ClickFix, JINX-0164 & GHOST STADIUM: Cross-Platform Infostealer & Blockchain C2 Campaigns — OTX Intel

---
title: Suspicious Finger.exe Execution - Potential ClickFix Loader
id: 0e8c4d2b-6a1f-4b3c-8d9e-1f2a3b4c5d6e
description: Detects the execution of finger.exe, which is abused by ClickFix campaigns to retrieve payloads.
status: experimental
date: 2026/05/31
author: Security Arsenal
references:
  - https://otx.alienvault.com/pulse/63456789
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\finger.exe'
  condition: selection
falsepositives:
  - Legitimate administrative use of finger.exe (rare)
level: high
---
title: LofyStealer Node.js Loader Activity
description: Detects Node.js processes spawning child processes typical of LofyStealer loading behavior.
status: experimental
date: 2026/05/31
author: Security Arsenal
references:
  - https://otx.alienvault.com/pulse/63456790
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\node.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate Node.js development scripts
level: medium
---
title: Connection to GHOST STADIUM or Malicious Infrastructure
description: Detects network connections to domains associated with FIFA phishing or ClickFix C2.
status: experimental
date: 2026/05/31
author: Security Arsenal
references:
  - https://otx.alienvault.com/pulse/63456791
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'fifa.gold'
      - 'fifa.black'
      - 'trindastal.com'
      - 'poronto.com'
      - 'veloitall.cfd'
  condition: selection
falsepositives:
  - Unknown
level: critical

// Hunt for ClickFix Finger.exe activity
DeviceProcessEvents  
| where Timestamp > ago(7d)  
| where ProcessCommandLine contains "finger.exe" or FileName == "finger.exe"  
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName  
| extend Tactic = "Execution", Technique = "Command and Scripting Interpreter";

// Hunt for GHOST STADIUM / Malicious Domain Connections
DeviceNetworkEvents  
| where Timestamp > ago(3d)  
| where RemoteUrl has_any ("fifa.gold", "fifa.black", "fifa.tax", "trindastal.com", "driver-updater.net", "veloitall.cfd")  
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName  
| extend Tactic = "Command and Control", Technique = "Application Layer Protocol";

// Hunt for LofyStealer Node.js Parent Processes
DeviceProcessEvents  
| where Timestamp > ago(7d)  
| where InitiatingProcessFileName endswith "node.exe" and FileName in ("cmd.exe", "powershell.exe", "regsvr32.exe")  
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine

# Check for connections to ClickFix C2 Port 688 or Suspicious Domains
$targetDomains = @("trindastal.com", "poronto.com", "fifa.gold", "fifa.black", "driver-updater.net")
$suspiciousConnections = Get-NetTCPConnection | Where-Object { 
    $_.RemotePort -eq 688 -or 
    ($_.RemoteAddress -and (Resolve-DnsName -Name $_.RemoteAddress -ErrorAction SilentlyContinue | Where-Object { $targetDomains -contains $_.NameHost }))
}

if ($suspiciousConnections) {
    Write-Host "[ALERT] Suspicious network connections detected:" -ForegroundColor Red
    $suspiciousConnections | Format-Table -AutoSize
} else {
    Write-Host "No suspicious connections found on standard ports." -ForegroundColor Green
}

# Check for finger.exe processes
$fingerProcess = Get-Process -Name "finger" -ErrorAction SilentlyContinue
if ($fingerProcess) {
    Write-Host "[ALERT] finger.exe process detected (ClickFix Indicator):" -ForegroundColor Red
    $fingerProcess | Select-Object Id, ProcessName, Path, StartTime
} else {
    Write-Host "No finger.exe processes found." -ForegroundColor Green
}