KarstoRAT, LofyStealer & Malicious AI Extensions: OTX Pulse Analysis — Credential Theft & Supply Chain Threats

title: Potential KarstoRAT FodHelper UAC Bypass
id: 0e8c1f8c-1a2b-3c4d-5e6f-7a8b9c0d1e2f
description: Detects registry modification patterns associated with FodHelper.exe used for UAC bypass, often employed by KarstoRAT and similar malware.
status: experimental
author: Security Arsenal
date: 2026/05/04
references:
    - https://otx.alienvault.com/pulse/626f1e1b8f3a2c1b3c4d5e6f
tags:
    - attack.defense_evasion
    - attack.privilege_escalation
    - attack.t1548.002
logsource:
    product: windows
    registry:
        - create
        - set
detection:
    selection:
        TargetObject|contains: 'Software\Classes\ms-settings\Shell\Open\command'
        Details|contains: 'cmd.exe'
    condition: selection
falsepositives:
    - Administrative activity (rare)
level: high

---
title: ClickFix Campaign Suspicious Finger.exe Execution
id: 1f9a2e3b-4c5d-6e7f-8a9b-0c1d2e3f4a5b
description: Detects the execution of finger.exe with suspicious arguments or spawned by an unusual parent, associated with the ClickFix/BackgroundFix campaign.
status: experimental
author: Security Arsenal
date: 2026/05/04
references:
    - https://otx.alienvault.com/pulse/626f1e1b8f3a2c1b3c4d5e6g
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        Image|endswith: '\finger.exe'
        CommandLine|contains:
            - 'http'
            - 'powershell'
            - 'cmd'
    condition: selection
falsepositives:
    - Legitimate use of finger.exe (rare in modern environments)
level: high

---
title: Browser Credential Theft via Unusual Process Access
id: 2a0b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects processes like Node.js or Python accessing Chrome/Edge user data databases, indicative of LofyStealer or AI extension malware behavior.
status: experimental
author: Security Arsenal
date: 2026/05/04
references:
    - https://otx.alienvault.com/pulse/626f1e1b8f3a2c1b3c4d5e6h
tags:
    - attack.credential_access
    - attack.t1003
logsource:
    product: windows
    category: file_access
detection:
    selection:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\Default\'
            - '\Microsoft\Edge\User Data\Default\'
        TargetFilename|contains:
            - 'Cookies'
            - 'Login Data'
            - 'History'
    filter_main_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
    condition: selection and not 1 of filter_main_browsers*
falsepositives:
    - Third-party password managers
level: medium

// Hunt for ClickFix finger.exe activity and connections to known C2
let C2Domains = dynamic(["trindastal.com", "poronto.com", "brionter.com", "chatgptforchrome.com"]);
let C2IPs = dynamic(["212.227.65.132", "38.146.28.30", "24.152.36.241"]);
DeviceNetworkEvents
| where RemoteUrl in (C2Domains) or RemoteIP in (C2IPs)
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, InitiatingProcessFileName = InitiatingProcessFileName, RemoteUrl = RemoteUrl, RemoteIP = RemoteIP
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| union (
    DeviceProcessEvents
    | where FileName =~ "finger.exe"
    | extend Timestamp = TimeGenerated, DeviceName = DeviceName, ProcessCommandLine = ProcessCommandLine
    | project Timestamp, DeviceName, "FileName"=FileName, ProcessCommandLine
)

# IOC Hunt Script for KarstoRAT, LofyStealer, and ClickFix Components
# Requires Administrator privileges

$KnownHashes = @(
    "65229ef9d09e4cbfae326d41c517576cc2143c259fd764f259f3925fc8917c8b",
    "bde21d8be65d31e1c380f2daae2f73c79f3e1f4bca70fb990db6fdf6c3768c92",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881"
)

# Check File System
Write-Host "Checking for known malicious file hashes..."
Get-ChildItem -Path "C:\", "C:\Users" -Recurse -ErrorAction SilentlyContinue | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -in $KnownHashes) {
            Write-Host "WARNING: Malicious file found: $($_.FullName)" -ForegroundColor Red
        }
    }

# Check Registry for FodHelper Persistence (KarstoRAT technique)
Write-Host "Checking Registry for FodHelper UAC Bypass..."
$RegPath = "HKCU:\Software\Classes\ms-settings\Shell\Open\command"
if (Test-Path $RegPath) {
    Write-Host "WARNING: FodHelper persistence registry key detected." -ForegroundColor Red
    Get-Item $RegPath
}

# Check Network Connections for C2 IPs
$C2IPs = @("212.227.65.132", "38.146.28.30", "24.152.36.241")
Write-Host "Checking active network connections..."
Get-NetTCPConnection | 
    Where-Object { $C2IPs -contains $_.RemoteAddress } | 
    ForEach-Object {
        $Process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "WARNING: Connection to C2 IP detected: $($_.RemoteAddress) via $($Process.ProcessName)" -ForegroundColor Red
    }