Threat Summary
The three OTX pulses show a convergent criminal-to-advanced intrusion pattern: social engineering that hands execution to the user, autonomous post-exploitation against AI infrastructure, and industrialized credential theft against financial customers. ClickFix is no longer a simple fake CAPTCHA lure. Reporting tied to the pulse describes progression from cleartext PowerShell and batch droppers delivering DeerStealer or Vidar to server-side polymorphic pages, XOR or Base64 compressed payloads, and fileless execution that reduces disk artifacts. JADEPUFFER is assessed as an agentic intrusion set exploiting CVE-2025-3248 in Langflow, then chaining reconnaissance, credential harvesting, lateral movement, container escape, and deployment of ENCFORGE, a Go ransomware binary built to destroy AI and ML assets across roughly 180 extensions. Balonx Sistema is a Mexico-based PhaaS operation targeting more than 20 financial institutions with tiered subscriptions, real-time WebSocket session hijacking to bypass MFA, AI-assisted vishing call flows, and Spyroid Android RAT distribution through fake security alerts; operators claim over 1,100 harvested credential sets since October 2025. Collectively, the objective is monetizable access: steal browser and identity material, destroy or extort high-value model estates, and convert banking sessions into fraud before controls react.
Threat Actor / Malware Profile
ClickFix uses fake CAPTCHA or verification pages that instruct victims to paste attacker-supplied PowerShell into Run or Terminal. Distribution is opportunistic through compromised sites, malvertising, SEO poisoning, and traffic distribution; the listed host and domains such as www.fidestrento.com, kiitec.ac.tz, aqarco.com, game-corp.net, pickleballmastery.com, itechhardware.com, shadesking.com, and mlm-dra.com are consistent with disposable or compromised infrastructure. Payload behavior centers on PowerShell launching encoded commands, retrieving XOR encrypted or Base64 compressed content, reflectively executing stealer logic, and staging DeerStealer or Vidar for browser cookies, tokens, crypto wallets, saved credentials, and system fingerprints. Persistence is usually light at initial stage and may rely on Run keys, scheduled tasks, or startup scripts after stealer execution. Anti-analysis includes server-side polymorphism, per-visit payload changes, cleartext-to-obfuscated transitions, fileless execution, and short-lived domains.
JADEPUFFER is named in the pulse as an evolving autonomous or agentic threat actor. Initial access is CVE-2025-3248 against exposed Langflow instances. Post-exploitation behavior includes discovery, credential harvesting, lateral movement, and container escape before dropping ENCFORGE. The ENCFORGE samples are represented by SHA256 values 8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2, ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a, and ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328. The malware is a compiled Go binary focused on AI and ML estates, including model weights, checkpoints, notebooks, pipelines, vector stores, and supporting data. Expected C2 or tasking is minimal after launch because ransomware can run offline, but pre-encryption access should be hunted through Langflow exploit requests, unusual container process trees, cloud metadata access, and new admin or service-account use. Anti-analysis likely includes Go packing, stripped symbols, environment checks for containers, and selective targeting of high-value extensions.
Balonx Sistema is the operator brand behind a PhaaS affecting Mexican banking. The panel infrastructure includes balonx.online, callbalonx.info, panelbalonxfs.xyz, soporte-aclaracion.xyz, IPv4 196.251.84.11, and admin API paths under /admin/api/api/gql, /admin/api/api/rest, and /admin/api/api/token. Distribution relies on fake bank security alerts, AI vishing and call-flow support, and Spyroid Android RAT installation. Payload behavior includes overlay or accessibility abuse, SMS and notification capture, credential collection, device reconnaissance, and WebSocket-assisted session hijacking to ride authenticated banking sessions after MFA. Persistence on Android typically comes from accessibility service enrollment, device admin or notification listener rights, battery optimization exclusion, and RAT re-registration to the panel. Anti-analysis includes domain rotation, subscription-gated panels, tokenized API endpoints, cryptocurrency payment handling, and real-time operator intervention.
