GoCaracal + Bandook C2, MCP Secrets Abuse, and RecruitTrap OAuth Phishing: OTX Pulse Detection Pack — 2026-08-26

Threat Summary

Three concurrent OTX pulses point to one operational theme: credential and secrets access is being pursued across every enterprise control plane — endpoints, identity providers, mobile browsers, and emerging AI-agent infrastructure.

• Dark Caracal Reloaded describes a targeted intrusion in June 2026 that uncovered GoCaracal, a previously undocumented modular Go framework. Reporting associates the activity with Dark Caracal, Bandook (S0234), and AsioGate, with Latin America-focused targeting across Brazil, Chile, Colombia, Ecuador, El Salvador, Uruguay, and Venezuela, and interest in telecommunications. The toolset appears to split into a lightweight access/payload-delivery profile and an extended collection build with keylogging and browser credential theft. Tags such as ethereum c2 fallback, blockchain infrastructure, and modular framework suggest resilient C2 design and possible fallback channels when conventional infrastructure is blocked.
• The AI-Native security platform pulse reports an unauthenticated Model Context Protocol (MCP) honeypot observed May–July 2026. Roughly 1,000 sources reached the decoy, 596 spoke MCP, and 24 actively exploited it, executing 628 shell commands, 255 file reads, and 248 secrets-store lookups. This is direct evidence that operators are probing AI agent runtimes for cloud credentials, tokens, environment variables, and secrets-manager paths.
• RecruitTrap recruitment scams are harvesting enterprise credentials through HR impersonation, Browser-in-the-Browser desktop lures, and full-screen mobile login pages that suppress visible URL context. The infrastructure screens victims and rejects personal emails to prioritize corporate identities and OAuth tokens across aerospace, technology, retail, finance, hospitality, manufacturing, and media.

Collectively, the likely objective is durable access to corporate identity: steal browser/session credentials on endpoints, phish OAuth grants and mobile logins, and mine AI/cloud control planes for secrets that bypass MFA and endpoint controls. Treat these pulses as one defensive problem: credential exposure + token replay + secrets discovery.

Threat Actor / Malware Profile

Dark Caracal / GoCaracal / Bandook / AsioGate

• Adversary: Dark Caracal, historically linked to cyberespionage and surveillance-style operations; current reporting indicates renewed tooling rather than a wholesale change in victimology.
• Distribution: The pulse does not disclose the initial vector; assume targeted intrusion tradecraft such as spear phishing, exposed services, valid-account abuse, or supply-chain/third-party access until local telemetry proves otherwise.
• Payload behavior: GoCaracal is described as modular, with a lightweight implant for access and payload delivery and an extended build for sustained collection including keylogging and browser credential theft. Bandook lineage implies remote administration, data theft, and long dwell time. AsioGate appears as an associated family/component in the same cluster.
• C2 communication: Listed IPv4s and .cloud/.icu domains should be treated as C2 or staging. The ethereum c2 fallback / blockchain infrastructure tags indicate defenders should not rely only on domain/IP blocking; monitor for uncommon DNS patterns, TLS to low-reputation domains, and application-layer traffic to blockchain RPC endpoints or wallet-related infrastructure where business use is absent.
• Persistence: Not specified in the pulse. For Go-based modular implants, hunt common Windows persistence: Run/RunOnce keys, scheduled tasks, services, WMI subscriptions, startup folder, and DLL search-order abuse; on Linux/macOS check systemd units, cron, LaunchAgents, profile.d, and SSH authorized_keys changes.
• Anti-analysis: Go binaries are often large, statically linked, packed/obfuscated, and stripped of easy indicators. Expect delayed execution, environment checks, encrypted configs, mutexes, and C2 fallback logic. Use memory hunting and behavior analytics rather than hash-only detection.

