Dysphoria Blockchain-C2 Botnet, Browser-Extension Wallet Drainers & AnonyMousKIT PhaaS: OTX Credential-Theft Campaign Analysis — Enterprise Detection Pack | Security Arsenal

Five concurrent OTX pulses paint a single, uncomfortable picture: the credential-theft economy is industrializing across every layer of the enterprise stack simultaneously — endpoints, browsers, network hardware, mobile devices, and now AI agent infrastructure.

The Dysphoria botnet has amassed 200,000+ compromised hosts since Q1 2026, evolving through jackskid and fbot variants and pioneering blockchain-based C2 via ENS and SNS domains, turning victims into relay/proxy nodes. A parallel campaign pushed 19 malicious Chrome and Edge extensions into official stores, delivering a wallet-drainer and credential-stealing framework that strips Content Security Policy headers and talks to its operators over WebSockets. At the hardware layer, three firmware implants — SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS — were discovered embedded in ZBT routers distributed globally, with DARKLANTERN offering unauthenticated root shells over UDP/9992. On the crimeware-as-a-service front, AnonyMousKIT operates an AI-powered PhaaS supply chain (506 domains, 168 storefront brands) that harvests Apple credentials to disable Activation Lock on stolen devices, using email, SMS, WhatsApp, and AI voice phishing. Finally, honeypot data confirms operators are actively exploiting Model Context Protocol (MCP) servers: 24 actors executed 628 shell commands, 255 file reads, and 248 secrets-store lookups against a single decoy.

The common denominator is secrets monetization: cloud keys, browser credentials, crypto wallets, Apple IDs, and network-device root access are all being harvested at scale and fed into resale pipelines. Enterprise defenders must assume credential exposure and verify identity posture, not just perimeter integrity.

Threat Actor & Malware Profiles

Dysphoria Botnet (jackskid / fbot lineage)

Distribution: IoT exploitation across a broad CVE set (CVE-2013-3307 through CVE-2022-35733), targeting routers and embedded devices, with observed activity concentrated in China and the technology sector.
Payload behavior: Converts compromised hosts into relay/proxy nodes, creating a self-healing anonymization mesh that shields upstream C2.
C2: Blockchain-based resolution using ENS (Ethereum Name Service) and SNS (Solana Name Service) domains — a takedown-resistant technique that defeats conventional domain sinkholing and registrar abuse channels.
Persistence: Firmware-adjacent residency on IoT devices; survives reboots via init script and cron modification on Linux-based embedded systems.
Anti-analysis: Rapid variant iteration across three codebases; C2 indirection through public blockchain RPC endpoints blends malicious resolution with legitimate Web3 traffic.

Browser-Extension Wallet Drainer Framework

Distribution: 18 Chrome + 1 Edge extensions published to official stores over six months — a supply-chain compromise of the browser trust model itself.
Payload behavior: XSS injection into visited pages, theft of cryptocurrency wallet secrets, session tokens, and stored credentials.
C2: Persistent WebSocket channels to attacker infrastructure (e.g., cookie-whitelist.com, api.extensionanalyticspro.top); typosquatted telemetry domains such as ggle-analytics.com masquerade as legitimate analytics.
Persistence: Browser extension auto-load on every launch; survives host reboots and AV scans that ignore extension directories.
Anti-analysis: Strips Content-Security-Policy response headers to neuter page-level defenses; extendable module framework allows operators to push new capabilities without store re-review.

SPEAKINGSTONE / DARKLANTERN / ENDLESSDOORS (ZBT Firmware Implants)

Distribution: Pre-installed in ZBT router firmware, shipped through a global supply chain reaching the US, Canada, Australia, Germany, Philippines, Russia, and others.
Payload behavior: DARKLANTERN is an unauthenticated UDP backdoor on port 9992 providing root shell access from the internet with a trivial MAC-address bypass — full device takeover with a single packet. SPEAKINGSTONE and ENDLESSDOORS provide phone-home and persistence functions.
C2: Hardcoded infrastructure including 47.107.224.89 and 45.156.37.159, plus hostname www.ac-link.com.
Persistence: Firmware-embedded; survives factory resets and is invisible to endpoint security tooling.

