Infostealer Surge: Void Dokkaebi, Fox Tempest & PureLogs — OTX Pulse Analysis

---
title: Potential VS Code Task Persistence - Void Dokkaebi
id: 8a4b2c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
description: Detects modifications to .vscode/tasks. which may indicate a supply chain attack using malicious VS Code tasks.
status: experimental
date: 2026/05/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/void-dokkaebi
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|contains: '.vscode/tasks.'
    condition: selection
falsepositives:
    - Legitimate developer activity modifying build tasks
level: high
---
title: PowerShell Steganography Decoder - PureLogs/PawsRunner
id: 9b5c3d2e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
description: Detects PowerShell processes attempting to access image files combined with base64 decoding or stream operations, indicative of steganography loaders.
status: experimental
date: 2026/05/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/purelogs
tags:
    - attack.defense_evasion
    - attack.t1027
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        CommandLine|contains:
            - '.png'
            - '.jpg'
            - '.bmp'
    selection_ps:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_decode:
        CommandLine|contains:
            - 'FromBase64String'
            - 'System.Drawing.Bitmap'
            - 'System.IO.Stream'
    condition: all of selection_*
falsepositives:
    - Legitimate image processing scripts
level: high
---
title: Suspicious AppleScript Browser Access - macOS ClickFix
id: 0c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
description: Detects AppleScript (osascript) accessing browser cookie or history directories, typical of ClickFix infostealers on macOS.
status: experimental
date: 2026/05/21
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/clickfix-macos
tags:
    - attack.credential_access
    - attack.t1555.003
logsource:
    product: macos
    category: process_creation
detection:
    selection_osascript:
        Image|endswith: '/osascript'
    selection_browser_path:
        CommandLine|contains:
            - '/Library/Application Support/Google/Chrome'
            - '/Library/Application Support/Firefox'
            - '/Library/Safari'
    condition: all of selection_*
falsepositives:
    - User automation scripts managing browser data
level: high


**KQL (Microsoft Sentinel)**

kql
// Hunt for network connections to known malicious domains from pulses
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteUrl in ("bull-run.fun", "spot-wave.fun", "signspace.cloud", "everycarebd.com") 
    or RemoteHostname has "alexavegas.icu" or RemoteHostname has "needbinding.icu"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend TailoredIntel = "OTX Pulse Domain Hunt"


**PowerShell Hunt Script**

powershell
# IOC Hunter for Void Dokkaebi and PureLogs Pulse Hashes
$TargetHashes = @(
    "a12957e7627cb19fba2a4b155f7258b7", "e12285f507c847b986233991b86b22e3",
    "77b1beb083e4e2074402742ef2d677835072acf0e7ddd9ee8206e5a2c76b1ca5",
    "0fcb86ae384e9975933314ac2a231f0ff46c0208556bf4a16f096a642d3f505e"
)

Write-Host "Scanning for malicious file hashes..." -ForegroundColor Cyan

Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $hash) {
            Write-Host "[!] MATCH FOUND: $($_.FullName)" -ForegroundColor Red
        }
        $sha256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $sha256) {
            Write-Host "[!] MATCH FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }

# Check for suspicious VS Code tasks
$VSCodePath = "$env:APPDATA\Code\User"
if (Test-Path $VSCodePath) {
    Write-Host "Checking VS Code User Settings..." -ForegroundColor Cyan
    Get-ChildItem -Path $VSCodePath -Recurse -Filter "tasks." | ForEach-Object {
        Write-Host "[+] VS Code Tasks found: $($_.FullName)" -ForegroundColor Yellow
        # Manual review recommended for content
    }
}