ClickFix Surge: Potemkin, TELEPUZ, and OkoBot Credential Theft Campaigns — OTX Pulse Analysis

title: Potential Potemkin Loader ClickFix Activity
description: Detects execution of HTA files spawning MSI processes, a pattern observed in Potemkin Loader campaigns via ClickFix.
status: experimental
date: 2026/07/16
author: Security Arsenal
references:
    - https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack
tags:
    - attack.defense_evasion
    - attack.execution
    - attack.t1204.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\mshta.exe'
        Image|endswith: '\msiexec.exe'
    condition: selection
falsepositives:
    - Legitimate software installations triggered via HTML help
level: high
---
title: TELEPUZ MaaS Process Creation Patterns
description: Detects suspicious PowerShell execution patterns associated with TELEPUZ or OkoBot ClickFix infection chains.
status: experimental
date: 2026/07/16
author: Security Arsenal
references:
    - https://www.elastic.co/security-labs/telepuz-maas-malware-clickfix
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'downloadstring'
            - 'iex'
    selection_suspicious:
        CommandLine|contains:
            - 'ClickFix'
            - 'chrome_update'
            - 'edge_fix'
    condition: all of selection_*
falsepositives:
    - Administrative scripts
level: medium
---
title: Golden Gh0st RAT C2 Traffic
Description: Detects network connections to known Golden Gh0st RAT C2 ports associated with CylindricalCanine activity.
status: experimental
date: 2026/07/16
author: Security Arsenal
references:
    - https://expel.com/blog/introducing-cylindricalcanine/
tags:
    - attack.c2
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 5188
            - 5198
        Initiated: 'true'
    filter:
        DestinationIp:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
    condition: selection and not filter
falsepositives:
    - Legitimate applications using these high ports (rare)
level: high

// Hunt for Potemkin and ClickFix related process activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (InitiatingProcessFileName == "mshta.exe" and FileName == "msiexec.exe") 
   or (FileName == "powershell.exe" and CommandLine has "downloadstring" and ProcessCommandLine matches regex @"(chrome|edge|browser).*update")
| extend FullProcess = ProcessCommandLine
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, FullProcess
| order by Timestamp desc

// Hunt for network connections to suspicious domains or Golden Gh0st ports
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (5188, 5198) or RemoteUrl has_any ("eutialyson.com", "distritovagas.com", "goldeyeuu.io", "keensie.com")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
| order by Timestamp desc

# IOC Hunt for Potemkin, TELEPUZ, OkoBot, and Golden Gh0st Indicators
$IOC_Hashes = @(
    "79f7b67ce8b39070f3e1c2b90fce0ce84134782a7dedcccc1edac197ee9e089b",
    "03fa348b70819296c958c842e7646b3b7efe5fa217ed5098143003c47995a746",
    "1abffe97aafe9916b366da5745858a78338598cab9742c2d9e03e4ad0ba11f29bf",
    "13ac78f8f2ed76a03c85f0cdef07e5463aa64458303c0949090fcd81868ba8ca"
)

$IOC_Domains = @(
    "resumeacceptable.com",
    "sonra.eutialyson.com",
    "cl.distritovagas.com",
    "uu.goldeyeuu.io",
    "api.keensie.com",
    "coffeesaloon.online"
)

Write-Host "[*] Checking for malicious file hashes..."
foreach ($hash in $IOC_Hashes) {
    $paths = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash -eq $hash }
    if ($paths) {
        Write-Host "[!] MALICIOUS FILE FOUND: " $paths.FullName -ForegroundColor Red
    }
}

Write-Host "[*] Checking DNS Cache for C2 domains..."
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($domain in $IOC_Domains) {
    if ($dnsCache | Where-Object { $_.Entry -like "*$domain*" }) {
        Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND FOR: $domain" -ForegroundColor Yellow
    }
}

Write-Host "[*] Checking for RMMProject/Gh0st suspicious persistence..."
$services = Get-WmiObject -Class Win32_Service | Where-Object { $_.PathName -like "*lua*" -or $_.Name -like "*gh0st*" }
if ($services) {
    Write-Host "[!] SUSPICIOUS SERVICE FOUND: " $services.Name -ForegroundColor Red
}