KarstoRAT, ClickFix & LofyStealer: Multi-Vector Credential Theft Campaigns — OTX Pulse Analysis

title: KarstoRAT FodHelper UAC Bypass and Execution
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects KarstoRAT utilizing FodHelper.exe to bypass UAC, often followed by suspicious network activity to known C2 infrastructure.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/65229ef9d09e4cbfae326d41c517576c
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - car.2019-04-001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\cmd.exe'
        Image|endswith: '\fodhelper.exe'
    condition: selection
falsepositives:
    - Legitimate administrative usage
level: high
---
title: ClickFix Campaign Fake Image Tool and Finger.exe Abuse
id: b2c3d4e5-6789-01bc-def2-3456789012bc
description: Detects the ClickFix social engineering pattern where a fake tool copies commands to the clipboard invoking finger.exe to fetch payloads.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/bde21d8be65d31e1c380f2daae2f73c7
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\finger.exe'
    selection_cli:
        CommandLine|contains: 'http'
    filter_legit:
        ParentImage|contains: 'System32'
    condition: selection_img and selection_cli and not filter_legit
falsepositives:
    - Rare legitimate finger usage over HTTP
level: critical
---
title: LofyStealer Node.js Loader Spawning Suspicious Child Processes
id: c3d4e5f6-7890-12cd-ef34-5678901234cd
description: Detects the LofyStealer Node.js loader spawning native Windows processes (powershell, cmd) indicative of post-exploitation activity.
status: experimental
date: 2026/05/06
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/293006cec43c663ccff331795d662c3b
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\node.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
    filter_legit_dev:
        CommandLine|contains: 'npm' or ParentCommandLine|contains: 'vscode'
    condition: selection_parent and selection_child and not filter_legit_dev
falsepositives:
    - Legitimate Node.js development scripts
level: medium

// Hunt for ClickFix C2 domains and KarstoRAT IP connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("trindastal.com", "poronto.com", "brionter.com", "chatgptforchrome.com", "aquasecurtiy.org") 
   or RemoteIP in ("212.227.65.132", "38.146.28.30", "24.152.36.241")
| extend FullURL = strcat(RemoteUrl, ":", RemotePort)
| summarize Count = count(), LastSeen = max(Timestamp) by DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, ActionType
| order by Count desc

<#
.SYNOPSIS
    Hunt script for KarstoRAT, ClickFix, and LofyStealer IOCs.
.DESCRIPTION
    Checks for the presence of suspicious file hashes, domains in hosts file, 
    and registry modifications associated with recent OTX pulses.
#>

$TargetHashes = @(
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881"
)

$SuspiciousDomains = @(
    "trindastal.com", "poronto.com", "brionter.com", 
    "aquasecurtiy.org", "chatgptforchrome.com"
)

Write-Host "[+] Checking Hosts file for suspicious domains..."
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $SuspiciousDomains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] ALERT: Found $Domain in hosts file." -ForegroundColor Red
        }
    }
}

Write-Host "[+] Scanning for recently modified malicious hashes (User Temp & AppData)..."
$PathsToScan = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.Length -gt 0kb -and $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | 
        ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for FodHelper persistence (KarstoRAT)..."
$RegPath = "HKCU:\Software\Classes\ms-settings\shell\open\command"
if (Test-Path $RegPath) {
    Write-Host "[!] ALERT: FodHelper registry key detected. Potential UAC bypass." -ForegroundColor Red
    Get-ItemProperty $RegPath
}