KarstoRAT, ClickFix, and Malicious AI Extensions: OTX Pulse Analysis — Credential Theft Surge

---
title: Potential KarstoRAT FodHelper UAC Bypass Activity
id: 4a8f9c2b-1d3e-4f5a-9b6c-7d8e9f0a1b2c
description: Detects the execution of fodhelper.exe with suspicious command line arguments or child processes often associated with KarstoRAT UAC bypass attempts.
status: experimental
date: 2026/05/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6623...
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - car.2019-04-001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\fodhelper.exe'
    filter:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection and not filter
falsepositives:
    - Legitimate use of fodhelper.exe for troubleshooting (rare)
level: high
---
title: Suspicious Finger.exe Execution (ClickFix Indicator)
id: 5b9g0d3c-2e4f-5g6b-0c7d-1e8f2g3h4i5j
description: Detects the execution of finger.exe spawning a shell or making network requests, typical of the ClickFix/BackgroundFix social engineering attack chain.
status: experimental
date: 2026/05/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6624...
tags:
    - attack.execution
    - attack.user_execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        Image|endswith: '\finger.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legacy network administration (very rare)
level: critical
---
title: Malicious Python Package Execution (TeamPCP)
id: 6c0h1e4d-3f5g-6h7c-1d8e-2f9g3h4i5j6k
description: Detects execution of python.exe loading suspicious DLLs or scripts associated with the TeamPCP supply chain attack on telnyx SDK.
status: experimental
date: 2026/05/05
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6625...
tags:
    - attack.initial_access
    - attack.supply_chain
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\python.exe'
        CommandLine|contains:
            - 'telnyx'
            - 'site-packages'
    condition: selection
falsepositives:
    - Legitimate developer usage of telnyx package (verify parent process)
level: medium


kql
// Hunt for ClickFix network activity and process execution
// Look for finger.exe and connections to known C2s
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "finger.exe" or ProcessCommandLine has "finger.exe") 
| where InitiatingProcessFileName !in ("explorer.exe", "services.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| union (DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "trindastal.com" or RemoteUrl has "poronto.com" or RemoteIP in ("212.227.65.132", "38.146.28.30", "24.152.36.241")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName)


powershell
# IOC Hunt Script for KarstoRAT Persistence and C2 Connections
# Requires Administrator privileges

Write-Host "Checking for KarstoRAT FodHelper Persistence..." -ForegroundColor Yellow

# Check registry for FodHelper bypass technique
$regPath = "HKCU:\Software\Classes\ms-settings\shell\open\command"
if (Test-Path $regPath) {
    $value = Get-ItemProperty -Path $regPath -Name "DelegateExecute" -ErrorAction SilentlyContinue
    $default = Get-ItemProperty -Path $regPath -Name "(default)" -ErrorAction SilentlyContinue
    if ($value -or $default) {
        Write-Host "[!] Potential FodHelper persistence found at $regPath" -ForegroundColor Red
        Get-Item -Path $regPath | Format-List *
    } else {
        Write-Host "[-] No FodHelper persistence detected." -ForegroundColor Green
    }
}

Write-Host "Checking for active connections to known C2 IPs..." -ForegroundColor Yellow

$maliciousIPs = @("212.227.65.132", "38.146.28.30", "24.152.36.241")
$connections = Get-NetTCPConnection -State Established, TimeWait -ErrorAction SilentlyContinue

foreach ($ip in $maliciousIPs) {
    $found = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($found) {
        Write-Host "[!] Active connection detected to $ip" -ForegroundColor Red
        $found | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
        $process = Get-Process -Id $found.OwningProcess -ErrorAction SilentlyContinue
        if ($process) { Write-Host "Process details:"; $process | Select-Object ProcessName, Path, StartTime }
    }
}

Write-Host "Hunt complete."