ClickFix, LofyStealer, and JINX-0164: Multi-Vector Campaigns Targeting Developers and Gamers — OTX Intelligence Briefing

---
title: Potential ClickFix Activity via Finger.exe
id: 4e3b1c8f-9a2d-4b5c-8e1d-2f3a4b5c6d7e
status: experimental
description: Detects the execution of finger.exe, which is abused by the ClickFix campaign to fetch payloads via clipboard hijacking. Legacy utility usage is rare in modern environments.
references:
    - https://www.huntress.com/blog/clickfix-castleloader-backgroundfix
author: Security Arsenal
date: 2026/06/03
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\finger.exe'
        CommandLine|contains:
            - 'http'
    condition: selection
falsepositives:
    - Legitimate use of finger utility (rare)
level: high
---
title: Potential JINX-0164 macOS Payload Deployment
id: 5f4c2d9e-0b3e-5c6d-9f2e-3g4b5c6d7e8f
status: experimental
description: Detects macOS processes downloading shell scripts associated with JINX-0164 AUDIOFIX/MINIRAT campaigns targeting crypto firms.
references:
    - https://www.wiz.io/blog/threat-actors-target-crypto-orgs
author: Security Arsenal
date: 2026/06/03
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: process_creation
    product: macos
detection:
    selection_img:
        Image|endswith:
            - '/curl'
            - '/wget'
    selection_cli:
        CommandLine|contains:
            - 'install.sh'
            - 'driver-updater.net'
            - 'live.ong'
    condition: all of selection_*
falsepositives:
    - Legitimate software updates
level: high
---
title: Suspicious Node.js Loader Activity (LofyStealer)
id: 6g5d3e0f-1c4f-6d7e-0f3g-4h5c6d7e8f9g
status: experimental
description: Detects Node.js processes exhibiting behavior consistent with the LofyStealer loader, such as spawning child processes or hiding within legitimate library paths.
references:
    - https://zenox.ai/en/lofystealer-malware-mirando-jogadores-de-minecraft
author: Security Arsenal
date: 2026/06/03
tags:
    - attack.defense_evasion
    - attack.t1055.012
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\node.exe'
        ParentImage|endswith:
            - '\node.exe'
        CommandLine|contains:
            - '.js'
    condition: selection
falsepositives:
    - Legitimate Node.js development workflows
level: medium


kql
// Hunt for ClickFix finger.exe execution and JINX-0164 Network Indicators
// Union of process creation and network events
DeviceProcessEvents
| where FileName =~ "finger.exe" 
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| union (
    DeviceNetworkEvents
    | where RemoteUrl has_any ("driver-updater.net", "live.ong", "trindastal.com", "poronto.com", "brionter.com", "teamicrosoft.com", "live.us.org")
    | project Timestamp, DeviceName, RemoteUrl, RemotePort, RemoteIP, InitiatingProcessAccountName
)
| union (
    DeviceNetworkEvents
    | where RemotePort == 688 // Specific to ClickFix C2
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP
)


powershell
# IOC Hunt Script for ClickFix and LofyStealer Payloads
# Checks for running finger.exe processes and scans for specific file hashes

$ClickFixHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb"
)

$LofyHashes = @(
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7"
)

# Check for finger.exe process
$fingerProc = Get-Process -Name finger -ErrorAction SilentlyContinue
if ($fingerProc) {
    Write-Host "[ALERT] finger.exe process detected (Potential ClickFix Activity) - PID: $($fingerProc.Id)" -ForegroundColor Red
}

# Scan common directories for malware hashes
$pathsToScan = @("$env:TEMP", "$env:APPDATA", "C:\Users\Public", "C:\Windows\Temp")

foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($fileHash -in $ClickFixHashes) {
                Write-Host "[ALERT] ClickFix Payload found: $($_.FullName)" -ForegroundColor Red
            }
            if ($fileHash -in $LofyHashes) {
                Write-Host "[ALERT] LofyStealer Payload found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}