IOC Analysis
The pulse set contains four operational indicator classes. Domains and hostnames are best used for DNS sinkholing, proxy and Secure Web Gateway blocks, TLS SNI and JA3 or JA4 hunting, passive DNS expansion, and retro searches across CDN or resolver logs; treat academic or business-looking domains such as kiitec.ac.tz as potentially compromised rather than attacker-owned. The IPv4 196.251.84.11 should be blocked at egress, but assume low dwell time and pivot by ASN, certificate, and hosting history. URLs under panelbalonxfs.xyz are high value because /admin/api/api/token, /admin/api/api/rest, and /admin/api/api/gql reveal panel authentication, REST tasking, and GraphQL operator workflows; preserve full URI paths, referers, cookies, authorization headers, and response bodies when legal for takedown and victim notification. File hashes for ENCFORGE should be enforced in EDR block lists and used for binary similarity, import hash, Go build ID, and section entropy pivots rather than treated as sufficient alone. CVE-2025-3248 is an exposure indicator: inventory internet-facing Langflow, confirm patch state, and hunt exploit attempts preceding process creation. SOC teams should load indicators into a TI platform with confidence and expiration, send network indicators to firewall, DNS, proxy, EDR network telemetry, and NDR, send hashes to EDR and email or web detonation, and send domains to brand monitoring and takedown workflow. Tooling that helps decode the behavior includes CyberChef for XOR and Base64 layers, oletools only if office lures appear, cape or any.run for detonation, Wireshark or Zeek for WebSocket session theft, mitmproxy for mobile RAT traffic in lab conditions, and YARA for Go ransomware and stealer artifacts.
Detection Engineering
---
title: ClickFix Fake CAPTCHA Fileless PowerShell Stealer Execution
id: 7d4a7e10-5e62-4f58-9d21-clickfix001
status: experimental
description: Detects user-launched PowerShell consistent with ClickFix fake CAPTCHA lures delivering DeerStealer or Vidar through encoded, compressed, or fileless commands.
references:
- 'https://www.menlosecurity.com/blog/the-evolution-of-clickfix-from-cleartext-to-server-side-polymorphism'
date: 2026/08/20
author: Security Arsenal
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- '-enc'
- '-ec'
- 'FromBase64String'
- 'IEX'
- 'Invoke-Expression'
- 'DownloadString'
- 'Invoke-WebRequest'
- 'Start-BitsTransfer'
- '-w hidden'
- '-WindowStyle Hidden'
- 'bypass'
- 'DeerStealer'
- 'Vidar'
parent_user_lure:
ParentCommandLine|contains:
- 'rundll32'
- 'explorer'
- 'msedge'
- 'chrome'
- 'firefox'
condition: selection and parent_user_lure
falsepositives:
- 'Admin automation using encoded PowerShell'
- 'Software deployment tools with hidden windows'
level: high
tags:
- attack.t1059.001
- attack.t1027
- attack.t1140
- attack.t1105
---
title: ENCFORGE AI and ML Asset Destruction File Activity
id: 9b1ed7a2-7b9c-4d3d-a7f0-encforge002
status: experimental
description: Detects suspicious bulk access or modification of AI and ML model artifacts associated with ENCFORGE ransomware after JADEPUFFER Langflow intrusion.
references:
- 'https://www.sysdig.com/blog/jadepuffer-evolves-the-agentic-threat-actor-deploys-ransomware-built-to-destroy-ai-models'
date: 2026/08/20
author: Security Arsenal
logsource:
category: file_event
product: windows
detection:
selection_ext:
TargetFilename|endswith:
- '.pt'
- '.pth'
- '.onnx'
- '.h5'
- '.keras'
- '.safetensors'
- '.ckpt'
- '.ipynb'
- '.joblib'
- '.mlmodel'
- '.gguf'
- '.bin'
selection_context:
TargetFilename|contains:
- 'models'
- 'checkpoints'
- 'weights'
- 'langflow'
- 'mlruns'
- 'wandb'
- 'vectorstore'
- 'rag'
condition: selection_ext and selection_context
falsepositives:
- 'Data science training jobs'
- 'Model backup or snapshot operations'
level: critical
tags:
- attack.t1486
- attack.t1490
- attack.t1078
- attack.t1611
---
title: Balonx Sistema PhaaS Panel and Spyroid Infrastructure
id: 51d6aa31-d416-4d0a-93d2-balonx003
status: experimental
description: Detects DNS resolution or proxy access to Balonx Sistema panel, call-flow, support lure, and Spyroid API infrastructure targeting Mexican banking users.
