Infostealer Surge: ClickFix, Lumma, and JINX-0164 Targeting Crypto & Enterprise — OTX Pulse Analysis

---
title: Potential ClickFix BackgroundFix Activity via Finger.EXE
id: 4a7b8c9d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
description: Detects the execution of finger.exe spawning a shell or downloading content, a specific behavior associated with the ClickFix campaign delivering CastleLoader.
status: experimental
author: Security Arsenal
date: 2026/06/01
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_finger:
    Image|endswith: '\finger.exe'
  selection_spawn:
    ParentImage|endswith: '\finger.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\curl.exe'
  condition: 1 of selection*
falsepositives:
  - Legitimate use of finger.exe (rare in modern environments)
level: high
---
title: Potential LofyStealer Node.js Loader Activity
id: 5b8c9d0e-2f3g-4b5c-6d7e-8f9a0b1c2d3e
description: Detects Node.js processes spawning command shells or PowerShell, characteristic of the LofyStealer Node.js loader initiating the C++ payload.
status: experimental
author: Security Arsenal
date: 2026/06/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\node.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\cscript.exe'
  filter_legit:
    CommandLine|contains:
      - 'npm'
      - 'node_modules'
      - 'yarn'
  condition: selection_parent and selection_child and not filter_legit
falsepositives:
  - Legitimate development scripts running npm builds
level: medium
---
title: ClearFake EtherHiding Network Activity
id: 6c9d0e1f-3g4h-5c6d-7e8f-9a0b1c2d3e4f
description: Detects browser processes connecting to high-numbered ports or known BSC Testnet infrastructure, indicative of smart contract-based C2 communication used by ClearFake.
status: experimental
author: Security Arsenal
date: 2026/06/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  selection_ports:
    DestinationPort:
      - 688
      - 8545
  selection_suspicious_ips:
    DestinationIp|startswith:
      - '148.178.'
      - '89.36.'
  condition: selection_browsers and 1 of selection_*
falsepositives:
  - Users interacting with legitimate Web3 dApps
level: medium


kql
// Hunt for ClickFix and JINX-0164 Indicators
// Focus on Finger.exe abuse and file hash presence
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("finger.exe", "install.sh") or ProcessCommandLine contains "finger.exe"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine, FolderPath
| extend SuspiciousActivity = iff(FileName == "finger.exe", "Potential ClickFix", "Unknown")

// Hunt for specific IOCs from Ghost Stadium and LofyStealer
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92", 
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7"
)
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, AdditionalFields

// Hunt for network connections to non-standard ports used by ClickFix
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (688, 8545)
| summarize Count() by DeviceName, RemoteUrl, RemotePort, InitiatingProcessFileName


powershell
# PowerShell IOC Hunt Script for ClickFix and LofyStealer
# Requires Admin privileges for full file system scan

$MaliciousHashes = @(
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "ed391a16389234f9ebb6727711baaf3e068d7f77c465708fa3e8b7d0565d7fb9",
    "f5dbaa09e60343f252a80d4a313a36ac11442d96b0896022d1a83744e3c11feb",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881"
)

Write-Host "[+] Scanning for ClickFix Finger.exe processes..." -ForegroundColor Cyan
$FingerProc = Get-Process -Name "finger" -ErrorAction SilentlyContinue
if ($FingerProc) {
    Write-Host "[ALERT] Finger.exe process found! PID: $($FingerProc.Id)" -ForegroundColor Red
    $FingerProc | Select-Object ProcessName, Id, Path, StartTime
} else {
    Write-Host "[-] No finger.exe processes detected." -ForegroundColor Green
}

Write-Host "[+] Scanning user directories for known malicious hashes..." -ForegroundColor Cyan
$PathsToScan = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($MaliciousHashes -contains $FileHash) {
                Write-Host "[ALERT] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for suspicious Node.js parent processes..." -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1000 -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'ParentProcessName.*node\.exe' -and $_.Message -match 'NewProcessName.*(cmd|powershell)\.exe' } |
    Select-Object TimeCreated, Message | Format-List