Infostealer Surge: ClickFix, LofyStealer, and GHOST STADIUM Targeting Global Infrastructure

---
title: Potential ClickFix CastleLoader Activity via Finger.exe
id: 348b172d-6a3e-4f4a-9e5a-5c8b7d6e5f4a
description: Detects the execution of finger.exe invoked by a script or browser, a technique used by ClickFix campaigns to retrieve CastleLoader payloads.
author: Security Arsenal
date: 2026/05/31
status: experimental
references:
    - https://otx.alienvault.com/pulse/667a1b2c3d4e5f6a7b8c9d0e
tags:
    - attack.initial_access
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\finger.exe'
    filter:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative use of finger.exe (rare)
level: high
---
title: Suspicious Node.js Loader Executing Native Payloads (LofyStealer)
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Detects Node.js processes spawning child processes like powershell or cmd, indicative of the LofyStealer Node.js loader executing the C++ payload stage.
author: Security Arsenal
date: 2026/05/31
status: experimental
references:
    - https://otx.alienvault.com/pulse/667a1b2c3d4e5f6a7b8c9d0f
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    parent:
        Image|endswith: '\node.exe'
    child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\regsvr32.exe'
    condition: parent and child
falsepositives:
    - Legitimate Node.js development scripts
level: medium
---
title: ClearFake Blockchain C2 Traffic Pattern
id: b2c3d4e5-f6a7-4b5c-9d0e-1f2a3b4c5d6e
description: Detects processes attempting to connect to BNB Smart Chain (BSC) RPC endpoints or specific blockchain testnet nodes, typical of smart contract C2 abuse like ClearFake.
author: Security Arsenal
date: 2026/05/31
status: experimental
references:
    - https://otx.alienvault.com/pulse/667a1b2c3d4e5f6a7b8c9d10
tags:
    - attack.command_and_control
    - attack.c2
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort:
            - 8545
            - 443
        Initiated: 'true'
    filter_bsc:
        DestinationHostname|contains:
            - 'bsc-testnet'
            - 'binance.org'
            - 'rpc'
    filter_legit:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: selection and filter_bsc and not filter_legit
falsepositives:
    - Legitimate crypto wallets or dApp browsers
level: high


kql
// Hunt for Ghost Stadium and ClickFix Network Indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "fifa.gold", "fifa.black", "fifa.tax", "fifaweb.com", 
    "trindastal.com", "poronto.com", "giovettiadv.com",
    "login.teamicrosoft.com", "live.ong", "driver-updater.net"
)
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemotePort, RemoteIP
| order by Timestamp desc

// Hunt for LofyStealer and JINX-0164 Process Execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (ProcessCommandLine contains "finger.exe" or InitiatingProcessFileName =~ "node.exe")
| where (ProcessVersionInfoOriginalFileName =~ "node.exe" or ProcessVersionInfoInternalFileName =~ "node")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


powershell
# IOC Hunt Script for Infostealer Campaigns
# Usage: Run as Administrator

Write-Host "[*] Starting Hunt for Infostealer Artifacts..." -ForegroundColor Cyan

# 1. Check for LofyStealer / Node.js Loader Artifacts
Write-Host "[*] Checking for suspicious Node.js processes..." -ForegroundColor Yellow
$nodeProcs = Get-WmiObject Win32_Process | Where-Object { $_.Name -eq "node.exe" -and $_.CommandLine -like "*chromelevator*" -or $_.CommandLine -like "*lofy*" }
if ($nodeProcs) {
    Write-Host "[!] Suspicious Node.js process found!" -ForegroundColor Red
    $nodeProcs | Select-Object ProcessId, CommandLine
} else {
    Write-Host "[-] No suspicious Node.js processes detected." -ForegroundColor Green
}

# 2. Scan for CastleStealer / ClickFix File Hashes (Mockup for specific hashes)
Write-Host "[*] Scanning for ClickFix/CastleLoader Hashes..." -ForegroundColor Yellow
$maliciousHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7"
)

# Check common download directories
$paths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:APPDATA")
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $maliciousHashes) {
                Write-Host "[!] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 3. Check DNS Cache for Ghost Stadium Domains
Write-Host "[*] Checking DNS Cache for Phishing Domains..." -ForegroundColor Yellow
$phishingDomains = @("fifa.gold", "fifa.black", "faweb.com", "login.teamicrosoft.com")
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($domain in $phishingDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$domain*" }
    if ($hit) {
        Write-Host "[!] Phishing domain resolution found: $($domain) -> $($hit.Data)" -ForegroundColor Red
    }
}

Write-Host "[*] Hunt Complete." -ForegroundColor Cyan