ClickFix, LofyStealer & JINX-0164: Multi-Vector Credential Theft Campaign Analysis — OTX Pulse Intelligence Pack

---
title: Suspicious finger.exe Execution with Clipboard Content - ClickFix Detection
id: 8f4a2b1c-3d5e-4f7a-9a1b-2c3d4e5f6a7b
status: experimental
description: Detects ClickFix campaign using finger.exe with clipboard content as observed in BackgroundFix malware distribution
references:
    - https://www.huntress.com/blog/clickfix-castleloader-backgroundfix
author: Security Arsenal
date: 2026/05/30
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
        CommandLine|contains: 'clip'
    condition: selection
falsepositives:
    - Legitimate use of finger.exe (rare)
level: high
---
title: Node.js Loader with Large Memory Footprint - LofyStealer Detection
id: 7e3d1a2b-4c6e-5f8a-9b2c-1d3e4f5a6b7c
status: experimental
description: Detects LofyStealer Node.js loader component with characteristic large file size and suspicious parameters
references:
    - https://zenox.ai/en/lofystealer-malware-mirando-jogadores-de-minecraft
author: Security Arsenal
date: 2026/05/29
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains:
            - '--loader'
            - '--experimental-modules'
    filter:
        ParentImage|contains:
            - '\npm\'
            - '\yarn\'
            - '\nodejs\'
    condition: selection and not filter
falsepositives:
    - Legitimate Node.js development
level: medium
---
title: Suspicious HTTP Connection to Blockchain Testnet - ClearFake C2 Detection
id: 6d2c0a1b-3b5d-4e7a-8a1c-0b1c2d3e4f5a
status: experimental
description: Detects connections to BNB Smart Chain testnet endpoints used by ClearFake for C2 via smart contracts
references:
    - https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html
author: Security Arsenal
date: 2026/05/27
tags:
    - attack.command_and_control
    - attack.c2
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 80
            - 443
        DestinationHostname|contains:
            - '.cfd'
            - '.lat'
            - '.in.net'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate connections to similar TLDs
level: medium


kql
// Hunt for ClickFix C2 connections on port 688
DeviceNetworkEvents
| where RemotePort == 688
| where ActionType in ("ConnectionAllowed", "ConnectionSuccess")
| where RemoteUrl has_any ("poronto.com", "giovettiadv.com", "brionter.com", "trindastal.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
| extend IoCType = "ClickFix_C2_Port688"


powershell
<#
    Security Arsenal - IOC Hunt Script
    Scans for indicators from ClickFix, LofyStealer, JINX-0164, GHOST STADIUM, and ClearFake campaigns
    Date: 2026-05-30
#>

param(
    [switch]$Verbose,
    [string]$OutputPath = "$env:TEMP\IOC_Hunt_$(Get-Date -Format 'yyyyMMdd').csv"
)

# IoCs from OTX Pulses
$IOC_Hashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7",
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"
)

$IOC_Domains = @(
    "trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com",
    "driver-updater.net", "live.ong", "teamicrosoft.com", "teams.live.us.org",
    "fifa.gold", "fifa.black", "fifa.tax", "fifaweb.com", "fifa.red", "fifa.fund", "fifa-com.shop",
    "afraid.veloitall.cfd", "root-cul.xamir3on.lat", "ohn.stainedunstitch.work",
    "getcfgs.qen9varol.lat", "ootid.srv-auth-dlt-msh.in.net"
)

$IOC_IPs = @("148.178.22.16", "89.36.224.5")

$results = @()

# Function to calculate file hash
function Get-FileHashCustom {
    param([string]$Path)
    try {
        $hash = Get-FileHash -Path $Path -Algorithm SHA256 -ErrorAction Stop
        return $hash.Hash.ToLower()
    } catch {
        return $null
    }
}

