Dark Caracal GoCaracal Framework + Russian Evilginx OAuth Phishing Clusters: OTX Pulse Analysis — Credential Theft Detection Pack | Security Arsenal

Two pulses published to AlienVault OTX on 2026-09-25 paint a converging picture: credential theft and espionage-grade collection operations are maturing on both sides of the globe. In Latin America, the Dark Caracal threat actor has re-emerged with a previously undocumented Go-based modular framework. In the US and Europe, three Russian cyber espionage clusters are running sophisticated OAuth and device-code phishing campaigns backed by Evilginx infrastructure. Both operations share a single objective — harvesting identities and session tokens that can be monetized or weaponized downstream.

Threat Summary

Pulse 1 — Dark Caracal Reloaded (GoCaracal / Bandook / AsioGate). During a targeted intrusion investigation in June 2026, researchers uncovered GoCaracal, a modular framework written in Go attributed to Dark Caracal — the long-running cyberespionage actor historically tied to the Bandook RAT (S0234). GoCaracal ships in two operational profiles: a lightweight implant for initial access and payload delivery, and an extended build for sustained intelligence collection, including keylogging and browser credential extraction. The campaign targets telecommunications organizations across Brazil, Chile, Colombia, Ecuador, El Salvador, Uruguay, and Venezuela. Notably, the operation uses Ethereum blockchain infrastructure as a C2 fallback channel — dead-drop resolver logic embedded in smart contracts makes takedown significantly harder. The pulse also references four CVEs (CVE-2026-28299, CVE-2026-50656, CVE-2026-28323, CVE-2026-18577), indicating vulnerability exploitation is part of the delivery chain, and lure infrastructure uses Spanish-language domains themed around digital documents and support portals (e.g., documentodigital.cloud, soportedigital.cloud).

Pulse 2 — Inhospitable (UNC6293 / UNC7005 / UNC5976). Validin's research tracks infrastructure used by three Russian cyber espionage clusters targeting individuals in academia, think tanks, and government organizations in the United States and Czechia. Tradecraft includes OAuth phishing, Microsoft device code phishing, and WhatsApp-based targeting, with UNC6293 deploying lure domains impersonating Google Drive and file-sharing services (drive.google.sharefolders.org, drive.google.formshare.cloud). Evilginx — an adversary-in-the-middle (AiTM) phishing framework — proxies real authentication flows, capturing session cookies that bypass MFA entirely.

Collective assessment: Both campaigns converge on identity as the primary target. Dark Caracal steals credentials endpoint-side via keylogging and browser stores; the Russian clusters steal them identity-side via token/session interception. Stolen credentials and session tokens from both operations have historically surfaced in dark web markets and initial access broker (IAB) channels.

Threat Actor / Malware Profile

GoCaracal (Dark Caracal)

Distribution: Targeted intrusion delivery via Spanish-language lure domains posing as digital document/accounting services; exploitation of recently disclosed CVEs in the delivery chain.
Payload behavior: Two-build modular architecture. Lightweight profile establishes access and stages payloads; extended profile performs keylogging, browser credential extraction, and long-term collection.
C2 communication: Primary C2 over attacker-controlled domains; Ethereum smart-contract fallback where the implant queries blockchain data to resolve replacement C2 infrastructure when primary domains are sinkholed.
Persistence: Sustained-access build designed for long dwell times consistent with espionage tasking; expect standard implant persistence (scheduled tasks, run keys, or service installation) deployed via the modular loader.
Anti-analysis: Go compilation (large binaries, flattened symbols), modular on-demand capability delivery to limit forensic footprint, and blockchain-based C2 resolution that defeats static IOC blocking.

Evilginx AiTM Phishing (UNC6293 / UNC7005 / UNC5976)

Distribution: Spear-phishing lures impersonating Google Drive, file-sharing portals, and Microsoft device-code authentication flows; WhatsApp used as a delivery/social engineering channel.
Payload behavior: No endpoint payload required — Evilginx acts as a reverse proxy to legitimate login portals, capturing credentials and post-authentication session cookies in real time.
C2 / Infrastructure: Lure domains with deceptive subdomains (drive.google.<lure-domain>), rotation across registrars, DNS pivoting between clusters.
Persistence: Stolen session tokens provide persistence without malware — valid until expiry/revocation. OAuth consent grants may be abused for durable mailbox/cloud access.
Anti-analysis: Infrastructure compartmentalized per cluster; lure pages fingerprint visitors and serve benign content to scanners/sandboxes.