references:
- 'https://www.group-ib.com/blog/balonx-sistema-mexico-phaas'
date: 2026/08/20
author: Security Arsenal
logsource:
category: dns
detection:
selection:
query|contains:
- 'soporte-aclaracion.xyz'
- 'balonx.online'
- 'callbalonx.info'
- 'panelbalonxfs.xyz'
condition: selection
falsepositives:
- 'Threat research or takedown infrastructure access'
level: high
tags:
- attack.t1071.001
- attack.t1566
- attack.t1598
- attack.t1656
let net_iocs = dynamic(['196.251.84.11','soporte-aclaracion.xyz','balonx.online','callbalonx.info','panelbalonxfs.xyz','www.fidestrento.com','kiitec.ac.tz','aqarco.com','game-corp.net','pickleballmastery.com','itechhardware.com','shadesking.com','mlm-dra.com']);
let proc_terms = dynamic(['FromBase64String','Invoke-Expression','DownloadString','-enc','DeerStealer','Vidar','langflow','CVE-2025-3248','encforge','safetensors','.onnx','panelbalonxfs']);
union
(DeviceNetworkEvents
| where RemoteIP in (net_iocs) or RemoteUrl has_any (net_iocs) or RemoteUrl contains '/admin/api/api/token' or RemoteUrl contains '/admin/api/api/gql' or RemoteUrl contains '/admin/api/api/rest'
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceProcessEvents
| where ProcessCommandLine has_any (proc_terms) or FileName has_any (proc_terms) or InitiatingProcessCommandLine has_any (proc_terms)
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), DistinctDevices=dcount(DeviceName), SampleCommand=any(ProcessCommandLine) by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, SHA256
| order by LastSeen desc;
$ErrorActionPreference = 'SilentlyContinue'
$iocs = @('196.251.84.11','soporte-aclaracion.xyz','balonx.online','callbalonx.info','panelbalonxfs.xyz','www.fidestrento.com','kiitec.ac.tz','aqarco.com','game-corp.net','pickleballmastery.com','itechhardware.com','shadesking.com','mlm-dra.com')
$hashes = @('8cb0c223b018cecef1d990ec81c67b826eb3c30d54f06193cf69969e9a8baea2','ab9824b61587c77a8d8649545cdbdc63ed2c384e45c9aba534e3f457f96efa7a','ea7822eac6cecef7746c606b862b4d3034856caf754c4cf69533662637905328')
Write-Output '[+] Suspicious processes and command lines'
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match 'FromBase64String|Invoke-Expression|DownloadString|DeerStealer|Vidar|encforge|langflow|panelbalonxfs|safetensors|onnx' -or $_.Name -match 'powershell|pwsh|rundll32|mshta|wscript|cscript|encforge' } | Select-Object ProcessId, ParentProcessId, Name, CommandLine | Format-List
Write-Output '[+] Network connections to OTX indicators'
Get-NetTCPConnection | Where-Object { $iocs -contains $_.RemoteAddress -or $_.RemoteAddress -eq '196.251.84.11' } | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess | Format-Table -AutoSize
Write-Output '[+] DNS cache hits'
Get-DnsClientCache | Where-Object { $n = $_.Name; $iocs | Where-Object { $n -like ('*' + $_ + '*') } } | Select-Object Name, Type, Data | Format-Table -AutoSize
Write-Output '[+] Persistence artifacts'
$runKeys = @('HKCU:/Software/Microsoft/Windows/CurrentVersion/Run','HKLM:/Software/Microsoft/Windows/CurrentVersion/Run','HKCU:/Software/Microsoft/Windows/CurrentVersion/RunOnce','HKLM:/Software/Microsoft/Windows/CurrentVersion/RunOnce')
foreach ($k in $runKeys) { Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'powershell|enc|base64|clickfix|encforge|balonx|spyroid|langflow|temp|appdata' } | Select-Object @{n='Key';e={$k}}, Name, Value } }
