CyberDakait GhostBat Android Banking Fraud + Brazilian Magecart Supply-Chain Skimming: OTX Enterprise Detection Pack

---
title: CyberDakait Android Banking C2 Communication
id: 9a2c1f4e-5b7d-4c8a-9e1f-2a3b4c5d6e7f
status: experimental
description: Detects network connections to known CyberDakait GhostBat/GhostGrab command-and-control and cryptomining infrastructure identified in OTX pulse.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'fud2026.com'
      - 'fud2026.xyz'
      - 'serviceshelp.online'
      - 'cardsprotection.in'
  condition: selection
falsepositives:
  - Legitimate corporate traffic to similarly named domains (rare)
level: high
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1496
date: 2026/10/28
---
title: Firefox Wallet Impersonation Extension C2
id: 7b8c9d0e-1f2a-4b3c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects Firefox process network access to bonto.io subdomains used by malicious crypto-wallet impersonation extensions.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection_img:
    Image|endswith: '\firefox.exe'
  selection_dns:
    DestinationHostname|contains: 'bonto.io'
  condition: selection_img and selection_dns
falsepositives:
  - None expected; bonto.io is not associated with legitimate Mozilla infrastructure.
level: critical
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1071.001
date: 2026/10/28
---
title: Magecart Skimmer WebSocket Exfiltration
id: 3c4d5e6f-7a8b-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects browser or webserver processes establishing WebSocket connections to known Magecart exfiltration endpoint 1x0.is.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains: '1x0.is'
  condition: selection
falsepositives:
  - Security research or sandbox analysis
level: high
tags:
  - attack.collection
  - attack.t1056
  - attack.exfiltration
  - attack.t1041
date: 2026/10/28

// Hunt for CyberDakait, wallet-impersonation, and Magecart IOCs across device network telemetry
let Lookback = 14d;
let SuspiciousHosts = dynamic(["bonto.io", "fud2026.com", "fud2026.xyz", "serviceshelp.online", "cardsprotection.in", "1x0.is", "ecomscan.com", "antiddos-protection.net", "deepveindrilling.com"]);
DeviceNetworkEvents
| where TimeGenerated >= ago(Lookback)
| where RemoteUrl has_any (SuspiciousHosts) or RemoteIP in (dynamic([]))
| extend IOC_Match = iff(RemoteUrl has_any (SuspiciousHosts), RemoteUrl, RemoteIP)
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, IOC_Match
| order by LastSeen desc;

# OTX IOC Hunt - CyberDakait, Wallet Impersonators, Magecart
# Run on endpoints to check for network artifacts and suspicious extension/config paths
$ErrorActionPreference = 'SilentlyContinue'
$report = [System.Collections.Generic.List[object]]::new()

# 1) Check active/established connections to malicious hosts
$badHosts = @('bonto.io','fud2026.com','fud2026.xyz','serviceshelp.online','cardsprotection.in','1x0.is')
Get-NetTCPConnection -State Established | ForEach-Object {
    $r = $_
    try {
        $dns = (Resolve-DnsName -Name $r.RemoteAddress -ErrorAction Stop).NameHost
        if ($badHosts | Where-Object { $dns -like "*$_*" }) {
            $proc = Get-Process -Id $r.OwningProcess
            $report.Add([pscustomobject]@{
                Type='NetworkIOC'; Host=$dns; RemoteIP=$r.RemoteAddress; Process=$proc.ProcessName; PID=$r.OwningProcess
            })
        }
    } catch {}
}

# 2) Hunt Firefox profiles for suspicious extension storage referencing bonto.io
$ffProfiles = Get-ChildItem "$env:APPDATA\Mozilla\Firefox\Profiles" -Directory
foreach ($p in $ffProfiles) {
    $extDir = Join-Path $p.FullName 'extensions'
    if (Test-Path $extDir) {
        Get-ChildItem $extDir -Recurse -File | Select-String -Pattern 'bonto\.io|phantom|jupiter|bitget' -List | ForEach-Object {
            $report.Add([pscustomobject]@{Type='FirefoxExtensionIOC'; Path=$_.Path; Match=$_.Line.Trim()})
        }
    }
}

# 3) Check for Android ADB-connected devices (if adb present) with suspicious APK hashes
$adb = Get-Command adb -ErrorAction SilentlyContinue
if ($adb) {
    $targetHashes = @('311c49974f28d33947b8b74d78b48f51855eacac182d519a4fe1daa6af7f30e9','ee4618d24737eff785e5a267b55903d5ef6ff7ecbeb099347a67fee77734d7f7')
    $pkgs = adb shell pm list packages 2>$null
    foreach ($pkg in $pkgs) {
        $pkgName = $pkg -replace 'package:',''
        $path = adb shell pm path $pkgName 2>$null | Select-Object -First 1
        if ($path -match 'base.apk') {
            $apkPath = ($path -replace 'package:','').Trim()
            $hash = adb shell "sha256sum $apkPath" 2>$null | ForEach-Object { ($_ -split ' ')[0] }
            if ($targetHashes -contains $hash) {
                $report.Add([pscustomobject]@{Type='AndroidMalwareHash'; Package=$pkgName; SHA256=$hash})
            }
        }
    }
}

$report | Format-Table -AutoSize