# Scan file system for IoC hashes
if ($Verbose) { Write-Host "Scanning for malicious file hashes..." }

$commonPaths = @(
    "$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop", "$env:TEMP",
    "$env:APPDATA", "$env:LOCALAPPDATA", "C:\ProgramData"
)

foreach ($path in $commonPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $fileHash = Get-FileHashCustom -Path $_.FullName
            if ($fileHash -and $IOC_Hashes -contains $fileHash) {
                $results += [PSCustomObject]@{
                    Timestamp = Get-Date
                    IoCType = "FileHash"
                    IoCValue = $fileHash
                    FilePath = $_.FullName
                    Severity = "Critical"
                    Campaign = "OTX_Pulse_Collection"
                }
            }
        }
    }
}

# Check DNS cache for malicious domains
if ($Verbose) { Write-Host "Checking DNS cache for malicious domains..." }

try {
    $dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
    if ($dnsCache) {
        foreach ($entry in $dnsCache) {
            foreach ($domain in $IOC_Domains) {
                if ($entry.Name -like "*$domain*") {
                    $results += [PSCustomObject]@{
                        Timestamp = Get-Date
                        IoCType = "DNS_Cache"
                        IoCValue = $entry.Name
                        Data = $entry.Data
                        Severity = "High"
                        Campaign = "OTX_Pulse_Collection"
                    }
                }
            }
        }
    }
} catch {
    if ($Verbose) { Write-Host "Could not access DNS cache: $_" }
}

# Check hosts file for malicious domains
if ($Verbose) { Write-Host "Checking hosts file for malicious domains..." }

$hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($line in $hostsContent) {
        if ($line -notmatch "^#" -and $line -match "\S+") {
            foreach ($domain in $IOC_Domains) {
                if ($line -match $domain) {
                    $results += [PSCustomObject]@{
                        Timestamp = Get-Date
                        IoCType = "Hosts_File"
                        IoCValue = $line.Trim()
                        FilePath = $hostsPath
                        Severity = "High"
                        Campaign = "OTX_Pulse_Collection"
                    }
                }
            }
        }
    }
}

# Check for suspicious network connections
if ($Verbose) { Write-Host "Checking active network connections..." }

$activeConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($conn in $activeConnections) {
    $remoteIP = $conn.RemoteAddress
    if ($IOC_IPs -contains $remoteIP) {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        $results += [PSCustomObject]@{
            Timestamp = Get-Date
            IoCType = "Network_Connection"
            IoCValue = $remoteIP
            LocalPort = $conn.LocalPort
            RemotePort = $conn.RemotePort
            ProcessName = if ($process) { $process.ProcessName } else { "Unknown" }
            ProcessId = $conn.OwningProcess
            Severity = "Critical"
            Campaign = "OTX_Pulse_Collection"
        }
    }
}

# Check for ClickFix persistence (BackgroundFix references)
if ($Verbose) { Write-Host "Checking for ClickFix-related artifacts..." }

$clickFixPaths = @(
    "$env:USERPROFILE\*\BackgroundFix*",
    "$env:APPDATA\*\BackgroundFix*",
    "$env:TEMP\*\BackgroundFix*"
)

foreach ($path in $clickFixPaths) {
    $files = Get-ChildItem -Path $path -ErrorAction SilentlyContinue
    if ($files) {
        foreach ($file in $files) {
            $results += [PSCustomObject]@{
                Timestamp = Get-Date
                IoCType = "Suspicious_File"
                IoCValue = $file.FullName
                FilePath = $file.FullName
                Severity = "High"
                Campaign = "ClickFix_BackgroundFix"
            }
        }
    }
}

# Output results
if ($results.Count -gt 0) {
    $results | Export-Csv -Path $OutputPath -NoTypeInformation
    Write-Host "Found $($results.Count) IoC matches. Results saved to: $OutputPath" -ForegroundColor Yellow
    $results | Format-Table -AutoSize
} else {
    Write-Host "No IoCs found on this system." -ForegroundColor Green
}