ClickFix, GachiLoader, and KYCShadow: Multi-Vector Credential Theft Campaigns - OTX Pulse Analysis

---
title: Potential ClickFix PowerShell MSI Download
id: 5836b1c2-8f2a-45a7-9c1e-5522d4e6f8a9
status: experimental
description: Detects PowerShell commands downloading MSI files, a technique observed in ClickFix campaigns leading to HijackLoader.
references:
    - https://otx.alienvault.com/pulse/64xxxxx (ClickFix Pulse)
author: Security Arsenal Research
date: 2026/04/29
tags:
    - attack.execution
    - attack.t1059.001
    - attack.initial_access
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IWR'
            - 'DownloadFile'
    selection_msi:
        CommandLine|contains: '.msi'
    condition: all of selection_*
falsepositives:
    - Legitimate software installation scripts
level: high
---
title: Suspicious DLL Sideloading via Renamed Binaries
id: 9a2b4c8d-1e3f-4a5b-8e6d-7c9f0a1b2c3d
status: experimental
description: Detects processes loading DLLs from suspicious paths or using renamed binaries typical of HijackLoader and GachiLoader.
references:
    - https://otx.alienvault.com/pulse/64xxxxx (ClickFix PowerShell Pulse)
author: Security Arsenal Research
date: 2026/04/29
tags:
    - attack.defense_evasion
    - attack.t1574.001
    - attack.t1574.002
logsource:
    product: windows
    category: image_load
detection:
    selection:
        Image|endswith:
            - '.exe'
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
        ImageLoaded|endswith:
            - '.dll'
    filter_legit:
        Signed: true
    condition: selection and not filter_legit
falsepositives:
    - Unsigned legitimate software
level: medium
---
title: GlassWorm/GachiLoader Blockchain C2 Connection
id: 7d3e8f1a-2b5c-4d6e-9f0a-1b2c3d4e5f6a
status: experimental
description: Detects outbound connections to known Solana RPC endpoints or high-entropy domains associated with blockchain-based C2.
references:
    - https://otx.alienvault.com/pulse/64xxxxx (GlassWorm Pulse)
    - https://otx.alienvault.com/pulse/64xxxxx (GachiLoader Pulse)
author: Security Arsenal Research
date: 2026/04/29
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    category: network_connection
detection:
    selection_solanaports:
        DestinationPort:
            - 8899
            - 8900
            - 9900
    selection_hostnames:
        DestinationHostname|contains:
            - 'solana'
            - 'rpc'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Web3 or crypto applications
level: low


kql
// Hunt for ClickFix PowerShell activity and C2 connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com", "robinhuds.com", "serv.biz", "serv.xyz", "api.biz")
| extend IOCNature = "ClickFix/GachiLoader Domain"
| union DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains ".msi" and (ProcessCommandLine contains "powershell" or ProcessCommandLine contains "pwsh")
| extend IOCNature = "ClickFix PowerShell MSI Download"
| project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine, RemoteUrl, IOCNature


powershell
# IOC Hunt Script for Lumma/GachiLoader/KYCShadow Artifacts
# Run with administrative privileges

$IOC_Domains = @(
    "ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com",
    "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com",
    "serv.biz", "serv.xyz", "api.biz"
)

$IOC_IPs = @("85.11.161.198")

$IOC_Hashes_SHA256 = @(
    "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc",
    "c529217014b732abbe646046c07ce8f0366a42051839d4cb3be5b400285fc728",
    "818daf975f78ac30ba4ce0fdd2f7eb550cdc16701da35594e8c9cba72bc84a5c",
    "1d261b45e73b5b712becb12ed182ec89d3dd0d73143a2dd8ff5512da489a50eb",
    "34479b18597f1a0deb5d55b8450bc21af1d1f638c4ceca1ee19e6f5ac89d6be2"
)

Write-Host "[+] Checking DNS Cache for malicious domains..."
$DNSEntries = Get-DnsClientCache | Where-Object { $IOC_Domains -contains $_.Entry }
if ($DNSEntries) {
    Write-Host "[!] WARNING: Found cached entries for malicious domains:" -ForegroundColor Red
    $DNSEntries | Format-Table Entry, Data, Type
} else {
    Write-Host "[-] No malicious domains found in DNS cache."
}

Write-Host "[+] Scanning for specific file hashes in common download locations..."
$Paths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA")
foreach ($Path in $Paths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($IOC_Hashes_SHA256 -contains $Hash) {
                Write-Host "[!] CRITICAL: Malicious file found at $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking active network connections for known C2 IPs..."
$TCPConnections = Get-NetTCPConnection -State Established | Where-Object { $IOC_IPs -contains $_.RemoteAddress }
if ($TCPConnections) {
    Write-Host "[!] WARNING: Active connection to malicious IP detected:" -ForegroundColor Red
    $TCPConnections | Format-Table LocalPort, RemoteAddress, RemotePort, OwningProcess
} else {
    Write-Host "[-] No connections to malicious IPs detected."
}