---
title: Potential ClickFix BackgroundFix Activity via Finger.exe
id: 20260604-001
description: Detects the execution of finger.exe, a legacy tool abused in ClickFix campaigns to retrieve malicious payloads via clipboard hijacking commands.
status: experimental
author: Security Arsenal
date: 2026/06/04
tags:
    - attack.command_and_control
    - attack.t1105
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    condition: selection
falsepositives:
    - Legitimate use of finger utility (rare in modern environments)
level: high
---
title: Suspicious Node.js Loader Spawning Shell (LofyStealer)
id: 20260604-002
description: Detects Node.js processes spawning cmd.exe or powershell.exe, indicative of the LofyStealer Node.js loader activating a C++ payload.
status: experimental
author: Security Arsenal
date: 2026/06/04
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\node.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection
falsepositives:
    - Legitimate development scripts
level: medium
---
title: macOS Suspicious Remote Installation Script (JINX-0164)
id: 20260604-003
description: Detects execution of remote installation scripts (install.sh) via curl or wget, associated with JINX-0164 supply chain attacks targeting crypto developers.
status: experimental
author: Security Arsenal
date: 2026/06/04
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith:
            - '/curl'
            - '/wget'
        CommandLine|contains: 'install.sh'
    condition: selection
falsepositives:
    - Legitimate software installation
level: high


kql
// Hunt for ClickFix finger.exe activity and C2 connections
let ClickFixDomains = dynamic(["trindastal.com", "poronto.com", "brionter.com", "giovettiadv.com"]);
let JINXDomains = dynamic(["driver-updater.net", "login.teamicrosoft.com", "live.ong", "teams.live.us.org"]);
// 1. Process Hunt
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName =~ "finger.exe" or ProcessVersionInfoOriginalFileName =~ "finger.exe"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| union ( 
    DeviceProcessEvents  
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ "node.exe" and FileName in (~"cmd.exe", ~"powershell.exe")
    | project Timestamp, DeviceName, AccountName, "ProcessType" = "NodeSpawningShell"
);
// 2. Network Hunt
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (ClickFixDomains) or RemoteUrl has_any (JINXDomains)
| project Timestamp, DeviceName, ActionType, RemoteUrl, RemotePort, RemoteIP


powershell
# IOC Hunt Script for ClickFix, LofyStealer, and JINX-0164 Payloads
# Requires Admin Privileges

$MaliciousHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92", # CastleLoader
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9", # NetSupport/Related
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881", # LofyStealer
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7", # LofyStealer
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"  # JINX-0164
)

Write-Host "[*] Scanning for known malicious file hashes (This may take time)..." -ForegroundColor Cyan

$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $Drives) {
    Write-Host "Scanning $Drive..."
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue -Force | 
    Where-Object { $_.PSIsContainer -eq $false } | 
    ForEach-Object {
        $FilePath = $_.FullName
        try {
            $FileHash = (Get-FileHash -Path $FilePath -Algorithm SHA256 -ErrorAction Stop).Hash
            if ($MaliciousHashes -contains $FileHash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $FilePath (Hash: $FileHash)" -ForegroundColor Red
            }
        } catch {
            # Ignore access errors
        }
    }
}

Write-Host "[*] Checking for NetSupport RAT persistence in Registry..." -ForegroundColor Cyan
$Paths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
)

$Paths | ForEach-Object {
    if (Test-Path $_) {
        Get-ItemProperty -Path $_ -ErrorAction SilentlyContinue | 
        Where-Object { $_.PSObject.Properties.Value -match "client32" -or $_.PSObject.Properties.Name -match "NetSupport" } | 
        ForEach-Object {
            Write-Host "[!] Suspicious Persistence found in $_" -ForegroundColor Yellow
            $_ | Format-List
        }
    }
}


# Response Priorities

**Immediate (0-24h):**
1.  **Block IOCs:** immediately block the listed domains (`poronto.com`, `driver-updater.net`, etc.) and file hashes on perimeter gateways and EDRs.
2.  **Hunt for `finger.exe`:** Search historical logs for the execution of `finger.exe`. Any instance outside of specific legacy environments should be treated as a compromised host.
3.  ** quarantine hosts:** Isolate devices that have communicated with the non-standard port 688 associated with ClickFix.

**24h:**
1.  **Credential Reset:** If LofyStealer or CastleStealer is suspected, force a password reset for affected users and invalidate session tokens (especially for Minecraft-related accounts if personal devices are BYOD, and crypto wallets for JINX-0164 targets).
2.  **Supply Chain Audit:** For technology and crypto sectors, audit `package.` files and recent npm package installs for references to typosquatted domains or unexpected dependencies.

**1 Week:**
1.  **Application Whitelisting:** Restrict the use of `finger.exe` and unsigned Node.js executators for non-developer endpoints.
2.  **Awareness Training:** Update security awareness training to specifically highlight "clipboard hijacking" (ClickFix) and LinkedIn recruitment scams (JINX-0164).
3.  **macOS Hardening:** Review and enforce strict controls on Gatekeeper and execution of unsigned scripts for developer workstations.