KeyHunter LLM API Theft + Claude Code SSH Backdoor + Fake-Takedown Bank Phishing: OTX Pulse Analysis — Enterprise Detection Pack

These three OTX pulses collectively describe a credential-theft-heavy threat landscape in which attackers are monetizing identity material across cloud, developer tooling, and consumer banking channels.

First, the “KeyHunter” operation attributed to the actor leepsmarts focuses on harvesting exposed LLM and SaaS credentials from misconfigured deployments on platforms like Vercel, Netlify, and Railway, then using those keys for fraud, spam infrastructure, or resale. The same actor is also running academic fraud against universities, indicating a dual revenue model: stolen cloud/AI capacity plus social engineering against education and finance workflows. The presence of CVE-2026-41940 in the indicators suggests at least one exploitation path into internet-facing services that expose secrets in build logs, environment variables, or CI/CD artifacts.

Second, Microsoft’s research into a trojanized Claude Code extension for the Cursor marketplace shows a supply-chain-style intrusion against developer workstations. The malicious extension drops JavaScript that runs during module load, performs host recon, and establishes a persistent SSH reverse tunnel on macOS using LaunchAgents. This gives operators durable remote access to engineer laptops—exactly where source code, cloud tokens, signing keys, and AI API credentials live.

Third, KELA’s reporting on a large-scale bank-phishing network shows attackers operating 248 live look-alike domains impersonating 189 US financial institutions. The campaign uses urgency-themed domain names and a cloaking trick: returning visitors see a fake “account suspended” or takedown-style page, while new visitors are served the real credential-harvesting site. That helps the operation evade scanners, brand-protection takedowns, and analyst review.

The common objective across all three pulses is credential and access theft with clear monetization paths: cloud and LLM API keys for compute and fraud, developer-machine access for deeper compromise, and banking credentials for direct financial theft.

Threat Actor / Malware Profile

KeyHunter / leepsmarts (LLM & cloud credential theft)

• Distribution / access vector: Scanning and exploitation of misconfigured cloud deployments and public code/CI artifacts; possible exploitation of CVE-2026-41940 on exposed services.
• Payload behavior: Automated collection of environment variables, config files, and deployment metadata to extract API keys for LLM providers and SaaS platforms; validation of keys and tagging of working credentials.
• C2 / infrastructure: Use of attacker-controlled VPS and Telegram bots for tasking and exfil; infrastructure observed across multiple countries, consistent with bulletproof hosting and fast flux.
• Persistence: Not host-persistent; relies on continuous scanning, credential reuse, and access to cloud tenants rather than endpoint implants.
• Anti-analysis: Heavy use of legitimate cloud platforms, Telegram for C2, and short-lived credentials to blend into normal traffic.

Malicious Claude Code Cursor extension (macOS SSH backdoor)

• Distribution: Trojanized extension anthropic.claude-code versions 2.1.313 and 2.1.312 distributed through the Cursor extension marketplace during a limited time window.
• Payload behavior: Injected JavaScript runs at module load to execute shell commands, gather host and network recon, and pull down second-stage tooling. Microsoft tracks components as Trojan:JS/CredTheft.MS!MTB, Trojan:MacOS/SmtShellMal.A, Trojan:MacOS/MalPlistSysmond.A, and HackTool:MacOS/RevAnthShell.A.
• C2 communication: Reverse SSH tunnel from the victim to attacker infrastructure, enabling interactive shell access and data theft while bypassing many egress controls that allow outbound SSH.
• Persistence: Installs a LaunchAgent plist under the user’s Library to re-establish the tunnel at login, masquerading with system-sounding names such as “sysmond”.
• Anti-analysis: Short distribution window, abuse of a trusted IDE marketplace, use of built-in macOS utilities (ssh, launchd), and naming that mimics legitimate daemons.

Bank-phishing network (fake-takedown cloaking)

• Distribution: 248 look-alike domains using patterns like authorize-<bank>.com, protect-<bank>.com, and urgency terms such as “primaryset”.
• Payload behavior: Credential-harvesting pages that mimic business banking and treasury portals for 189 US financial institutions.
• C2 / infrastructure: Phishing kit backends that capture credentials and likely MFA/session tokens for resale or direct account takeover.
• Persistence: Domain rotation and rapid re-registration; infrastructure survives partial takedowns.
• Anti-analysis: Cloaking logic that shows a fake “account suspended” or seized page to repeat visitors, security scanners, and takedown vendors, while serving live phishing content to fresh targets.

IOC Analysis

This pulse set contains four primary indicator types, each operationalized differently:

• IPv4 addresses (KeyHunter): 14.47.118.194, 190.114.197.2, 46.39.24.98 are likely scanning, exploitation, or C2 nodes. SOC teams should add them to egress blocklists, alert on any outbound connection, and retro-hunt proxy/firewall/VPN logs for at least 30 days.
• Domains (phishing + bot infra): 53primaryset.com, authorize-valley.com, commercial-atfirst.com, protect-pinnaclefp.com, and juanwangccbotgithubgithub.com should be blocked at DNS and secure web gateway. Because phishing domains rotate quickly, pattern-based detections (urgency keywords + bank names) are as important as exact-match IOCs.
• File hashes (Claude Code backdoor): SHA256 7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278, ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15, MD5 f49bcd657ef1e626e85ce858958c1769, SHA1 7d52fa561468f0c77bca112f8393399dec078d02 should be swept across endpoints via EDR/MDE and blocked in application control.
• CVE (CVE-2026-41940): Treat as an exploitation signal. Identify internet-facing assets running the affected software and prioritize patching or virtual patching at the WAF.

