ClickFix, PyPI Poisoning, & AI Abuse: Coordinated Infostealer Surge — OTX Pulse Analysis

---
title: Potential ClickFix Social Engineering Activity
id: 89d9f8a2-7b4c-4f2d-9e1a-1c3b5a6b7c8d
description: Detects suspicious command line arguments often used in ClickFix campaigns where users are tricked into running fixes via PowerShell or CMD copied from browser popups.
status: experimental
date: 2026/04/28
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
    CommandLine|contains:
      - 'copy'
      - 'paste'
      - 'clipboard'
      - 'regsvr32'
      - 'msiexec'
  condition: selection
falsepositives:
  - Legitimate IT support scripts
level: high
tags:
  - attack.initial_access
  - attack.execution
  - attack.user_execution
---
title: PyPI Package Supply Chain Compromise via Base64
id: 71c2e9b3-8c5d-4e3a-0f2b-2d4e6f8a9b1c
description: Detects Python processes decoding Base64 strings, a technique used in the Xinference supply chain attack to hide malicious payloads.
status: experimental
date: 2026/04/28
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: '\python.exe'
  selection_cli:
    CommandLine|contains: 'base64'
  selection_module:
    CommandLine|contains:
      - 'base64.b64decode'
      - '-d'
  condition: all of selection_*
falsepositives:
  - Legitimate software installations
level: medium
tags:
  - attack.initial_access
  - attack.supply_chain
---
title: AMOS Stealer Delivery via Cursor AI Agent
id: 62b1d8c4-7d6e-5f4b-1a3c-3e5f7g9h0i1j
description: Detects suspicious child processes spawned by the Cursor AI IDE (or similar dev tools) initiating scripts or downloads, indicative of AMOS Stealer activity.
status: experimental
date: 2026/04/28
author: Security Arsenal
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|contains: 'Cursor'
  selection_child:
    Image|endswith:
      - '/osascript'
      - '/bash'
      - '/sh'
      - '/curl'
  selection_cli:
    CommandLine|contains:
      - 'download'
      - 'http'
  condition: all of selection_*
falsepositives:
  - Legitimate developer build scripts
level: high
tags:
  - attack.initial_access
  - attack.execution
  - attack.t1204

// Hunt for ClickFix and AMOS Network IOCs
let IoC_Domains = dynamic(["ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com", "mpasvw.com", "arkypc.com", "ucaboodle.com", "someotherbox.com", "your-link.online", "linda-makeup.com", "cibcsecurity2fa.com", "rbcdevice-login.com", "yellowusheart.net"]);
let IoC_IPs = dynamic(["45.94.47.204", "92.246.136.14"]);
DeviceNetworkEvents
| where RemoteUrl in (IoC_Domains) or RemoteIP in (IoC_IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend AlertMessage = "OTX Pulse Indicator Match"

<#
.SYNOPSIS
    IOC Hunt for April 2026 OTX Pulses (PyPI & AMOS)
.DESCRIPTION
    Scans the file system for known malicious file hashes associated with Xinference and AMOS Stealer.
#>

$TargetHashes = @(
    "3ee893ae46530b92e0d26435fb979d82", "484067fd6232f7cdd7b664b33857fc2c",
    "971670c10eff28339a085ca50a600e35", "9b3257e45b27a6bbe4e240e41a3a306f",
    "c6ce4e25f7fe3e3bb1eea2e9052483bf", "e291734d46c313a23d676681499f8846",
    "312147c0ae0d555a4d50fa627ff7d4f3", "c54620dd3745fdeaff5ccc0db4132f11"
)

Write-Host "Starting IOC Scan... Please wait." -ForegroundColor Cyan

# Search C:\ for files matching the hashes (Note: This may take time)
$Matches = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { -not $_.PSIsContainer } | 
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($Hash -in $TargetHashes) {
            $_
        }
    }

if ($Matches) {
    Write-Host "[ALERT] Malicious files found:" -ForegroundColor Red
    $Matches | Select-Object FullName, Length, LastWriteTime
} else {
    Write-Host "No matching files found." -ForegroundColor Green
}

# Check Hosts File for ClickFix/Keitaro domains
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$SuspiciousHosts = @("ustazazharidrus.com", "arkypc.com")

$HostsContent = Get-Content $HostsPath
foreach ($HostEntry in $SuspiciousHosts) {
    if ($HostsContent -match $HostEntry) {
        Write-Host "[ALERT] Suspicious entry found in hosts file: $HostEntry" -ForegroundColor Red
    }
}