KarstoRAT, ClickFix, and LofyStealer: 2026 Infostealer Surge — OTX Detection & Hunting Pack

---
title: Potential KarstoRAT UAC Bypass via FodHelper
id: 6c7b1d20-91a0-4f1e-8c2b-1234567890ab
description: Detects registry modification associated with FodHelper UAC bypass, often used by KarstoRAT for privilege escalation.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://www.levelblue.com/hubfs/Web/Library/Documents_pdf/TTR-Spotlight-Novel-KarstoRAT-Malware.pdf
tags:
    - attack.privilege_escalation
    - attack.t1548.002
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'Software\\Classes\\ms-settings\\shell\\open\\command'
        Details|contains: 'cmd.exe'
    condition: selection
falsepositives:
    - Unknown
level: critical
---
title: Suspicious ClickFix Activity via Finger.exe
id: d8e4c21a-55b3-4a9d-9c1e-9876543210ab
description: Detects the execution of finger.exe which is abused in ClickFix campaigns to download malicious payloads via clipboard commands.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://www.huntress.com/blog/clickfix-castleloader-backgroundfix
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\\finger.exe'
        CommandLine|contains: 
            - 'http'
            - 'powershell'
            - 'cmd'
    condition: selection
falsepositives:
    - Legitimate administrator usage of finger.exe (rare)
level: high
---
title: LofyStealer Node.js Loader Activity
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects Node.js processes initiating network connections, consistent with LofyStealer's Node.js loader communicating with C2.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://zenox.ai/en/lofystealer-malware-mirando-jogadores-de-minecraft
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    category: network_connection
detection:
    selection:
        Image|endswith: '\\node.exe'
        Initiated: 'true'
    filter:
        DestinationPort:
            - 80
            - 443
    condition: selection and not filter
falsepositives:
    - Legitimate Node.js development servers
level: medium


kql
// Hunt for ClickFix and KarstoRAT Network IOCs
// Look for connections to known C2 infrastructure and suspicious domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("212.227.65.132", "38.146.28.30", "24.152.36.241") 
   or RemoteUrl has_any ("trindastal.com", "poronto.com", "brionter.com", "aquasecurtiy.org", "chatgptforchrome.com")
| extend ThreatIntel = case(
    RemoteIP == "212.227.65.132", "KarstoRAT",
    RemoteIP == "38.146.28.30", "ClickFix/CastleLoader",
    RemoteIP == "24.152.36.241", "LofyStealer",
    RemoteUrl has "aquasecurtiy.org", "TeamPCP Supply Chain",
    RemoteUrl has "chatgptforchrome.com", "Malicious AI Extension",
    "Unknown"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ThreatIntel


powershell
# IOC Hunter Script: KarstoRAT, ClickFix, and LofyStealer Artifacts
# Requires Administrative Privileges

Write-Host "[+] Starting Dark Web IOC Hunt..." -ForegroundColor Cyan

# 1. Check for Active Network Connections to Malicious IPs
$maliciousIPs = @("212.227.65.132", "38.146.28.30", "24.152.36.241")
$activeConnections = Get-NetTCPConnection -State Established | 
    Where-Object { $maliciousIPs -contains $_.RemoteAddress }

if ($activeConnections) {
    Write-Host "[!] ALERT: Found active connections to known C2 IPs!" -ForegroundColor Red
    $activeConnections | Format-Table LocalAddress, RemoteAddress, State, OwningProcess -AutoSize
} else {
    Write-Host "[-] No active connections to C2 IPs found." -ForegroundColor Green
}

# 2. Check for Suspicious Processes (ClickFix vector: finger.exe)
$suspiciousProcesses = @("finger.exe")
$processList = Get-Process

foreach ($proc in $suspiciousProcesses) {
    $found = $processList | Where-Object { $_.ProcessName -eq $proc.Trim(".exe") }
    if ($found) {
        Write-Host "[!] ALERT: Suspicious process '$proc' detected (Potential ClickFix Activity)." -ForegroundColor Red
        $found | Select-Object Id, ProcessName, Path, StartTime
    }
}

# 3. Check for KarstoRAT UAC Bypass Registry Keys
$registryPath = "Registry::HKEY_CURRENT_USER\Software\Classes\ms-settings\shell\open\command"
if (Test-Path $registryPath) {
    Write-Host "[!] ALERT: FodHelper UAC Bypass Registry Key Detected (Potential KarstoRAT)." -ForegroundColor Red
    Get-Item $registryPath
} else {
    Write-Host "[-] No FodHelper bypass registry key found." -ForegroundColor Green
}

Write-Host "[+] Hunt Complete." -ForegroundColor Cyan