ClickFix RAT Delivery via ChatGPT Custom GPTs & Gentlemen RaaS Insider 'Azazel': OTX Pulse Analysis — Enterprise Detection Pack

---
title: ClickFix Fake CAPTCHA PowerShell Execution (Lumma/Matanbuchus Delivery)
id: 3f9a2c1e-7b44-4d21-9a1c-clickfix001
status: experimental
description: Detects PowerShell execution consistent with ClickFix social-engineering lures delivering infostealers (Lumma, Matanbuchus, SectopRAT) via malicious Custom GPTs and fake Cloudflare CAPTCHA pages.
author: Security Arsenal Threat Intelligence
references:
    - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
date: 2026/10/05
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_encoded:
        CommandLine|contains:
            - ' -enc '
            - ' -ec '
            - 'EncodedCommand'
            - 'FromBase64String'
    selection_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'Invoke-RestMethod'
            - 'iwr '
            - 'irm '
            - 'curl.exe'
            - 'DownloadString'
            - 'Start-BitsTransfer'
    selection_clipboard:
        CommandLine|contains:
            - 'Get-Clipboard'
            - 'Set-Clipboard'
    condition: selection_img and (selection_encoded or (selection_download and selection_clipboard))
falsepositives:
    - Rare legitimate admin automation combining clipboard and download cradles
level: high
tags:
    - attack.t1059.001
    - attack.t1204.002
    - attack.t1105
---
title: Endpoint DNS-over-HTTPS Usage Bypassing Internal Resolver
id: 8d2b4f77-1c93-4e55-b2d2-doh002
status: experimental
description: Detects outbound HTTPS connections to public DNS-over-HTTPS resolvers from endpoints, a C2 concealment technique used by Lumma Stealer and Matanbuchus in the ClickFix campaign.
author: Security Arsenal Threat Intelligence
date: 2026/10/05
logsource:
    category: network_connection
    product: windows
detection:
    selection_doh_dest:
        DestinationHostname|contains:
            - 'dns.google'
            - 'cloudflare-dns.com'
            - 'mozilla.cloudflare-dns.com'
            - 'dns.quad9.net'
            - 'doh.opendns.com'
    selection_doh_ip:
        DestinationIp:
            - '1.1.1.1'
            - '1.0.0.1'
            - '8.8.8.8'
            - '8.8.4.4'
        DestinationPort: 443
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: (selection_doh_dest or selection_doh_ip) and not filter_browsers
falsepositives:
    - Browser DoH configuration (filtered); developer tooling with explicit DoH
level: medium
tags:
    - attack.t1071.001
    - attack.t1572
---
title: GitLab Phishing Infrastructure or CI/CD Secret Access Anomaly (Azazel / Gentlemen)
id: b71c9a03-55e1-4f88-c3a3-gitlab003
status: experimental
description: Detects network connections to GitLab-impersonating infrastructure associated with the Gentlemen ransomware affiliate Azazel and suspicious access to CI/CD secret stores.
author: Security Arsenal Threat Intelligence
references:
    - https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files
date: 2026/10/05
logsource:
    category: network_connection
detection:
    selection_infra:
        DestinationHostname|contains:
            - 'forgitlab.com'
        DestinationIp:
            - '66.179.30.155'
    condition: selection_infra
falsepositives:
    - None expected; forgitlab.com is attacker-controlled lookalike infrastructure
level: critical
tags:
    - attack.t1552.004
    - attack.t1566
    - attack.t1567

// Hunt: ClickFix execution, DoH C2, and GitLab phishing infrastructure — OTX 2026-10-05
let lookback = 14d;
let bad_hashes_sha256 = dynamic([
    "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4",
    "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f",
    "14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335",
    "20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53",
    "278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48",
    "3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621"]);
let bad_hashes_md5 = dynamic(["6ab595ad6554819181b686d4876efb80", "6ab6ba039440819185ed491740b11cf8"]);
// 1) ClickFix-style PowerShell: encoded commands + download/clipboard cradles
let ClickFix = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName in~ ("powershell.exe","pwsh.exe")
| where ProcessCommandLine has_any ("-enc","EncodedCommand","FromBase64String")
   or (ProcessCommandLine has_any ("Invoke-WebRequest","irm ","iwr ","DownloadString","curl.exe")
       and ProcessCommandLine has "Get-Clipboard")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
// 2) Hash matches for known ClickFix payload hashes
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where SHA256 in~ (bad_hashes_sha256) or MD5 in~ (bad_hashes_md5)
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, SHA256, MD5;
// 3) Network: Azazel GitLab phishing infra + suspicious DoH from non-browser processes
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(lookback)
| where RemoteUrl has "forgitlab.com" or RemoteIP == "66.179.30.155"
   or (RemoteUrl has_any ("dns.google","cloudflare-dns.com","mozilla.cloudflare-dns.com")
       and InitiatingProcessFileName !in~ ("chrome.exe","firefox.exe","msedge.exe"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
union ClickFix, HashHits, NetworkHits
| order by TimeGenerated desc

# Security Arsenal - IOC Hunt: ClickFix Infostealer + Azazel/Gentlemen Artifacts
# OTX Pulses 2026-10-05 | Run elevated on Windows endpoints

$report = @()

# --- 1) Hash sweep: known ClickFix / Lumma / Matanbuchus payload hashes ---
$badHashes = @(
    '22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4',
    '0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f',
    '14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335',
    '20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53',
    '278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48',
    '3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621'
)
$searchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads","$env:ProgramData")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($badHashes -contains $h.ToLower()) {
                $report += [PSCustomObject]@{Type='HashMatch'; Path=$_.FullName; Detail=$h}
            }
        }
}

# --- 2) Persistence: Run keys masquerading as browser/system updaters (Lumma/Matanbuchus) ---
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'powershell|mshta|rundll32|AppData|Temp' -and $_.Name -notmatch '^PS'
        } | ForEach-Object {
            $report += [PSCustomObject]@{Type='RunKey'; Path="$rk\$($_.Name)"; Detail=$_.Value}
        }
    }
}

# --- 3) Scheduled tasks staging from user-writable paths ---
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | ForEach-Object { "$($_.Execute) $($_.Arguments)" }
    if (($actions -join ' ') -match 'AppData|Temp|powershell.*-enc|mshta') {
        $report += [PSCustomObject]@{Type='ScheduledTask'; Path=$_.TaskName; Detail=($actions -join '; ')}
    }
}

# --- 4) Network: Azazel GitLab phishing infra + active DoH connections ---
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -eq '66.179.30.155' -or
    ($_.RemotePort -eq 443 -and $_.RemoteAddress -in @('1.1.1.1','1.0.0.1','8.8.8.8','8.8.4.4'))
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{Type='NetConnection'; Path=$proc.Path; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($proc.Name)"}
}

# --- 5) DNS cache check for forgitlab.com ---
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match 'forgitlab\.com' } |
    ForEach-Object { $report += [PSCustomObject]@{Type='DNSCache'; Path=$_.Entry; Detail=$_.Data} }

$report | Format-Table -AutoSize
if ($report) { $report | Export-Csv ".\OTX_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').csv" -NoTypeInformation; Write-Host "[ALERT] $($report.Count) findings exported." -ForegroundColor Red }
else { Write-Host "[CLEAN] No indicators found." -ForegroundColor Green }