ClickFix, LofyStealer & JINX-0164: Multi-Vector Infostealer & Supply Chain Assault — OTX Pulse Analysis

---
title: Potential ClickFix BackgroundFix Activity
id: a4b2c1d3-5566-7788-99aa-bbccddeeff00
description: Detects the execution of finger.exe invoked via command line or clipboard manipulation, a tactic used by ClickFix campaigns to retrieve payloads.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667d2a3f55b8f6e3b2c1d3e4
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    condition: selection
falsepositives:
    - Legitimate administrative use of finger.exe (rare)
level: high
---
title: Suspicious Node.js Child Process (LofyStealer)
id: b5c3d2e4-6677-8899-00bb-ccddeeff0011
description: Detects Node.js spawning PowerShell or cmd.exe, indicative of the LofyStealer Node.js loader executing subsequent payloads.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667d2a3f55b8f6e3b2c1d3e5
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    parent:
        Image|endswith: '\node.exe'
    child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    condition: parent and child
falsepositives:
    - Legitimate developer build scripts
level: medium
---
title: NPM Supply Chain Preinstall Hook Execution
id: c6d4e3f5-7788-9900-11cc-ddeeff001122
description: Detects the execution of shell commands or scripts during the npm install preinstall phase, indicative of supply chain attacks like Shai-Hulud.
status: experimental
date: 2026/06/03
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667d2a3f55b8f6e3b2c1d3e6
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/node'
        CommandLine|contains:
            - 'preinstall'
            - 'install.sh'
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/node'
    condition: selection
falsepositives:
    - Legitimate package installation scripts
level: high


kql
// Hunt for network connections to known C2 domains and suspicious ports
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com", "securehubcloud.com", "driver-updater.net", "live.ong")
    or RemotePort in (688, 8080, 4443)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort, RemoteIP
| extend IoCType = iif(RemoteUrl has_any ("trindastal.com", "poronto.com"), "ClickFix C2", iif(RemoteUrl has "securehubcloud", "Kali365 Panel", "Suspicious Domain"))


powershell
# IOC Hunt Script for ClickFix and LofyStealer Hashes
$targetHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7",
    "0dc06ecdaa63fe24859cfd955053c23245c536e4733480239d14bebf12688e35",
    "21b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4"
)

Write-Host "[+] Scanning for malicious file hashes..."

$drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($hash in $targetHashes) {
    foreach ($drive in $drives) {
        Write-Host "[INFO] Checking drive $drive for hash $hash"
        Get-ChildItem -Path $drive -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object { $_.Hash -eq $hash } | ForEach-Object {
            Write-Host "[ALERT] Malicious file found: $($_.Path)" -ForegroundColor Red
        }
    }
}

# Check for finger.exe execution logs via PowerShell Script Block Logging
Write-Host "[+] Checking Script Block Logs for finger.exe invocation..."
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational -MaxEvents 1000 -ErrorAction SilentlyContinue | Where-Object { $_.Message -match 'finger.exe' } | Select-Object TimeCreated, Message | Format-List