ClickFix, GlassWorm & EtherRAT: Cross-Platform Stealers and Blockchain C2 Tactics — OTX Analysis

title: Potential ClickFix PowerShell Execution Pattern
id: 4e2b3a0c-7b5c-4d9e-8c1f-1a2b3c4d5e6f
description: Detects PowerShell commands often used in ClickFix campaigns where users are coerced into pasting commands, specifically looking for base64 or obfuscation common in these payloads.
status: experimental
date: 2026/04/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6600000000000000
tags:
    - attack.execution
    - attack.t1059.001
    - detection.emerging_threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'CopyTo-Clipboard'
            - 'iex'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high

---
title: EtherRAT or GlassWorm Node.js Backdoor Activity
id: 5f3c4b1d-8c6e-5f0a-9d2e-2b3c4d5e6f7a
description: Detects Node.js processes initiating network connections, suspicious for EtherRAT (Node.js backdoor) or GlassWorm activity on endpoints where Node.js is not a standard user application.
status: experimental
date: 2026/04/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6600000000000001
tags:
    - attack.command_and_control
    - attack.t1071.001
    - detection.emerging_threats
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        Initiated: 'true'
    filter_legit_dev:
        User|contains:
            - 'Administrator'
            - 'SYSTEM'
    condition: selection and not filter_legit_dev
falsepositives:
    - Developers running legitimate node servers
level: medium

---
title: Suspicious Browser Extension Modification (GlassWorm)
id: 6a4d5c2e-9f7f-6a1b-0e3f-3c4d5e6f7a8b
description: Detects modifications to browser extension directories or registry keys indicative of GlassWorm installing a fake surveillance extension.
status: experimental
date: 2026/04/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6600000000000002
tags:
    - attack.persistence
    - attack.t1547.001
    - detection.emerging_threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\Software\Google\Chrome\Extensions'
            - '\Software\Microsoft\Edge\Extensions'
            - '\Software\Mozilla\Firefox\Extensions'
        Details|contains: 'update_url'
    filter:
        Details|contains: 'https://clients2.google.com/service'
    condition: selection and not filter
falsepositives:
    - Legitimate software installing extensions
level: high

// Hunt for ClickFix and EtherRAT Network Indicators
let IoCDomains = dynamic(['ustazazharidrus.com', 'account-help.info', 'quiptly.com', 'elive123go.com', 'visitbundala.com', 'nhacaired88.com', 'subsgod.com', 'ariciversontile.com', 'o-parana.com', 'rpc.payload.de', 'jariosos.com', 'hayesmed.com', 'regancontrols.com', 'salinasrent.com', 'justtalken.com', 'mebeliotmasiv.com']);
DeviceNetworkEvents
| where RemoteUrl has_any (IoCDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')

# IOC Hunter for ClickFix and EtherRAT
$MaliciousDomains = @(
    'ustazazharidrus.com', 'account-help.info', 'quiptly.com', 'elive123go.com',
    'visitbundala.com', 'nhacaired88.com', 'subsgod.com', 'ariciversontile.com',
    'o-parana.com', 'rpc.payload.de', 'jariosos.com', 'hayesmed.com',
    'regancontrols.com', 'salinasrent.com', 'justtalken.com', 'mebeliotmasiv.com'
)

Write-Host "[+] Checking Active Network Connections for Malicious Domains..."

# Get TCP connections (requires Admin privileges)
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($conn in $connections) {
    try {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        $remoteAddress = $conn.RemoteAddress
        
        # Resolve IP to Hostname to check against IOC list
        $hostEntry = [System.Net.Dns]::GetHostEntry($remoteAddress)
        $hostname = $hostEntry.HostName

        if ($MaliciousDomains -contains $hostname) {
            Write-Host "[!] THREAT DETECTED: Connection to $hostname ($remoteAddress)" -ForegroundColor Red
            Write-Host "    - Process: $($process.ProcessName) (PID: $($conn.OwningProcess))"
            Write-Host "    - Path: $($process.Path)"
        }
    } catch {
        # Ignore resolution errors or access denied
    }
}

Write-Host "[+] Checking for suspicious Node.js processes..."
$nodeProcs = Get-Process -Name node -ErrorAction SilentlyContinue
if ($nodeProcs) {
    foreach ($proc in $nodeProcs) {
        # Check if Node is running from a non-standard user profile path (suspicious for malware)
        if ($proc.Path -notlike "*Program Files*" -and $proc.Path -notlike "*AppData*\Roaming*npm*") {
             Write-Host "[!] SUSPICIOUS NODE PROCESS: $($proc.Path)" -ForegroundColor Yellow
        }
    }
}
Write-Host "[+] Hunt complete."