AnonyMousKIT PhaaS

Distribution: Credit-metered PhaaS with a reseller supply chain of 506 domains and 168 storefront brands active since early 2024; targets government and education sectors across 20 countries.
Payload behavior: Multi-channel credential harvesting (email, SMS, WhatsApp, AI-driven vishing) impersonating Apple Support to capture Apple ID credentials, then disabling Activation Lock to monetize stolen iPhones.
Infrastructure: Localization-aware lure domains (suporte-lcloud.com, buscar-lphone.com, findmy-dispositivos.com) tailored to Portuguese and Spanish-speaking victims.

MCP / AI-Agent Exploitation (Honeypot Telemetry)

Of ~1,000 sources reaching an unauthenticated MCP honeypot, 596 spoke the protocol and 24 actively exploited it — executing shell commands, reading files, and querying secrets stores at machine speed. This confirms LLMjacking and AI-agent credential theft have moved from theory to active operator playbooks. Any internet-reachable MCP server without authentication must be treated as compromised.

IOC Analysis

The indicator set spans five types, each requiring a distinct operationalization path:

Domains/Hostnames (highest fidelity): Extension C2 (cookie-whitelist.com, whale-alert.life, api.extensionanalyticspro.top, ggle-analytics.com) and PhaaS lure domains (apple-unlock.com, findsupport.live, zu7pl.pro). Push to DNS sinkhole, secure web gateway, and EDR custom indicators. Alert on historical DNS cache hits, not just new queries — extensions may already be installed.
IPv4 (2 indicators): 47.107.224.89 and 45.156.37.159 (implant C2). Block at egress firewall; hunt NetFlow for any historical session, including UDP.
File hashes (SHA256/SHA1): ZBT implant firmware binaries. Load into EDR blocklists and scan firmware update repositories and TFTP/staging servers where router images are stored.
CVEs (Dysphoria): Cross-reference the CVE list against internet-facing IoT/OT asset inventory (Shodan/Censys exports, EASM tooling). These are the botnet's infection vectors — unpatched exposure equals imminent recruitment.
URLs: Extension callback URLs containing uuid= parameters enable retro hunting in proxy logs for already-victimized users.

SOC tooling: normalize all indicators into STIX/TAXII or your TIP (MISP, OpenCTI), then push via API to Sentinel/Defender (Threat Intelligence Indicators API), CrowdStrike custom IOCs, and Palo Alto EDLs. Blockchain C2 (ENS/SNS) requires egress monitoring of RPC endpoints — standard domain controls will not see it.