IOC Analysis

The pulses contain 59 indicators, dominated by domains and hostnames, plus four CVE identifiers:

Lure/C2 domains (block at DNS and web proxy): contabilidad.icu, documentodigital.cloud, getpdfdigital.cloud, soportedigital.cloud (Dark Caracal); fileshareapp.org, sharefolders.org, formshare.cloud, usercontent.online, fllefolder.com (Russian clusters).
Deceptive hostnames (high-fidelity AiTM indicators): drive.google.sharefolders.org, drive.google.formshare.cloud, drive.google.usercontent.online — the drive.google.* prefix under attacker-controlled parent domains is a near-deterministic phishing signal.
CVEs (patch/attack-surface tracking): CVE-2026-28299, CVE-2026-50656, CVE-2026-28323, CVE-2026-18577 — map these to your asset inventory via your vulnerability scanner (Qualys/Tenable/Rapid7) and prioritize internet-facing and telecom-adjacent assets.

Operationalization guidance: Push domains/hostnames into DNS sinkhole, EDR custom indicators, and secure web gateway block lists. Detonate any captured lure documents in a sandbox (ANY.RUN, Joe Sandbox) to extract GoCaracal second-stage hashes and netwire. For Evilginx indicators, correlate DNS resolution telemetry with Azure AD/Entra sign-in logs — a user resolving a lure hostname followed by a successful sign-in from an anomalous ASN is a confirmed AiTM compromise.

Detection Engineering

YAML

---
title: GoCaracal Blockchain C2 Fallback or Suspicious Go Implant Network Activity
id: 9f1e2c3a-7b4d-4e5f-9a1b-darkcaracal01
status: experimental
description: Detects outbound connections to Dark Caracal C2/lure infrastructure and Ethereum JSON-RPC endpoints consistent with GoCaracal's blockchain-based C2 fallback mechanism.
author: Security Arsenal Threat Intelligence
references:
    - https://arcticwolf.com/resources/blog/dark-caracal-reloaded-new-malware-same-hunting-grounds/
date: 2026/09/25
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1102
logsource:
    category: network_connection
    product: windows
detection:
    selection_domains:
        DestinationHostname|contains:
            - 'contabilidad.icu'
            - 'documentodigital.cloud'
            - 'getpdfdigital.cloud'
            - 'soportedigital.cloud'
    selection_eth:
        DestinationHostname|contains:
            - 'mainnet.infura.io'
            - 'eth-mainnet'
            - 'rpc.ankr.com'
        Image|endswith:
            - '\appdata\'
    condition: selection_domains or selection_eth
falsepositives:
    - Legitimate Web3 development tooling (rare on enterprise endpoints)
level: high
---
title: Evilginx AiTM Phishing Lure Domain Resolution
description: Detects DNS resolution of Evilginx lure domains and deceptive drive.google.* hostnames used by UNC6293/UNC7005/UNC5976 Russian espionage clusters.
id: 8a2f1b4c-6d3e-4f5a-8b2c-evilginx0002
status: experimental
author: Security Arsenal Threat Intelligence
references:
    - https://www.validin.com/blog/inhospitable_russian_cyber_espionage_clusters/
date: 2026/09/25
tags:
    - attack.credential_access
    - attack.t1557
    - attack.t1566.002
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'fileshareapp.org'
            - 'sharefolders.org'
            - 'formshare.cloud'
            - 'usercontent.online'
            - 'fllefolder.com'
    condition: selection
falsepositives:
    - Threat research and sandbox detonation
level: critical
---
title: Microsoft Device Code Phishing Authentication Pattern
id: 7c3e2a1d-5f4b-4e6d-9c1a-devicecode03
status: experimental
description: Detects OAuth device code flow authentication from anomalous sources, consistent with UNC6293/UNC7005 device code phishing tradecraft.
author: Security Arsenal Threat Intelligence
date: 2026/09/25
tags:
    - attack.credential_access
    - attack.t1528
    - attack.t1550
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        authentication_protocol: 'deviceCode'
    filter_known:
        location|contains:
            - 'Corporate HQ'
    condition: selection and not filter_known
falsepositives:
    - Legitimate device code flow for IoT/CLI tooling (Azure CLI, VS Code)
level: high

KQL — Microsoft Sentinel / Defender

// Security Arsenal — AiTM Phishing & GoCaracal C2 Hunt
// Correlate lure domain resolution with anomalous sign-ins and unexpected outbound TLS
let lureDomains = dynamic(["contabilidad.icu","documentodigital.cloud","getpdfdigital.cloud","soportedigital.cloud","fileshareapp.org","sharefolders.org","formshare.cloud","usercontent.online","fllefolder.com"]);
let dnsHits = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (lureDomains) or RemoteUrl startswith "drive.google."
| project DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, TimeGenerated;
let signins = SigninLogs
| where TimeGenerated > ago(7d)
| project UserPrincipalName, IPAddress, Location, AppDisplayName, TimeGenerated, Status;
dnsHits
| extend TimeBin = bin(TimeGenerated, 15m)
| join kind=inner (signins | extend TimeBin = bin(TimeGenerated, 15m)) on TimeBin
| project DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, UserPrincipalName, IPAddress, Location, AppDisplayName, TimeGenerated
| order by TimeGenerated desc

