ClickFix, Supply Chain Poisoning, and Trigona Exfiltration: Multi-Vector Credential Theft Analysis

---
title: Potential ClickFix Social Engineering Execution
id: 8f79e3a8-1b2c-4d5e-9f6a-1b2c3d4e5f6a
description: Detects PowerShell execution patterns often associated with ClickFix campaigns where users are tricked into running obfuscated commands via copy-paste.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/662a1b1c5d4e5e6e6b1c2d3e
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: 
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'CopyTo-Clipboard'
            - 'iex'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Trigona Ransomware Custom Exfiltration Tool
id: a1b2c3d4-e5f6-4a5b-8c9d-1e2f3a4b5c6d
description: Detects the execution of uploader_client.exe, a custom tool used by Trigona affiliates to steal data before encryption.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/662a1b1c5d4e5e6e6b1c2d4f
tags:
    - attack.exfiltration
    - attack.t1041
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\uploader_client.exe'
    condition: selection
falsepositives:
    - Unknown (Legitimate usage unlikely)
level: critical
---
title: Suspicious VS Code Extension Child Process
id: b2c3d4e5-f6a7-4b5c-9d0e-2f3a4b5c6d7e
description: Detects suspicious child processes spawned by VS Code host, potentially indicating malicious extensions like GlassWorm or mcpAddon.js.
status: experimental
date: 2026/04/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/662a1b1c5d4e5e6e6b1c2d4e
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|contains: '\Code.exe'
    selection_child:
        Image|endswith:
            - '\node.exe'
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'extension'
            - 'http'
    condition: all of selection_*
falsepositives:
    - Legitimate extension development activity
level: medium

// Hunt for ClickFix and Keitaro related domains in network connections
let IoCs = dynamic(["ustazazharidrus.com", "account-help.info", "quiptly.com", "elive123go.com", "visitbundala.com", "ucaboodle.com", "someotherbox.com", "your-link.online"]);
DeviceNetworkEvents
| where RemoteUrl has_any (IoCs) or InitiatingProcessFileName has_any ("powershell.exe", "cmd.exe")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
| extend IoC_Hit = iff(RemoteUrl has_any (IoCs), "Domain_Match", "Suspicious_Process")

# Check for Trigona artifacts and malicious VS Code extensions
Write-Host "[!] Hunting for Trigona and GlassWorm artifacts..." -ForegroundColor Cyan

# Check for uploader_client.exe (Trigona Exfil)
$trigonaPath = "C:\Windows\Temp\uploader_client.exe"
if (Test-Path $trigonaPath) {
    Write-Host "[ALERT] Trigona exfiltration tool found at $trigonaPath" -ForegroundColor Red
}

# Check for common persistence mechanisms used by stealers
$regPaths = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
$malwareKeys = @("Lumma", "Vidar", "RedLine", "Rusty")

foreach ($path in $regPaths) {
    if (Test-Path $path) {
        Get-Item -Path $path | Select-Object -ExpandProperty Property | ForEach-Object {
            if ($_ -match ($malwareKeys -join '|')) {
                Write-Host "[ALERT] Suspicious persistence key found in $path : $_" -ForegroundColor Red
            }
        }
    }
}

# Scan for VS Code extensions with suspicious content
$vsCodeExtensions = "$env:USERPROFILE\.vscode\extensions"
if (Test-Path $vsCodeExtensions) {
    Write-Host "[*] Scanning VS Code extensions for suspicious scripts (GlassWorm/TeamPCP)..." -ForegroundColor Yellow
    Get-ChildItem -Path $vsCodeExtensions -Recurse -Filter "*.js" | Select-String -Pattern "eval\(|base64decode|http:\/\/.*\.onion" | Select-Object Path, Pattern | Out-String | Write-Host
}