Detection Engineering

Sigma Detection Rules

YAML

---
title: Malicious Browser Extension C2 Resolution - Wallet Drainer Campaign
id: 8f2c4a1d-3b7e-4f9a-b6c1-5d8e0a2f4b93
status: experimental
description: Detects DNS resolution of command-and-control domains tied to the 19 malicious Chrome/Edge extensions delivering wallet drainer and credential-stealing payloads. Extensions use WebSocket C2, CSP header stripping, and XSS injection to harvest crypto wallet secrets and browser credentials.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
references:
    - https://socket.dev/blog/chrome-edge-extension-wallet-drainer
logsource:
    category: dns
detection:
    selection_c2:
        QueryName|contains:
            - 'cookie-whitelist.com'
            - 'cookie-whitelist.top'
            - 'whale-alert.life'
            - 'extensionanalyticspro.top'
            - 'active-enable-right-click.top'
            - 'ggle-analytics.com'
            - 'blockfolioaddressmonitor.pro'
            - 'cryptopricebadgequickglance.pro'
    condition: selection_c2
falsepositives:
    - Threat research sandboxes and malware detonation environments
level: high
tags:
    - attack.command_and_control
    - attack.t1176
    - attack.t1071
    - attack.t1552
---
title: DARKLANTERN ZBT Router Implant - UDP 9992 Backdoor and C2 Communication
id: 4d7b9e2a-6c1f-4a8d-9e3b-1f5c7a0d2e84
status: experimental
description: Detects network communication consistent with the DARKLANTERN unauthenticated UDP backdoor (port 9992, root shell with trivial MAC bypass) embedded in ZBT router firmware, including sessions to known implant C2 infrastructure. Any UDP/9992 traffic from internal network segments is highly anomalous in enterprise environments.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
references:
    - https://www.vulncheck.com/blog/zbt-darklantern-speakingstone
logsource:
    category: network_connection
detection:
    selection_backdoor_port:
        DestinationPort: 9992
    selection_implant_c2:
        DestinationIp:
            - '47.107.224.89'
            - '45.156.37.159'
    selection_implant_host:
        DestinationHostname|contains:
            - 'ac-link.com'
    condition: 1 of selection_*
falsepositives:
    - Legacy applications using UDP/9992 (validate against approved service inventory)
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1542
    - attack.t1200
---
title: AI Agent or MCP Exploitation - Mass Secrets and Credential Store Access
id: 2e6a8c4b-9d3f-4b7e-a5c2-8f1d6b0e3a75
status: experimental
description: Detects process command lines accessing credential files, cloud secrets stores, and environment files in patterns matching the 248 secrets-store lookups observed during active exploitation of MCP (Model Context Protocol) honeypot infrastructure. Intended to catch LLMjacking operators and compromised AI agents enumerating secrets at machine speed.
author: Security Arsenal Threat Intelligence
date: 2026/08/29
references:
    - https://beelzebub.ai/blog/it-thought-it-had-won/
logsource:
    category: process_creation
detection:
    selection_cred_files:
        CommandLine|contains:
            - '.aws/credentials'
            - '.kube/config'
            - '.ssh/id_rsa'
            - '.ssh/id_ed25519'
            - '/etc/shadow'
            - 'Login Data'
            - '.env'
    selection_cloud_secrets:
        CommandLine|contains:
            - 'secretsmanager get-secret-value'
            - 'vault kv get'
            - 'az keyvault secret show'
            - 'gcloud secrets versions access'
    filter_known_automation:
        ParentImage|endswith:
            - '\\terraform.exe'
            - '\\ansible-playbook'
    condition: (selection_cred_files or selection_cloud_secrets) and not filter_known_automation
falsepositives:
    - DevOps automation and IaC pipelines (tune filter to your build agents)
    - Backup agents reading home directories
level: high
tags:
    - attack.credential_access
    - attack.t1552.001
    - attack.t1552.004
    - attack.t1059

Microsoft Sentinel KQL Hunt

KQL — Microsoft Sentinel / Defender

// OTX Credential-Theft Campaign Hunt: Extension C2, PhaaS lures, ZBT implants, MCP secrets access
let ExtC2 = dynamic(["cookie-whitelist.com","cookie-whitelist.top","whale-alert.life","extensionanalyticspro.top","active-enable-right-click.top","ggle-analytics.com","blockfolioaddressmonitor.pro","cryptopricebadgequickglance.pro"]);
let PhaaS = dynamic(["apple-unlock.com","buscar-lphone.com","suporte-lcloud.com","com-maps.info","findmy-dispositivos.com","id-ubicacion.com","findsupport.live","zu7pl.pro"]);
let ImplantIP = dynamic(["47.107.224.89","45.156.37.159"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (ExtC2) or RemoteUrl has_any (PhaaS) or RemoteIP in (ImplantIP)
    or (RemotePort == 9992 and RemoteIPType == "Public")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| extend HitType = case(RemoteUrl has_any (ExtC2), "ExtensionC2", RemoteUrl has_any (PhaaS), "PhaaSLure", RemotePort == 9992, "DARKLANTERN-UDP9992", "ImplantC2");
let SecretsAccess = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where ProcessCommandLine has_any (".aws/credentials", ".kube/config", ".ssh/id_rsa", "/etc/shadow", "secretsmanager get-secret-value", "vault kv get", "az keyvault secret show")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend HitType = "SecretsStoreAccess";
union NetHits, SecretsAccess
| sort by TimeGenerated desc