MCP / AI-Agent Secrets Abuse

• Distribution / access: Unauthenticated MCP servers exposed to the internet are being discovered and spoken to by automated clients. Active operators progressed from protocol negotiation to shell execution, file reads, and secrets-store lookup.
• Payload behavior: Post-exploitation is interactive and API-native: enumerate tools/resources, run shell commands, read sensitive files, query secrets stores, and test cloud credentials. Tags reference container escape, AWS Bedrock, llmjacking, credential theft, and model context protocol.
• Persistence: Expect persistence via legitimate agent configs, added MCP servers/tools, poisoned prompts, modified allowlists, cloud instance metadata credentials, container escape to host, or new service principals/API keys minted with stolen secrets.
• Anti-analysis: Activity can blend with normal automation. Baseline MCP endpoints, tool names, allowed commands, and service accounts; alert on deviations rather than generic shell execution.

RecruitTrap Recruitment Phishing

• Distribution: HR/recruiter impersonation using lookalike career domains for major brands. Mobile victims see full-screen counterfeit login flows; desktop uses Browser-in-the-Browser windows that fake trusted IdP chrome.
• Payload behavior: Credential harvesting and OAuth token capture/consent abuse. Victim screening rejects personal emails to keep enterprise credential quality high and reduce noise.
• C2 / infrastructure: Career-themed domains such as hbc-careers.com, fifahr-careers.com, mckinsey-careers.com, aa-careers.com, levis-careers.com, and expedia-careers.com should be treated as malicious or suspicious pending validation.
• Persistence: OAuth grants, refresh tokens, session cookies, malicious enterprise app consents, and mailbox forwarding rules can persist after password reset if tokens/grants are not revoked.
• Anti-analysis: Domain rotation, targeted allow/deny logic by email domain/device, and mobile-specific rendering to hide URL indicators.

IOC Analysis

The pulses contain three operationally useful indicator classes:

1. IPv4 C2 / infrastructure from the Dark Caracal pulse: 45.152.198.108, 176.124.220.153, 82.117.87.192, 82.117.87.138. Use for blocklists, retro-hunts, netflow enrichment, and TLS/JA3 clustering. Do not assume all traffic is malicious if an IP is shared hosting; validate with destination port, SNI, certificate, and process context.
2. Domains: Dark Caracal uses Spanish/business-lure domains (contabilidad.icu, documentodigital.cloud, getpdfdigital.cloud, soportedigital.cloud); RecruitTrap uses brand-career lookalikes (hbc-careers.com, fifahr-careers.com, mckinsey-careers.com, aa-careers.com, levis-careers.com, andmore-global.com, careers.com, expedia-careers.com). Note: careers.com may be legitimate in isolation; do not block solely on this string without corroborating telemetry, WHOIS age, cert, hosting, and lure context.
3. No file hashes were exposed in the provided sample, and one pulse restricts indicators. Shift to behavior-first detection: modular Go execution, browser credential access, keylogging artifacts, MCP tool invocation anomalies, secrets lookups, OAuth consent events, and mobile phishing redirects.

Operationalization guidance: add IOCs to EDR/network blocklists with confidence tags, expire low-confidence shared infrastructure, enrich with passive DNS and certificate transparency, and pivot by registrant/name server/ TLS certificate. Decode Go artifacts with strings, go-symbolizer/goresym, capa, YARA, and memory tools such as Volatility; inspect phishing with URL detonation, DNS telemetry, IdP sign-in logs, and OAuth app consent audit logs.

