Countering the DCloud Uni-App Threat: Detecting Mass-Produced Investment Scams

---
title: Potential Uni-App Scam Template Access
id: 98d6c3a1-4f12-4b8e-9c1d-1e2f3a4b5c6d
status: experimental
description: Detects network requests to Uni-App default build artifacts (app-service.js) which are heavily used in current investment scam templates. Legitimate apps using Uni-App should be allowlisted.
references:
  - https://www.securityweek.com/chinese-framework-powers-200000-scam-sites/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566
group: masquerading
logsource:
  category: proxy
  product: any
detection:
  selection:
    c-uri|contains:
      - '/static/js/app-service.js'
      - '/static/js/uni.'
      - '/__uniapp'
  filter_legitimate:
    cs-host|contains:
      - 'trusted-domain.com'
      - 'internal-app.local'
  condition: selection and not filter_legitimate
falsepositives:
  - Legitimate internal applications built with Uni-App
level: high
---
title: Suspicious Uni-App Webview User-Agent
id: 12a3b4c5-d6e7-8f90-1234-567890abcdef
status: experimental
description: Detects requests from User-Agents commonly associated with Uni-App hybrid applications originating from external IPs.
references:
  - https://www.securityweek.com/chinese-framework-powers-200000-scam-sites/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071
group: masquerading
logsource:
  category: webserver
  product: any
detection:
  selection:
    cs-user-agent|contains:
      - 'uni-app'
      - 'Html5Plus'
  condition: selection
falsepositives:
  - Verified internal mobile applications
level: medium


**KQL (Microsoft Sentinel / Defender)**

// Hunt for Uni-App scam infrastructure indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ('/static/js/app-service.js', '/static/js/chunk-vendors.js', '/__uniapp')
| where InitiatingProcessFileName in ('chrome.exe', 'msedge.exe', 'firefox.exe') 
or InitiatingProcessFileName !in ('svchost.exe', 'services.exe') // Filter background noise
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend Domain = tostring(split(RemoteUrl, '/')[0])
| summarize count() by Domain, RemoteIP, bin(Timestamp, 1h)
| where count_ < 50 // Filter out high-volume legitimate CDNs if necessary, or tune based on environment
| order by count_ desc


**Velociraptor VQL**

-- Hunt for Uni-App related manifest or JS files in user profiles
SELECT FullPath, Mtime, Size, Mode
FROM glob(globs='/*users/*/AppData/Local/*/User Data/*/Default/Local Storage/leveldb/*.log')
WHERE 
   Content =~ 'uni-app'
   OR Content =~ 'dcloud'
   OR Content =~ 'Html5Plus'


**Remediation Script (PowerShell)**

# Audit for suspicious investment scam artifacts using Uni-App
# Run as Administrator

Write-Host "[+] Initiating hunt for Uni-App scam artifacts..." -ForegroundColor Cyan

$UserDirs = Get-ChildItem "C:\Users" -Directory -Exclude "Public", "Default*")
$SuspiciousPatterns = @("uni-app", "dcloud", "Html5Plus", "app-service.js")
$Findings = @()

foreach ($User in $UserDirs) {
    $DownloadPath = Join-Path -Path $User.FullName -ChildPath "Downloads"
    $DesktopPath = Join-Path -Path $User.FullName -ChildPath "Desktop"
    
    if (Test-Path $DownloadPath) {
        Write-Host "[ ] Scanning $($User.Name) Downloads..." -ForegroundColor Gray
        $Files = Get-ChildItem -Path $DownloadPath -Recurse -Include *.html, *.js, *., *.url -ErrorAction SilentlyContinue
        
        foreach ($File in $Files) {
            $Content = Get-Content $File.FullName -Raw -ErrorAction SilentlyContinue
            if ($Content) {
                foreach ($Pattern in $SuspiciousPatterns) {
                    if ($Content -match $Pattern) {
                        $Findings += [PSCustomObject]@{
                            User = $User.Name
                            Path = $File.FullName
                            PatternMatched = $Pattern
                        }
                        break
                    }
                }
            }
        }
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "[!] Potential scam artifacts found:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
    # Optional: Quarantine logic would go here based on organizational policy
} else {
    Write-Host "[+] No suspicious Uni-App artifacts found." -ForegroundColor Green
}