PowerShell IOC Hunt Script

PowerShell

# Security Arsenal - OTX Credential-Theft Campaign Hunt (run on endpoints via EDR/Intune/PS remoting)
$iocDomains = @('cookie-whitelist.com','cookie-whitelist.top','whale-alert.life','extensionanalyticspro.top','active-enable-right-click.top','ggle-analytics.com','blockfolioaddressmonitor.pro','cryptopricebadgequickglance.pro','apple-unlock.com','buscar-lphone.com','suporte-lcloud.com','com-maps.info','findmy-dispositivos.com','id-ubicacion.com','findsupport.live','zu7pl.pro')
$iocIPs = @('47.107.224.89','45.156.37.159')
$findings = @()

# 1. DNS client cache - retro evidence of extension C2 or PhaaS lure resolution
Get-DnsClientCache | Where-Object { $d = $_.Entry; $iocDomains | Where-Object { $d -like "*$_*" } } | ForEach-Object {
    $findings += [pscustomobject]@{Check='DNSCache'; Host=$env:COMPUTERNAME; Detail="$($_.Entry) -> $($_.Data)"}
}

# 2. Active connections to implant C2 and any UDP/9992 listener (DARKLANTERN pattern)
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -in $iocIPs } | ForEach-Object {
    $findings += [pscustomobject]@{Check='ImplantC2-Connection'; Host=$env:COMPUTERNAME; Detail="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) PID=$($_.OwningProcess)"}
}
Get-NetUDPEndpoint -LocalPort 9992 -ErrorAction SilentlyContinue | ForEach-Object {
    $findings += [pscustomobject]@{Check='UDP9992-Listener'; Host=$env:COMPUTERNAME; Detail="Listener PID=$($_.OwningProcess)"}
}

# 3. Browser extension inventory - flag non-store and recently added extensions for review
$extRoots = @("$env:LOCALAPPDATA\Google\Chrome\User Data","$env:LOCALAPPDATA\Microsoft\Edge\User Data")
foreach ($root in $extRoots) {
    Get-ChildItem "$root\*\Extensions\*\*\manifest.json" -ErrorAction SilentlyContinue | ForEach-Object {
        $m = Get-Content $_.FullName -Raw | ConvertFrom-Json -ErrorAction SilentlyContinue
        $perms = ($m.permissions + $m.host_permissions) -join ','
        if ($perms -match 'webRequest|cookies|<all_urls>|tabs') {
            $findings += [pscustomobject]@{Check='HighPrivExtension'; Host=$env:COMPUTERNAME; Detail="$($m.name) v$($m.version) [$($_.Directory.Parent.Parent.Name)] perms=$perms"}
        }
    }
}

# 4. Persistence sweep - suspicious scheduled tasks and Run keys spawning script interpreters
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'powershell|wscript|cscript|rundll32|mshta' -and $_.TaskPath -notlike '\Microsoft*' } | ForEach-Object {
    $findings += [pscustomobject]@{Check='SuspiciousTask'; Host=$env:COMPUTERNAME; Detail="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"}
}
'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object {
    Get-ItemProperty $_ -ErrorAction SilentlyContinue | ForEach-Object { $_.PSObject.Properties } | Where-Object { $_.Value -match 'powershell|wscript|AppData\\Local\\Temp' } | ForEach-Object {
        $findings += [pscustomobject]@{Check='RunKey'; Host=$env:COMPUTERNAME; Detail="$($_.Name)=$($_.Value)"}
    }
}