Detection Engineering

---
title: Dark Caracal GoCaracal Collection Build - Browser Credential and Keylogging Artifacts
id: 7f0d1a2e-7b0f-4d7d-9d2a-g0caracal01
status: experimental
description: Detects behaviors consistent with GoCaracal extended build reporting: suspicious unsigned Go-like process access to browser credential stores, keylogging artifacts, and outbound C2 to listed infrastructure.
author: Security Arsenal
references:
  - https://otx.alienvault.com/
  - https://arcticwolf.com/resources/blog/dark-caracal-reloaded-new-malware-same-hunting-grounds/
date: 2026/08/26
modified: 2026/08/26
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1056
  - attack.t1071
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
    CommandLine|contains:
      - 'Login Data'
      - 'Cookies'
      - 'Web Data'
      - 'keychain'
      - 'vault'
      - 'GetClipboard'
      - 'SetWindowsHookEx'
      - 'GetAsyncKeyState'
  selection_unsigned:
    SignatureStatus: 'unsigned'
  condition: selection_process and selection_unsigned
falsepositives:
  - Admin password managers
  - Software inventory tools
level: high
---
title: Suspicious MCP AI Agent Secrets Enumeration and Shell Execution
id: 9a1c2b3d-4e5f-46aa-8b7c-mcpsecrets01
status: experimental
description: Identifies process or container activity where MCP/agent tooling or shells enumerate secrets, environment variables, cloud metadata, or credential files after network API activity.
author: Security Arsenal
references:
  - https://beelzebub.ai/blog/it-thought-it-had-won/
date: 2026/08/26
modified: 2026/08/26
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1059
  - attack.t1611
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/node'
      - '/kubectl'
      - '/aws'
  selection_cmd:
    CommandLine|contains:
      - 'env'
      - 'printenv'
      - 'AWS_SECRET_ACCESS_KEY'
      - 'AWS_SESSION_TOKEN'
      - '169.254.169.254'
      - '/run/secrets'
      - 'kubernetes.io/serviceaccount'
      - 'id_rsa'
      - '.aws/credentials'
      - 'gcloud auth'
      - 'az account'
      - 'mcp'
      - 'bedrock'
  condition: selection_img and selection_cmd
falsepositives:
  - Developer workstations
  - CI/CD runners with approved secrets access
level: high
---
title: RecruitTrap OAuth Phishing Domain Resolution or Browser-in-the-Browser Lure
id: 4f5e6d7c-8b9a-40cd-a1b2-recruittrap01
status: experimental
description: Detects DNS/network access to recruitment-themed credential harvesting domains and suspicious browser command lines used to spawn isolated login windows.
author: Security Arsenal
references:
  - https://zimperium.com/blog/extended-rapid-response-zimperium-identifies-recruittrap-recruit-scams-are-targeting-enterprise-credentials-on-mobile
date: 2026/08/26
modified: 2026/08/26
tags:
  - attack.initial_access
  - attack.phishing
  - attack.t1566
  - attack.t1534
  - attack.credential_access
logsource:
  category: dns
  product: windows
detection:
  selection_dns:
    QueryName|contains:
      - 'hbc-careers.com'
      - 'fifahr-careers.com'
      - 'mckinsey-careers.com'
      - 'aa-careers.com'
      - 'levis-careers.com'
      - 'andmore-global.com'
      - 'expedia-careers.com'
      - '-careers.com'
  condition: selection_dns
falsepositives:
  - Legitimate recruiting sites with similar naming; verify brand ownership and certificate before enterprise-wide blocking
level: medium

let DarkCaracalIPs = dynamic(["45.152.198.108","176.124.220.153","82.117.87.192","82.117.87.138"]);
let SuspiciousDomains = dynamic(["contabilidad.icu","documentodigital.cloud","getpdfdigital.cloud","soportedigital.cloud","hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","andmore-global.com","expedia-careers.com"]);
let Lookback = 14d;
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated >= ago(Lookback)
 | where RemoteIP in~ (DarkCaracalIPs) or RemoteUrl has_any (SuspiciousDomains)
 | project TimeGenerated, DeviceName, InitiatingProcessName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, Protocol, ActionType, Source="DeviceNetworkEvents"),
(DeviceProcessEvents
 | where TimeGenerated >= ago(Lookback)
 | where ProcessCommandLine has_any ("Login Data","Web Data","Cookies","SetWindowsHookEx","GetAsyncKeyState","169.254.169.254","AWS_SECRET_ACCESS_KEY","/run/secrets",".aws/credentials","mcp","bedrock")
    or FileName in~ ("powershell.exe","pwsh.exe","rundll32.exe","regsvr32.exe","node","python","python3","kubectl","aws")
 | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessName, InitiatingProcessCommandLine, SHA256, Source="DeviceProcessEvents")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Events=count(), Devices=dcount(DeviceName) by DeviceName, InitiatingProcessName, FileName, RemoteIP, RemoteUrl, ProcessCommandLine, Source
| order by LastSeen desc;

