ClickFix, PyPI Supply Chain, and AI Agent Abuse: Multi-Vector Infostealer Campaign — Detection Pack

title: Suspicious PowerShell Encoded Command - ClickFix Pattern
id: 8a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects PowerShell commands often used in ClickFix campaigns involving Base64 decoding or obfuscation to download stealers like Vidar or Lumma.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/04/28
modified: 2026/04/28
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'FromBase64String'
            - 'IEX'
            - 'Invoke-Expression'
            - 'Hidden'
        CommandLine|contains:
            - 'http://'
            - 'https://'
    condition: selection
falsepositives:
    - Administrator scripting
level: high
---
title: Malicious PyPI Package Installation - Xinference Supply Chain
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects installation or import of known compromised versions of the 'xinference' package (2.6.0 - 2.6.2) delivering credential theft payloads.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/04/28
logsource:
    category: process_creation
    product: linux
detection:
    selection_pip:
        Image|endswith:
            - '/python'
            - '/python3'
            - '/pip'
            - '/pip3'
        CommandLine|contains: 'xinference'
        CommandLine|contains:
            - '2.6.0'
            - '2.6.1'
            - '2.6.2'
    selection_import:
        Image|endswith:
            - '/python'
            - '/python3'
        CommandLine|contains: 'import xinference'
    condition: 1 of selection_
falsepositives:
    - Legitimate developer installation of specific versions (unlikely given compromise)
level: critical
---
title: AppleScript Execution via AI IDE - AMOS Stealer
id: 9f8e7d6c-5b4a-3f2e-1d0c-9b8a7f6e5d4c
status: experimental
description: Detects execution of AppleScript potentially linked to AMOS Stealer delivery via AI agents like Cursor, often involving obfuscated loaders.
references:
    - https://otx.alienvault.com/
author: Security Arsenal
date: 2026/04/28
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/osascript'
        ParentImage|contains:
            - 'Cursor'
            - 'cursor'
    condition: selection
falsepositives:
    - Legitimate AI agent automation
level: high


kql
// Hunt for ClickFix and AMOS Stealer Network IOCs
let IOCs = dynamic(["ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", "visitbundala.com", "nhacaired88.com", "subsgod.com", "ariciversontile.com", "mpasvw.com", "arkypc.com", "ucaboodle.com", "someotherbox.com", "your-link.online", "linda-makeup.com", "cibcsecurity2fa.com", "rbcdevice-login.com", "yellowusheart.net"]);
let IPs = dynamic(["45.94.47.204", "92.246.136.14"]);
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs) or RemoteIP in (IPs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend FullURL = strcat(RemoteUrl, RemotePort)


powershell
# Hunt for compromised Xinference versions and suspicious AMOS Stealer processes
Write-Host "Checking for compromised Xinference package versions..."
try {
    $pipList = pip list 2>&1
    if ($pipList -match "xinference") {
        $versionLine = $pipList -match "xinference"
        if ($versionLine -match "2\.6\.[0-2]") {
            Write-Host "[CRITICAL] Compromised version of Xinference detected: $versionLine" -ForegroundColor Red
        } else {
            Write-Host "Xinference installed, but version is not in the compromised range (2.6.0-2.6.2)." -ForegroundColor Green
        }
    } else {
        Write-Host "Xinference not found." -ForegroundColor Green
    }
} catch {
    Write-Host "Error checking pip list. Ensure Python/pip is in PATH."
}

Write-Host "\nChecking for suspicious processes related to AMOS Stealer (osascript from Cursor)..."
$procs = Get-Process -ErrorAction SilentlyContinue | Where-Object { $_.ProcessName -eq "osascript" }
if ($procs) {
    foreach ($proc in $procs) {
        try {
            $parent = Get-CimInstance -ClassName Win32_Process -Filter "ProcessId = $($proc.Parent.Id)"
            if ($parent.Name -like "*Cursor*" -or $parent.Name -like "*cursor*") {
                Write-Host "[ALERT] Suspicious osascript execution detected under Cursor process PID $($parent.ProcessId)." -ForegroundColor Red
            }
        } catch {
            # Access denied or process exited
        }
    }
}