# 5. Secrets-store exposure - credential files readable outside expected automation context
$credPaths = @("$env:USERPROFILE\.aws\credentials","$env:USERPROFILE\.kube\config","$env:USERPROFILE\.ssh\id_rsa")
$credPaths | Where-Object { Test-Path $_ } | ForEach-Object {
    $findings += [pscustomobject]@{Check='SecretsFilePresent'; Host=$env:COMPUTERNAME; Detail="$_ (LastWrite: $((Get-Item $_).LastWriteTime)) - correlate with KQL SecretsStoreAccess hits"}
}

$findings | Format-Table -AutoSize
if ($findings) { $findings | Export-Csv ".\otx-hunt-$env:COMPUTERNAME.csv" -NoTypeInformation; Write-Warning "HITS FOUND - export written, escalate to IR" } else { Write-Output "No hits on $env:COMPUTERNAME" }

Response Priorities

Immediate (0-4 hours)

Block all IOCs: Push the 8 extension-C2 domains, 8 PhaaS lure domains, and 2 implant C2 IPs to DNS sinkhole, SWG, EDR custom indicators, and egress firewall (include UDP). Add the three implant SHA256 hashes to EDR blocklists.
Deny UDP/9992 inbound and outbound at the perimeter; hunt NetFlow and the KQL query above for any historical session.
Inventory ZBT routers across offices, remote-worker hardware stipends, and lab environments; isolate identified devices pending firmware analysis.
Run the PowerShell hunt fleet-wide via EDR live response; the HighPrivExtension and DNSCache checks surface already-installed malicious extensions.
Audit for internet-exposed MCP servers (cloud asset inventory, EASM scan). Any unauthenticated instance is treated as breached: rotate every secret it could reach.

Within 24 Hours

Force credential resets for any user whose browser resolved an extension-C2 or PhaaS domain (DNS cache/proxy retro hunt). Include Apple IDs used for corporate device enrollment.
Rotate cloud secrets: AWS access keys, Kubernetes service accounts, and vault entries on any host with SecretsStoreAccess KQL hits — the honeypot data shows operators enumerate secrets within minutes of access.
Revoke sessions and refresh tokens for affected users; crypto-wallet drainers bypass MFA entirely via session theft, so session revocation is mandatory, not optional.
Verify MFA posture on IdP: confirm no SMS/voice fallback methods are enrolled for targeted users (AnonyMousKIT-style vishing exploits exactly these).
Check crypto exposure: if corporate treasury or employee wallets touched whale-alert.life or related infrastructure, assume private-key compromise and migrate funds.

Within One Week

Browser extension governance: Deploy allowlist-only extension policy via Chrome/Edge enterprise management; block users from installing unvetted extensions permanently. This is the single highest-value hardening against this campaign class.
Hardware supply-chain policy: Require firmware attestation and vendor SBOMs for all network gear; add ZBT-sourced devices to procurement blocklist pending vendor response.
Patch IoT attack surface: Remediate the Dysphoria CVE set (CVE-2013-3307, CVE-2017-5259, CVE-2020-25499, CVE-2022-35733, et al.) on all internet-facing embedded devices; segment IoT/OT onto restricted VLANs with egress filtering.
MCP/AI agent security baseline: Mandate authentication on all MCP servers, scope agent tool permissions to least privilege, and log every tool invocation to the SIEM. Treat AI agents as privileged service accounts.
Phishing-resistant MFA: Migrate executive, finance, and IT-admin populations to FIDO2/passkeys to blunt AI-vishing and PhaaS credential capture.
Blockchain-C2 visibility: Add monitoring for anomalous egress to public blockchain RPC endpoints from non-Web3 workloads — Dysphoria's ENS/SNS resolution hides in that traffic.