Hades Implant, AMOS Stealer, and CI/CD Abuse: OTX Pulse Analysis — Credential Theft Campaign | Security Arsenal

Threat Summary

Recent OTX pulses indicate a surge in sophisticated credential theft operations leveraging emerging technologies and supply chain vectors. The primary threats identified include the deployment of the Hades implant via the Hermes AI agent targeting government infrastructure, the distribution of AMOS and ClawHavoc infostealers through the compromised OpenClaw AI marketplace, and large-scale abuse of GitHub Actions to compromise cPanel/WHM environments. Collectively, these campaigns aim to steal sensitive credentials, harvest CRM data, and establish persistence in enterprise environments by exploiting trusted relationships and CI/CD pipelines.

Threat Actor / Malware Profile

Hades Implant (via Hermes AI)

Distribution: Delivered via autonomous AI agents exploiting Apache Hadoop HiveServer2 vulnerabilities (CVE-2026-43500).
Behavior: Custom Go-based implant operating autonomously. Drops webshells (VShell) and credential dumps.
C2: Communicates with Hong Kong-based infrastructure (e.g., 43.246.208.207).
Persistence: Utilizes ShadowPad and scheduled tasks via exploited services.

AMOS & ClawHavoc (OpenClaw Supply Chain)

Distribution: Malicious "skills" uploaded to the OpenClaw (ClawHub) marketplace, evading VirusTotal via file padding.
Behavior: macOS-focused infostealers targeting Keychain, browser cookies, and cryptocurrency wallets.
C2: Communications with domains like laosji.net.
Persistence: Uses LaunchAgents and background scripts disguised as legitimate AI agent processes.

IOC Analysis

IP Addresses: Key infrastructure includes 43.246.208.207 (Hong Kong) and 43.228.157.68 (GitHub Actions C2). SOC teams should block these immediately and query firewall logs for any historical allowed traffic.
File Hashes: Multiple SHA256 hashes associated with AMOS and ClawHavoc payloads. Operationalize these in EDR solutions for immediate quarantine.
Domains: laosji.net and baccarat.com.au (linked to the LastPass/Klue incident) should be added to DNS sinkholes.
CVEs: Exploitation focus on CVE-2026-43500 (Hadoop), CVE-2026-41940 (cPanel), and legacy vulnerabilities like CVE-2017-7269.

Detection Engineering

YAML

---
title: Hades Implant Hadoop Exploitation Activity
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects potential exploitation of Apache Hadoop HiveServer2 and execution of Hades implant binaries.
status: experimental
date: 2026/07/24
author: Security Arsenal
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        ParentImage|endswith: '/java'
        Image|endswith:
            - '/hadoop'
            - '/hive'
            - '/beeline'
    condition: selection
falsepositives:
    - Legitimate administration tasks
level: high
tags:
    - attack.credential_access
    - attack.t1059
---
title: GitHub Actions Runner C2 Communication
id: b2c3d4e5-6789-01ab-cdef-234567890abc
description: Detects GitHub Actions runners connecting to known suspicious C2 infrastructure or downloading non-standard payloads.
status: experimental
date: 2026/07/24
author: Security Arsenal
logsource:
    category: network_connection
    product: linux
detection:
    selection_ip:
        DestinationIp:
            - '43.228.157.68'
    selection_domain:
        DestinationDomain|contains:
            - 'glot.io'
    condition: 1 of selection*
falsepositives:
    - Legitimate developer tool usage
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: macOS AMOS Infostealer Execution
id: c3d4e5f6-7890-12bc-def0-345678901bcd
description: Detects execution patterns associated with AMOS infostealer delivered via malicious AI skills.
status: experimental
date: 2026/07/24
author: Security Arsenal
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith:
            - '/osascript'
            - '/curl'
        CommandLine|contains:
            - 'Library/Application Support'
            - 'LaunchAgents'
    condition: selection
falsepositives:
    - Legitimate software installation
level: high
tags:
    - attack.credential_access
    - attack.t1556


kql
// Hunt for IOC Network Connections and suspicious process execution
DeviceNetworkEvents
| where RemoteIP in ("43.246.208.207", "43.228.157.68")
   or RemoteUrl has "laosji.net"
   or RemoteUrl has "baccarat.com.au"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
| union (
    DeviceProcessEvents
    | where InitiatingProcessFileName in ("hadoop", "hive", "beeline") 
       or ProcessCommandLine has "CVE-2026-43500"
)


powershell
# IOC Hunter for File Hashes and Registry Artifacts
$maliciousHashes = @(
    "818aea6143282b352fdfdc0f3ebf77a36e54eb3befb5cad1a355a99ab97c6aa7",
    "881ce5cb124c4d2e814783724cc1388f6a1cbf6eee274c3f3366e77ba3503ad7",
    "b30eaed1f7478c28f4ec50d07ed5ef014ffbc4b2bc5a38d689ba9f7abb5e19c2",
    "b6c7e0bf573b1c7d9d3a05eb08d26579199515b847df984862805f44a7af8007",
    "ebb73dbb5aac1f6fe1a88e8f26126a1e1aa34c9f3345ad4345189b40d9bf1d1d",
    "f4e41aa269c88bf11a2022701a9cf41e9a186aa1b224d837c31bf34e0b875d0e"
)

Write-Host "Scanning for malicious file hashes..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 | Where-Object { $maliciousHashes -contains $_.Hash } | Select-Object Path, Hash

Write-Host "Checking for suspicious Hadoop/Hive processes..."
Get-Process | Where-Object { $_.ProcessName -like "*hadoop*" -or $_.ProcessName -like "*hive*" } | Select-Object ProcessName, Id, Path

Response Priorities

Immediate:

Block all IOCs (IPs 43.246.208.207, 43.228.157.68; domain laosji.net) at perimeter firewalls and proxies.
Scan endpoints for the specific SHA256 hashes associated with AMOS and ClawHavoc.
Isolate any GitHub Actions runners showing outbound connectivity to non-GitHub IPs.

Within 24 Hours:

Initiate credential resets for accounts with access to Salesforce, Gong, or LastPass environments, referencing the Klue/LastPass supply chain incident.
Audit Hadoop and cPanel instances for signs of CVE-2026-43500 and CVE-2026-41940 exploitation.
Review OAuth token grants for third-party applications (specifically market intelligence platforms).

Within 1 Week:

Implement strict allow-listing for GitHub Actions runner outbound traffic.
Harden CI/CD pipelines by requiring signed commits and branch protection rules.
Update phishing awareness training to include QR code phishing and AiTM (Adversary-in-the-Middle) tactics observed in Q2 trends.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Hades Implant, AMOS Stealer, and CI/CD Abuse: OTX Pulse Analysis — Credential Theft Campaign