PowerShell

# Security Arsenal — GoCaracal / Evilginx IOC Endpoint Hunt
# Run via EDR live response or PS remoting across the fleet
$lureDomains = @("contabilidad.icu","documentodigital.cloud","getpdfdigital.cloud","soportedigital.cloud","fileshareapp.org","sharefolders.org","formshare.cloud","usercontent.online","fllefolder.com")

Write-Host "=== [1] DNS Cache Check for Lure/C2 Domains ===" -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache | Where-Object { $entry = $_.Entry; $lureDomains | Where-Object { $entry -like "*$_*" } }
if ($dnsCache) { $dnsCache | Format-Table Entry, Data, TimeToLive -AutoSize } else { Write-Host "No lure domains in DNS cache." }

Write-Host "=== [2] Active Connections to IoC Infrastructure ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established | ForEach-Object {
    try { $rdns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost } catch { $rdns = $null }
    if ($rdns -and ($lureDomains | Where-Object { $rdns -like "*$_*" })) {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ RemoteHost = $rdns; RemoteIP = $_.RemoteAddress; Process = $proc.ProcessName; Path = $proc.Path }
    }
} | Format-Table -AutoSize

Write-Host "=== [3] Persistence Artifacts (Run Keys / Scheduled Tasks) ===" -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run","HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
    Select-Object -Property * | Out-String | Select-String -Pattern "AppData|Temp|Public" | ForEach-Object { $_.Line }
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" -and $_.Actions.Execute -match "AppData|Temp|ProgramData" } |
    Select-Object TaskName, TaskPath, @{n='Exec';e={$_.Actions.Execute}} | Format-Table -AutoSize

Write-Host "=== [4] Suspicious Unsigned Go Binaries in User Directories ===" -ForegroundColor Cyan
Get-ChildItem "$env:USERPROFILE\AppData","$env:ProgramData" -Recurse -Include *.exe -ErrorAction SilentlyContinue |
    Where-Object { (Get-AuthenticodeSignature $_.FullName).Status -ne 'Valid' -and $_.Length -gt 5MB } |
    Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize

Write-Host "=== [5] Browser Credential Store Access (Recent) ===" -ForegroundColor Cyan
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data","$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data" -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-3) } | Select-Object FullName, LastWriteTime

Response Priorities

Immediate (0–4h):

Block all listed domains/hostnames at DNS resolver, secure web gateway, and EDR custom indicator lists — including wildcard rules for *.sharefolders.org, *.formshare.cloud, *.usercontent.online.
Hunt endpoint telemetry for DNS resolutions to lure domains and for unsigned Go binaries (>5MB, unsigned, in AppData/ProgramData) executing with network activity.
Audit Entra ID/O365 sign-in logs for device code flow authentications and any sign-in temporally correlated with lure domain resolution; revoke sessions and reset credentials for any matches.

24 Hours:

Both campaigns steal credentials and session tokens — treat any exposed identity as compromised. Force password resets and revoke refresh tokens / OAuth grants for affected users (revoke-AzureADUserAllRefreshToken or equivalent).
Review OAuth app consents tenant-wide for suspicious grants added in the last 30 days; remove anything not explicitly approved.
For telecom-sector organizations in the listed Latin American countries: escalate to incident response posture and sweep for the four referenced CVEs in internet-facing infrastructure.

1 Week:

Deploy phishing-resistant MFA (FIDO2/passkeys) for high-risk users in academia, government, and think tanks — Evilginx defeats TOTP and push-based MFA but not hardware-bound WebAuthn.
Restrict or disable OAuth device code flow where not operationally required; enable Conditional Access policies enforcing compliant-device and approved-location sign-in.
Enforce certificate-based or attested browser session binding (token protection/Continuous Access Evaluation) to blunt session-cookie replay.
Patch the four CVEs cited in the Dark Caracal pulse; block outbound Ethereum JSON-RPC endpoints (Infura/Ankr) from standard user endpoints to sever GoCaracal's blockchain C2 fallback.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Dark Caracal GoCaracal Framework + Russian Evilginx OAuth Phishing Clusters: OTX Pulse Analysis — Credential Theft Detection Pack