ClickFix Fileless Infostealers, JADEPUFFER AI-Targeting Ransomware & Balonx PhaaS: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClickFix Fake CAPTCHA Fileless PowerShell Execution
id: 8f3a2c1e-9d4b-4e5a-a7c6-2f1d8e9b3a44
status: experimental
description: Detects ClickFix social-engineering execution pattern — encoded/compressed PowerShell spawned from Run dialog (explorer) or browser, consistent with DeerStealer/Vidar fileless delivery via XOR or Base64 obfuscation.
author: Security Arsenal Threat Intel
date: 2026/08/20
references:
    - https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
    selection_flags:
        CommandLine|contains:
            - ' -enc '
            - ' -e '
            - 'FromBase64String'
            - 'IEX'
            - 'Invoke-Expression'
            - '-bxor'
            - 'Decompress'
            - 'DeflateStream'
            - 'GzipStream'
    condition: selection_parent and selection_img and selection_flags
falsepositives:
    - Rare legitimate admin scripts; parent process (browser/explorer) is the strongest discriminator
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1204.002
    - attack.t1027
---
title: PhaaS Panel Infrastructure Communication - Balonx Sistema
id: 4b7d9e2f-1a3c-4d5b-8e6f-7c2a9d1e5b66
status: experimental
description: Detects network or DNS communication with Balonx Sistema PhaaS panel infrastructure and associated Spyroid Android RAT C2 domains targeting Mexican banking customers.
author: Security Arsenal Threat Intel
date: 2026/08/20
references:
    - https://www.group-ib.com/blog/balonx-sistema-mexico-phaas
logsource:
    category: dns
    product: windows
detection:
    selection_domains:
        query|contains:
            - 'soporte-aclaracion.xyz'
            - 'balonx.online'
            - 'callbalonx.info'
            - 'panelbalonxfs.xyz'
            - 'browser-app.com'
            - 'browsify.net'
            - 'e-wl.com'
    condition: selection_domains
falsepositives:
    - Threat research and sandbox detonation
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1566
---
title: Langflow CVE-2025-3248 Exploitation Post-Activity - JADEPUFFER
id: 2e5c8a1d-6f4b-4a7c-9d3e-1b8f4c6a2d77
status: experimental
description: Detects suspicious child processes and credential access on AI/ML infrastructure following Langflow CVE-2025-3248 exploitation, consistent with JADEPUFFER autonomous reconnaissance, credential harvesting, and ENCFORGE ransomware staging.
author: Security Arsenal Threat Intel
date: 2026/08/20
references:
    - https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentImage|endswith:
            - '/python'
            - '/python3'
            - '/uvicorn'
            - '/gunicorn'
    selection_children:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/nmap'
            - '/cat'
    selection_paths:
        CommandLine|contains:
            - '/etc/shadow'
            - '/etc/passwd'
            - 'id_rsa'
            - '.aws/credentials'
            - 'metadata.google.internal'
            - '169.254.169.254'
    condition: selection_parent and selection_children and selection_paths
falsepositives:
    - Legitimate ML pipeline scripts; baseline per-host and alert on deviation
level: high
tags:
    - attack.exploitation_of_public_facing_application
    - attack.t1190
    - attack.credential_access
    - attack.t1552

// Hunt: ClickFix execution, PhaaS C2, ENCFORGE hashes, and wallet-extension C2
let phaas_domains = dynamic(["soporte-aclaracion.xyz", "balonx.online", "callbalonx.info", "panelbalonxfs.xyz"]);
let ext_c2 = dynamic(["browser-app.com", "browsify.net", "e-wl.com"]);
let clickfix_lures = dynamic(["fidestrento.com", "game-corp.net", "pickleballmastery.com", "itechhardware.com", "shadesking.com", "mlm-dra.com", "aqarco.com"]);
let encforge_hashes = dynamic(["8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2", "ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a", "ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (phaas_domains, ext_c2, clickfix_lures)
        or RemoteIP == "196.251.84.11"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
    | extend Detection = "Network IOC"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where (InitiatingProcessFileName in~ ("explorer.exe", "msedge.exe", "chrome.exe", "firefox.exe")
        and FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe")
        and ProcessCommandLine has_any ("FromBase64String", "-enc", "-bxor", "GzipStream", "DeflateStream", "IEX"))
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
    | extend Detection = "ClickFix Fileless Execution"),
    (DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 has_any (encforge_hashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
    | extend Detection = "ENCFORGE Ransomware Binary"),
    (DeviceEvents
    | where TimeGenerated > ago(14d)
    | where ActionType == "BrowserLaunchedToOpenUrl" and RemoteUrl has_any (clickfix_lures)
    | project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName
    | extend Detection = "ClickFix Lure Page Visit")
| sort by TimeGenerated desc

