Flying Eagle RAT, Shai-Hulud NPM Worm & ClickFix: Cross-Vector Credential Theft Campaigns — Detection Pack

title: Potential ClickFix Rundll32 WebDAV Execution
id: 4b2c7e8a-9f1d-4b3c-8a5d-2f1e3b4c5d6e
description: Detects suspicious rundll32.exe execution loading payloads from remote WebDAV shares (http/https), a technique observed in ClickFix campaigns.
status: experimental
date: 2026/07/29
author: Security Arsenal
references:
    - https://www.cyberproof.com/blog/clickfix-keeps-evolving-rundll32-ordinal-execution-over-webdav/
tags:
    - attack.execution
    - attack.t1204
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\rundll32.exe'
    selection_cli:
        CommandLine|contains:
            - 'http://'
            - 'https://'
    selection_obfuscation:
        CommandLine|contains:
            - '#1'
            - 'ordinal'
    condition: all of selection_*
falsepositives:
    - Legitimate legacy application loading DLLs from internal web servers
level: high
---
title: NPM Supply Chain Attack Spawning Bun Runtime
id: 5c3d8f9b-0e2a-4c5d-9e6f-1a2b3c4d5e6f
description: Detects npm or node processes spawning the Bun runtime, indicative of the Shai-Hulud worm activity or malicious package execution.
status: experimental
date: 2026/07/29
author: Security Arsenal
references:
    - https://www.netskope.com/blog/shai-hulud-style-npm-worm-hits-tanstack
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\npm.exe'
            - '\node.exe'
            - '\npx.exe'
    selection_child:
        Image|endswith:
            - '\bun.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate development workflows using Bun with NPM
level: medium
---
title: PasasteSinTAG Phishing Domain Access
id: 6d4e9g0h-1f3b-5d6e-0f7g-2b3c4d5e6f7g
description: Detects process connections to known PasasteSinTAG phishing infrastructure domains targeting Chilean users.
status: experimental
date: 2026/07/29
author: Security Arsenal
references:
    - https://x.com/tial_cl/status/2071307374497861790
tags:
    - attack.credential_access
    - attack.t1059.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'pasastesintag'
            - 'parastesintago'
    condition: selection
falsepositives:
    - Unknown
level: critical



kql
// Hunt for ClickFix related rundll32 execution
DeviceProcessEvents  
| where Timestamp > ago(1d)  
| where FileName == "rundll32.exe"  
| where ProcessCommandLine has "http" and (ProcessCommandLine has "#1" or ProcessCommandLine has ",")  
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

// Hunt for NPM Worm related process spawn chains
DeviceProcessEvents  
| where Timestamp > ago(1d)  
| where InitiatingProcessFileName in ("npm.exe", "node.exe", "npx.exe")  
| where FileName in ("bun.exe", "powershell.exe", "cmd.exe")  
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, FolderPath

// Network connections to Shai-Hulud or ClickFix infrastructure
DeviceNetworkEvents  
| where Timestamp > ago(1d)  
| where RemoteUrl has "git-tanstack.com" or RemoteUrl has "poundbahis.com" or RemoteUrl has "webyek.com"  
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, LocalPort



powershell
# IOC Hunt Script for Flying Eagle & ClickFix Payloads
# Requires Administrator privileges

$TargetHashes = @(
    "18827998ad05c58da1d218066374fe16", # Flying Eagle
    "f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6", # ClickFix Payload
    "2ec78d556d696e208927cc503d48e4b5eb56b31abc2870c2ed2e98d6be27fc96"  # NPM Worm
)

$SearchPaths = @(
    "$env:TEMP",
    "$env:USERPROFILE\Downloads",
    "$env:USERPROFILE\AppData\Local\Temp",
    "C:\Windows\Temp"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

foreach ($path in $SearchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
                Write-Host "    Hash: $hash" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking Hosts file for ClickFix/PasasteSinTAG domains..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $SuspiciousDomains = @("git-tanstack", "poundbahis", "gentletouchchiropractic")
    $hostsContent = Get-Content $HostsPath
    foreach ($line in $hostsContent) {
        foreach ($domain in $SuspiciousDomains) {
            if ($line -like "*$domain*") {
                Write-Host "[!] Suspicious entry in hosts file: $line" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "[+] Scan complete." -ForegroundColor Green