$ErrorActionPreference = 'SilentlyContinue'
$iocIps = @('45.152.198.108','176.124.220.153','82.117.87.192','82.117.87.138')
$iocDomains = @('contabilidad.icu','documentodigital.cloud','getpdfdigital.cloud','soportedigital.cloud','hbc-careers.com','fifahr-careers.com','mckinsey-careers.com','aa-careers.com','levis-careers.com','andmore-global.com','expedia-careers.com')
Write-Host '[*] Checking active network connections for Dark Caracal IOC IPs...'
Get-NetTCPConnection | Where-Object { $iocIps -contains $_.RemoteAddress } | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess,@{n='Process';e={(Get-Process -Id $_.OwningProcess).ProcessName}}
Write-Host '[*] Checking DNS cache for pulse domains...'
Get-DnsClientCache | Where-Object { $d=$_.Entry; $iocDomains | ForEach-Object { if($d -like ('*'+$_+'*')){$true} } } | Select-Object Entry,RecordName,RecordType,Data
Write-Host '[*] Reviewing persistence locations commonly abused by modular implants...'
'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce','HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce' | ForEach-Object { Get-ItemProperty $_ | Select-Object PSPath,* }
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike '\Microsoft*' -and ($_.Actions.Execute -match 'powershell|pwsh|rundll32|regsvr32|wscript|cscript|node|python' -or $_.Actions.Arguments -match 'http|curl|encoded|frombase64') } | Select-Object TaskName,TaskPath,State,@{n='Action';e={($_.Actions.Execute+' '+$_.Actions.Arguments)}}
Write-Host '[*] Flagging recent browser credential store access windows (investigate processes with open handles)...'
$browserStores = @("$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data","$env:LOCALAPPDATA\Microsoft\Edge\User Data\Default\Login Data","$env:APPDATA\Mozilla\Firefox\Profiles")
foreach ($p in $browserStores) { if (Test-Path $p) { Get-Item $p | Select-Object FullName,LastWriteTime,LastAccessTime } }
Write-Host '[*] Checking MCP/AI developer secret paths and cloud cred files...'
@("$env:USERPROFILE\.aws\credentials","$env:USERPROFILE\.azure","$env:USERPROFILE\.config\gcloud","$env:USERPROFILE\.kube\config") | ForEach-Object { if(Test-Path $_){ Get-Item $_ | Select-Object FullName,LastWriteTime } }
Write-Host '[*] Done. Correlate any hit with EDR timeline, IdP sign-ins, OAuth grants, and proxy/DNS telemetry.'

Response Priorities

• Immediate: Block the listed IPs and high-confidence domains at DNS, proxy, firewall, and EDR network controls; add detections for GoCaracal collection behavior, MCP secrets enumeration, and career-domain phishing; isolate hosts with IOC contact or browser-store access by unsigned processes; preserve memory before reboot where Bandook/GoCaracal is suspected.
• 24h: Because credential and token theft is central, force password resets and revoke sessions/refresh tokens for affected users; audit OAuth app consents, enterprise applications, mailbox rules, MFA changes, and impossible-travel sign-ins; rotate exposed cloud keys, Kubernetes service account tokens, CI/CD secrets, and any credentials discoverable from MCP/agent hosts.
• 1 week: Harden architecture: require authn/authz and network egress controls for MCP servers, isolate AI agents in least-privilege sandboxes with no host metadata or broad secrets access, disable legacy email auth, enforce phishing-resistant MFA and conditional access, restrict browser credential access via EDR, implement brand-lookalike domain monitoring, and add mobile phishing guidance for recruiting workflows.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub