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204
---
title: ClickFix Staging Infrastructure Network Connection
id: 2b7d5e8a-4c6f-4a9b-8d3e-1f5a7c9e2b44
status: experimental
description: Detects outbound connections to ClickFix staging domain elxxvvx.xyz or compromised placeholder domain third-party.com
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'elxxvvx.xyz'
            - 'third-party.com'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    condition: selection and not filter_browser
falsepositives:
    - Legacy documentation links clicked by developers
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
---
title: Tor Connectivity to Ransomware Leak Infrastructure
id: 7e1c9a3f-6d2b-4f8a-b5e4-3c7d9f1a6e28
status: experimental
description: Detects Tor client execution or connections to Tor ports associated with Galago/Panzer ransomware leak-site access or RaaS C2
author: Security Arsenal Threat Intel
date: 2026/09/26
logsource:
    category: network_connection
    product: windows
detection:
    selection_ports:
        DestinationPort:
            - 9001
            - 9030
            - 9050
            - 9150
    selection_proc:
        Image|endswith:
            - '\tor.exe'
            - '\tor-browser.exe'
    condition: selection_ports or selection_proc
falsepositives:
    - Authorized Tor usage by researchers
level: high
tags:
    - attack.command_and_control
    - attack.t1090.003

// ClickFix + staging infrastructure + suspicious PowerShell hunt (Microsoft Sentinel / MDE)
let ClickFixHosts = dynamic(["elxxvvx.xyz", "third-party.com"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (ClickFixHosts) or RemoteUrl endswith "/f" or RemoteUrl endswith "/token" or RemoteUrl endswith "/widget.js"
| project NetTime=TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
let SuspiciousPS = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","curl.exe")
| where ProcessCommandLine has_any ("-enc","FromBase64String","IEX","DownloadString","elxxvvx","third-party.com")
| where InitiatingProcessFileName in~ ("explorer.exe","winver.exe","rundll32.exe")
   or ProcessCommandLine has_any ("elxxvvx","third-party.com")
| project PSTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName;
NetHits
| join kind=leftouter SuspiciousPS on DeviceName
| where isnull(PSTime) or abs(datetime_diff('minute', PSTime, NetTime)) <= 30
| project DeviceName, NetTime, RemoteUrl, RemoteIP, PSTime, FileName, ProcessCommandLine
| order by DeviceName, NetTime;

# Security Arsenal — ClickFix / Galago IOC Hunt Script
# Run elevated on endpoints or via your RMM/EDR remote shell

$report = [System.Collections.Generic.List[object]]::new()

# 1. DNS cache check for ClickFix staging domains
$dns = Get-DnsClientCache | Where-Object { $_.Entry -match 'elxxvvx|third-party' }
foreach ($d in $dns) { $report.Add([pscustomobject]@{Check='DNSCache'; Finding=$d.Entry; Detail=$d.Data}) }

# 2. Recent PowerShell execution artifacts (ConsoleHost_history)
$hist = "$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt"
if (Test-Path $hist) {
    Get-Content $hist | Select-String -Pattern 'elxxvvx|third-party|FromBase64String|DownloadString' |
      ForEach-Object { $report.Add([pscustomobject]@{Check='PSHistory'; Finding=$_.Line.Trim(); Detail=$hist}) }
}

# 3. Run dialog MRU (ClickFix paste-and-run artifact)
$mru = 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
if (Test-Path $mru) {
    (Get-ItemProperty $mru).PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|curl|elxxvvx' } |
      ForEach-Object { $report.Add([pscustomobject]@{Check='RunMRU'; Finding=$_.Name; Detail=$_.Value}) }
}

# 4. Scheduled tasks & Run keys (ransomware pre-detonation persistence)
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|mshta|wscript|cmd' -and $_.TaskPath -notlike '\Microsoft*' } |
  ForEach-Object { $report.Add([pscustomobject]@{Check='SchedTask'; Finding=$_.TaskName; Detail=$_.Actions.Execute}) }
'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object {
    if (Test-Path $_) {
        (Get-ItemProperty $_).PSObject.Properties | Where-Object { $_.Value -match 'powershell|mshta|AppData|Temp' } |
          ForEach-Object { $report.Add([pscustomobject]@{Check='RunKey'; Finding=$_.Name; Detail=$_.Value}) }
    }
}

# 5. Active Tor / suspicious network connections
Get-NetTCPConnection -State Established | Where-Object { $_.RemotePort -in 9001,9030,9050,9150 } |
  ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report.Add([pscustomobject]@{Check='TorConn'; Finding="$($_.RemoteAddress):$($_.RemotePort)"; Detail=$p.ProcessName}) }

$report | Format-Table -AutoSize
if ($report.Count -gt 0) { $report | Export-Csv ".\ioc_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation }
else { Write-Output '[+] No indicators found.' }

Response Priorities

Immediate (0–4h):

• Block third-party.com and elxxvvx.xyz at DNS sinkhole, secure web gateway, and EDR network protection layers. Any historical hit = incident, not noise.
• Push the Sigma rules and run the KQL query across the last 30 days; triage Run-dialog-spawned PowerShell first — that is the ClickFix execution fingerprint.
• Inventory and isolate all TACACS+-speaking devices (TCP/49); apply vendor mitigations for CVE-2026-48842 / CVE-2026-42542 / CVE-2026-87902. Internet-reachable TACACS+ should be considered an emergency.
• Block egress to Tor (ports 9001/9030/9050/9150, known guard relays) absent an explicit research exception.

24h:

• For any host with ClickFix execution telemetry: force credential resets for the interactive user and any credentials resident on the box (browser stores, cached tokens); ClickFix chains frequently deliver stealers as the first-stage payload.
• Rotate TACACS+ shared secrets and audit AAA logs for anomalous authentication patterns and unknown source IPs querying network devices; check network-device configs against golden images for unauthorized local accounts.
• Validate backup integrity and restore runbooks for clinical/healthcare-adjacent systems given Galago's sector focus; brief leadership on double-extortion exposure.

1 week:

• Remove or replace every reference to third-party.com in internal documentation, code samples, and embedded widgets — the placeholder itself is now weaponized.
• Deploy PowerShell Constrained Language Mode / WDAC policies that neuter paste-and-run execution for standard users; enable clipboard-write auditing where your EDR supports it.
• Migrate network-device AAA off legacy TACACS+ where feasible, or front it with a hardened proxy; enforce management-plane ACLs so AAA services are reachable only from jump hosts.
• Dark-web monitoring keyed to the Galago/Panzer onion portals for mentions of your organization, suppliers, or sector peers.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub