GlassWorm, Lumma Stealer, and Xinference Compromise: Multi-Front Infostealer Assessment

---
title: Potential GlassWorm or PyPI Supply Chain Compromise
description: Detects suspicious Python processes loading encoded content or making network connections to non-standard endpoints immediately after install, characteristic of GlassWorm or Xinference compromises.
status: experimental
date: 2026/04/30
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_python:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
    CommandLine|contains: 'import'
  selection_suspicious:
    CommandLine|contains:
      - 'base64'
      - '-enc'
      - 'Solana'
  condition: selection_python and selection_suspicious
falsepositives:
  - Legitimate developer scripts encoding data
level: high
tags:
  - attack.execution
  - attack.t1059.001
---
title: ClickFix Phishing Lumma Stealer Execution
description: Detects the execution pattern associated with the HijackLoader/Lumma Stealer campaign involving PowerShell downloading MSI files from remote servers.
status: experimental
date: 2026/04/30
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'DownloadString'
      - 'IEX'
      - 'Invoke-Expression'
  selection_msi:
    CommandLine|contains: '.msi'
  selection_c2:
    CommandLine|contains:
      - '85.11.161.198'
      - ':9658'
      - ':6600'
  condition: selection_powershell and selection_msi
falsepositives:
  - Low
level: critical
tags:
  - attack.initial_access
  - attack.t1566.001
---
title: GachiLoader AI Skill Lure Execution
description: Detects Node.js or Electron processes spawning suspicious child processes like cmd or powershell, indicative of the GachiLoader campaign using fake AI skills.
status: experimental
date: 2026/04/30
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\node.exe'
      - '\electron.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\msiexec.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate software installation via Node.js
level: high
tags:
  - attack.execution
  - attack.t1204

// Hunt for C2 connections associated with KYCShadow and Lumma Stealer
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("serv.biz", "serv.xyz", "api.biz") 
   or RemoteIP == "85.11.161.198"
   or RemoteUrl contains "robinhuds.com"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| summarize Count=count() by DeviceName, RemoteUrl
| order by Count desc


kql
// Hunt for GlassWorm/Xinference suspicious Python activity
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName has "python"
| where ProcessCommandLine has "base64" or ProcessCommandLine has "Solana"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

# IOC Hunt Script for GlassWorm, Lumma, and Xinference Hashes
# Requires Admin Privileges

$TargetHashes = @(
    "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc",
    "c529217014b732abbe646046c07ce8f0366a42051839d4cb3be5b400285fc728",
    "818daf975f78ac30ba4ce0fdd2f7eb550cdc16701da35594e8c9cba72bc84a5c",
    "077d49fa708f498969d7cdffe701eb64675baaa4968ded9bd97a4936dd56c21c",
    "e1e007ce4eab7774785617179d1c01a9381ae83abfd431aae8dba6f82d3ac127",
    "3ee893ae46530b92e0d26435fb979d82", # MD5 for Xinference
    "b07a03883675654088a2b56a80933ca8"  # MD5 for Lumma
)

Write-Host "[+] Starting IOC Hunt for specific file hashes..." -ForegroundColor Cyan

$Drives = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Drive in $Drives) {
    Write-Host "[+] Scanning drive $Drive..." -ForegroundColor Yellow
    try {
        Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
        Get-FileHash -ErrorAction SilentlyContinue | 
        Where-Object { $TargetHashes -contains $_.Hash } | 
        ForEach-Object {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
        }
    }
    catch {
        # Ignore access errors
    }
}

# Check for suspicious Solana/GlassWorm browser extensions (Simplified Check)
$ExtPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data", "$env:APPDATA\Mozilla\Firefox\Profiles")
Write-Host "[+] Checking for suspicious browser extension artifacts..." -ForegroundColor Yellow
# (Logic would expand to enumerate IDs and check manifest. for specific GlassWorm keywords)

Write-Host "[+] Hunt complete." -ForegroundColor Cyan