<#
.SYNOPSIS
    Security Arsenal — OTX Pulse Hunt: ClickFix, Balonx PhaaS, Offside Extensions, ENCFORGE
.DESCRIPTION
    Checks endpoints for execution artifacts, persistence, browser extension presence,
    and network IOCs from the 2026-08-20 OTX pulse set.
#>

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. ClickFix: suspicious RunMRU entries (Win+R pasted commands) ---
$runMRU = Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
foreach ($prop in $runMRU.PSObject.Properties) {
    if ($prop.Value -match 'powershell|mshta|FromBase64String|IEX|certutil|bitsadmin') {
        $findings += [PSCustomObject]@{Check='ClickFix RunMRU'; Artifact="$($prop.Name) = $($prop.Value)"; Severity='HIGH'}
    }
}

# --- 2. Persistence: Run keys with encoded/obfuscated commands ---
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    $vals = Get-ItemProperty $key
    foreach ($p in $vals.PSObject.Properties) {
        if ($p.Value -match 'FromBase64String|-enc|-bxor|GzipStream|AppData.*\.ps1') {
            $findings += [PSCustomObject]@{Check='Infostealer Persistence'; Artifact="$key -> $($p.Name) = $($p.Value)"; Severity='CRITICAL'}
        }
    }
}

# --- 3. Scheduled tasks spawned near browser/PowerShell execution windows ---
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'powershell|mshta|wscript' -and
    $_.Actions.Arguments -match '-enc|FromBase64String|http'
} | ForEach-Object {
    $findings += [PSCustomObject]@{Check='Malicious Scheduled Task'; Artifact="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity='HIGH'}
}

# --- 4. ENCFORGE ransomware hashes on disk ---
$encforge = @('8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2',
              'ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a',
              'ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328')
$searchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", 'C:\ProgramData')
foreach ($path in $searchPaths) {
    Get-ChildItem $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($encforge -contains $h) {
            $findings += [PSCustomObject]@{Check='ENCFORGE Binary'; Artifact=$_.FullName; Severity='CRITICAL'}
        }
    }
}

# --- 5. Live network connections to PhaaS / extension C2 ---
$badIPs = @('196.251.84.11')
Get-NetTCPConnection -State Established | Where-Object { $badIPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = (Get-Process -Id $_.OwningProcess).ProcessName
    $findings += [PSCustomObject]@{Check='Active C2 Connection'; Artifact="$($_.RemoteAddress):$($_.RemotePort) via $proc"; Severity='CRITICAL'}
}

# --- 6. DNS cache hits for pulse domains ---
$badDomains = @('balonx.online','callbalonx.info','panelbalonxfs.xyz','soporte-aclaracion.xyz',
                'browser-app.com','browsify.net','e-wl.com','fidestrento.com','game-corp.net')
Get-DnsClientCache | Where-Object { $d = $_.Entry; $badDomains | Where-Object { $d -like "*$_*" } } | ForEach-Object {
    $findings += [PSCustomObject]@{Check='DNS Cache IOC'; Artifact="$($_.Entry) -> $($_.Data)"; Severity='HIGH'}
}

# --- 7. Firefox extensions inventory (Offside Wallet Theft Factory) ---
$ffProfiles = "$env:APPDATA\Mozilla\Firefox\Profiles"
if (Test-Path $ffProfiles) {
    Get-ChildItem $ffProfiles -Directory | ForEach-Object {
        $extJson = Join-Path $_.FullName 'extensions.json'
        if (Test-Path $extJson) {
            $exts = (Get-Content $extJson -Raw | ConvertFrom-Json).addons
            foreach ($e in $exts) {
                if ($e.defaultLocale.name -match 'wallet|web3|crypto|metamask|phantom|ledger') {
                    $findings += [PSCustomObject]@{Check='Suspicious Firefox Extension'; Artifact="$($e.defaultLocale.name) ($($e.id))"; Severity='MEDIUM'}
                }
            }
        }
    }
}

# --- Output ---
if ($findings.Count -gt 0) {
    $findings | Sort-Object Severity | Format-Table -AutoSize
    $findings | Export-Csv "$env:TEMP\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation
    Write-Host "`n[!] $($findings.Count) findings exported to $env:TEMP" -ForegroundColor Red
} else {
    Write-Host '[+] No IOC artifacts found on this host.' -ForegroundColor Green
}