ClickFix, GlassWorm & KICS Supply Chain Attacks: OTX Pulse Analysis — Multi-Vector Infostealer Campaigns

title: Potential ClickFix PowerShell Execution Pattern
id: c0a1b2c3-4d5e-6f78-90ab-cdef01234567
description: Detects suspicious PowerShell execution often associated with ClickFix campaigns where users are tricked into running repair commands.
status: experimental
date: 2026/04/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000000
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'copy-item'
            - 'invoke-expression'
            - 'iex'
        CommandLine|contains|all:
            - 'error'
            - 'fix'
            - 'support'
    condition: selection
falsepositives:
    - Legitimate system administration scripts
level: high
tags:
    - attack.execution
    - attack.t1059.001
    - attack.initial_access
    - attack.t1566.001
---
title: Malicious KICS Binary or VS Code Extension Execution
id: d1e2f3a4-5b6c-7d8e-9f01-234567890abc
description: Detects execution of known malicious file hashes associated with the Checkmarx KICS supply chain compromise.
status: experimental
date: 2026/04/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000002
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains:
            - '\kics'
            - '\mcpAddon.js'
    filter_hashes:
        Hashes|contains:
            - 'MD5=d47de3772f2d61a043e7047431ef4cf4'
            - 'SHA1=250f3633529457477a9f8fd3db3472e94383606a'
            - 'SHA256=222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b'
    condition: selection and filter_hashes
falsepositives:
    - Legitimate use of KICS scanner (verify hash)
level: critical
tags:
    - attack.initial_access
    - attack.t1195.002
    - attack.supply_chain
---
title: Trigona Custom Exfiltration Tool Execution
id: e2f3a4b5-c6d7-8e9f-0123-456789abcdef
description: Detects the execution of Trigona affiliate custom uploader client and associated kernel driver abuse tools.
status: experimental
date: 2026/04/26
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/660000000004
logsource:
    product: windows
    category: process_creation
detection:
    selection_uploader:
        OriginalFileName|endswith: 'uploader_client.exe'
    selection_tools:
        Image|endswith:
            - '\WKTools.exe'
            - '\DumpGuard.exe'
    condition: 1 of selection_*
falsepositives:
    - Rare, unless used by admin for driver management
level: high
tags:
    - attack.exfiltration
    - attack.t1041
    - attack.defense_evasion
    - attack.t1562.001


kql
// Hunt for ClickFix and Keitaro related domain connections
let MaliciousDomains = dynamic(["ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com", "ucaboodle.com", "someotherbox.com", "your-link.online", "linda-makeup.com", "cibcsecurity2fa.com", "rbcdevice-login.com"]);
DeviceNetworkEvents
| where RemoteUrl in (MaliciousDomains) or RemoteDomain in (MaliciousDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType
| summarize count() by DeviceName, RemoteUrl, bin(Timestamp, 1h)
| order by count_ desc;


powershell
# PowerShell Hunt Script for Trigona and GlassWorm Artifacts
# Checks for specific file hashes and suspicious browser extensions

$maliciousHashes = @(
    "d47de3772f2d61a043e7047431ef4cf4",
    "e1023db24a29ab0229d99764e2c8deba",
    "222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b",
    "e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173",
    "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019"
)

Write-Host "Scanning for malicious file hashes..."

# Check common download and temp directories
$paths = @("C:\Users\*\Downloads\", "C:\Windows\Temp\", "C:\ProgramData\")

foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash.ToLower()
            if ($maliciousHashes -contains $hash) {
                Write-Host "[ALERT] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# Check for suspicious browser extensions (GlassWorm indicator pattern)
$chromeExtensions = "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
$edgeExtensions = "$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Extensions"

Write-Host "Checking for suspicious browser extensions..."
foreach ($extPath in @($chromeExtensions, $edgeExtensions)) {
    if (Test-Path $extPath) {
        # Look for recently modified extensions in the last 7 days
        Get-ChildItem -Path $extPath -Directory | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | ForEach-Object {
            Write-Host "[INFO] Recently modified extension found: $($_.Name) in $extPath" -ForegroundColor Yellow
        }
    }
}