Get-ScheduledTask | Where-Object { $_.TaskName -match 'clickfix|encforge|balonx|spyroid|update|sync' -or $_.Actions.Execute -match 'powershell|wscript|mshta|rundll32' } | Select-Object TaskName, State, @{n='Action';e={$_.Actions.Execute}}, @{n='Args';e={$_.Actions.Arguments}} | Format-List
Write-Output '[+] AI or ML artifact staging and suspicious files'
$paths = @($env:TEMP, $env:LOCALAPPDATA, $env:APPDATA, 'C:/ProgramData')
foreach ($p in $paths) { Get-ChildItem $p -Recurse -Force -Include '*.pt','*.pth','*.onnx','*.h5','*.keras','*.safetensors','*.ckpt','*.gguf','*encforge*','*clickfix*','*balonx*','*spyroid*' | Select-Object FullName, Length, LastWriteTime }
Write-Output '[+] Hash check for ENCFORGE samples'
foreach ($p in $paths) { Get-ChildItem $p -Recurse -Force -File | ForEach-Object { $h = Get-FileHash $_.FullName -Algorithm SHA256; if ($hashes -contains $h.Hash) { [PSCustomObject]@{Path=$_.FullName; Hash=$h.Hash; LastWriteTime=$_.LastWriteTime} } } }
Write-Output '[+] Langflow exposure clues'
Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'langflow|uvicorn|fastapi|docker|containerd' -or $_.PathName -match 'langflow|uvicorn|fastapi' } | Select-Object Name, State, StartMode, PathName | Format-List
Response Priorities
Immediate: block the IPv4, domains, hostnames, full panel URLs, and ENCFORGE SHA256 values at EDR, DNS resolver, SWG, email gateway, firewall, and mobile or MDM controls where supported. Isolate hosts showing encoded PowerShell launched from browser or Run-dialog context, any process touching model extensions in bulk, and endpoints resolving Balonx infrastructure. Preserve memory for fileless ClickFix stages, capture PowerShell ScriptBlock and AMSI logs, collect Langflow access logs and container audit events, and export WebSocket sessions tied to banking portals before rotating indicators. Treat Android users with Spyroid symptoms as potentially live session compromise rather than simple credential exposure.
24 hours: because DeerStealer, Vidar, Spyroid, and Balonx are credential and session theft oriented, force password resets for exposed users, revoke refresh tokens and cookies, invalidate banking and SSO sessions, re-enroll MFA where WebSocket hijack or RAT accessibility access is plausible, and review impossible travel, new payees, device enrollment, and token replay. Notify fraud teams for Mexican banking customers and check cryptocurrency payment or beneficiary changes. For AI estates, rotate cloud keys, service principals, model registry tokens, vector database credentials, and CI secrets that Langflow or compromised notebooks could reach; verify whether CVE-2025-3248 was internet reachable and whether container escape reached node credentials.
1 week: harden architecture by removing inbound Langflow exposure or placing it behind authenticated access, patching CVE-2025-3248, enforcing egress deny-by-default for servers and data science workstations, segmenting model storage from general user browsing, restricting PowerShell with Constrained Language Mode and Script Block Logging, blocking pasted Run-dialog execution patterns through user training and application control, requiring phishing-resistant MFA for finance and admin workflows, deploying Android RAT detections for accessibility abuse, and building continuous hunts for server-side polymorphism, Go ransomware behavior, WebSocket session reuse, and model-file encryption staging.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.