ClickFix, Remus, and CloudZ: Multi-Vector Credential Theft Campaigns — OTX Pulse Analysis

title: Suspicious Finger.exe Network Connection (ClickFix)
id: 4b2d8f1a-9c3e-4f1d-8b2a-1c3d4e5f6a7b
description: Detects ClickFix activity where finger.exe is used to retrieve payloads from the internet.
status: experimental
date: 2026/05/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/665555555555
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
        Initiated: 'true'
    condition: selection
falsepositives:
    - Legitimate use of finger client (rare in modern environments)
level: critical
---
title: PowerShell Downloading MSI File (OpenClaw/Remcos Vector)
id: 5c3e9g2h-0d4e-5g2h-9c3b-2d4e5f6g7h8i
description: Detects PowerShell commands downloading MSI packages, a technique used in the OpenClaw/Remcos campaign.
status: experimental
date: 2026/05/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/666666666666
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_cmd:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'wget'
            - 'curl'
            - 'DownloadFile'
    selection_ext:
        CommandLine|contains: '.msi'
    condition: all of selection_*
falsepositives:
    - Software installation scripts
level: high
---
title: Potential Stealer Accessing Browser Credential Files
definition: TH-2026-05-07-001
description: Detects processes accessing browser credential files (Local State, Login Data), indicative of stealer activity like Remus or CastleStealer.
status: experimental
date: 2026/05/07
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/667777777777
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Local State'
            - '\Google\Chrome\User Data\Default\Login Data'
            - '\Microsoft\Edge\User Data\Local State'
            - '\Microsoft\Edge\User Data\Default\Login Data'
    filter:
        Image|contains:
            - '\chrome.exe'
            - '\msedge.exe'
    condition: selection and not filter
falsepositives:
    - Browser updates or backup software
level: high

// Hunt for ClickFix network activity and associated IOCs
let IOCs = dynamic(["38.146.28.30", "185.196.10.136", "217.156.122.57", "217.156.122.75", "217.156.122.12", "trindastal.com", "dropras.xyz", "trackpipe.dev"]);
DeviceNetworkEvents
| where RemoteIP in (IOCs) or RemoteUrl has_any (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| union (
    DeviceProcessEvents
    | where InitiatingProcessFileName =~ "finger.exe" or ProcessVersionInfoOriginalFileName =~ "finger.exe"
    | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
)
| sort by Timestamp desc

# Check for connections to known malicious IPs from OTX Pulses
$MaliciousIPs = @("38.146.28.30","185.196.10.136","217.156.122.57","217.156.122.75","217.156.122.12","45.151.106.110")
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

Foreach ($IP in $MaliciousIPs) {
    $Match = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    If ($Match) {
        $Process = Get-Process -Id $Match.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[ALERT] Connection to malicious IP $IP found by PID $($Match.OwningProcess) - Process: $($Process.ProcessName)" -ForegroundColor Red
    }
}

# Check for finger.exe process anomalies
$FingerProc = Get-Process -Name finger -ErrorAction SilentlyContinue
If ($FingerProc) {
    Write-Host "[ALERT] finger.exe process detected (Potential ClickFix activity). PID: $($FingerProc.Id)" -ForegroundColor Yellow
}