Operational guidance: load indicators into your TI platform, push IPs/domains to DNS and proxy controls, hashes to EDR, and use the queries below for behavior-based hunting so detection survives IOC rotation.

Detection Engineering

---
title: KeyHunter Cloud Credential Access and Exfiltration
id: 6f2c1f3a-6b7a-4b5f-9c6a-3d2f8a1c9e10
status: experimental
description: Detects suspicious access to cloud environment variables and LLM API keys followed by egress to known KeyHunter infrastructure, consistent with leepsmarts credential-harvesting activity.
author: Security Arsenal
references:
  - https://socradar.io/blog/keyhunter-operation-harvard-alumni-stanford-llm-key-data/
date: 2026/11/04
logsource:
  category: process_creation
  product: linux
  service: auditd
detection:
  selection_env_access:
    CommandLine|contains:
      - 'printenv'
      - '/proc/self/environ'
      - '.env'
      - 'OPENAI_API_KEY'
      - 'ANTHROPIC_API_KEY'
      - 'AWS_SECRET_ACCESS_KEY'
      - 'VERCEL_TOKEN'
      - 'NETLIFY_AUTH_TOKEN'
  selection_egress:
    DestinationIP:
      - '14.47.118.194'
      - '190.114.197.2'
      - '46.39.24.98'
  condition: selection_env_access and selection_egress
falsepositives:
  - Legitimate developer debugging of environment configuration.
level: high
tags:
  - attack.credential_access
  - attack.t1552
  - attack.exfiltration
---
title: Malicious Claude Code Extension LaunchAgent SSH Persistence
id: 7b3a9d21-5f6c-4c2d-9e7b-1a2c3d4e5f60
status: experimental
description: Detects creation of macOS LaunchAgent plists and subsequent SSH reverse-tunnel execution associated with the trojanized Claude Code Cursor extension and HackTool:MacOS/RevAnthShell.A.
author: Security Arsenal
references:
  - https://www.microsoft.com/en-us/security/blog/2026/10/30/inside-malicious-claude-code-branded-cursor-extension-persistent-ssh-backdoor/
date: 2026/11/04
logsource:
  category: file_event
  product: macos
detection:
  selection_launchagent_path:
    TargetFilename|contains:
      - '/Library/LaunchAgents/'
      - 'com.apple.sysmond.plist'
      - 'sysmond'
  selection_ssh_execution:
    CommandLine|contains:
      - 'ssh -R'
      - 'ssh -N -R'
      - '-o ServerAliveInterval'
  condition: selection_launchagent_path and selection_ssh_execution
falsepositives:
  - Legitimate remote-support tooling using reverse SSH tunnels.
level: critical
tags:
  - attack.persistence
  - attack.t1543.001
  - attack.command_and_control
  - attack.t1071.001
---
title: Bank Phishing Look-Alike Domain Access
id: 8c4d5e6f-7a8b-4c9d-0e1f-2a3b4c5d6e70
status: experimental
description: Identifies DNS or web access to look-alike banking domains using urgency keywords and bank-name patterns observed in the fake-takedown phishing network.
author: Security Arsenal
references:
  - https://www.kelacyber.com/blog/bank-phishing-campaign-fake-takedown/
date: 2026/11/04
logsource:
  category: dns
detection:
  selection_domains:
    query|contains:
      - '53primaryset.com'
      - 'authorize-valley.com'
      - 'commercial-atfirst.com'
      - 'protect-pinnaclefp.com'
  selection_patterns:
    query|contains:
      - 'authorize-'
      - 'protect-'
      - 'verify-'
      - 'secure-'
      - 'primaryset'
  condition: selection_domains or selection_patterns
falsepositives:
  - Legitimate financial-service subdomains using similar branding.
level: medium
tags:
  - attack.initial_access
  - attack.t1566
  - attack.credential_access

// Hunt for KeyHunter egress, Claude Code SSH backdoor behavior, and phishing domain access
let KeyHunterIPs = dynamic(["14.47.118.194","190.114.197.2","46.39.24.98"]);
let PhishDomains = dynamic(["53primaryset.com","authorize-valley.com","commercial-atfirst.com","protect-pinnaclefp.com","juanwangccbotgithubgithub.com"]);
union isfuzzy=true
(
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteIP in (KeyHunterIPs) or RemoteUrl has_any (PhishDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
),
(
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any ("ssh -R","ssh -N -R","ServerAliveInterval")
       or ProcessCommandLine has_any ("printenv","/proc/self/environ",".env","OPENAI_API_KEY","ANTHROPIC_API_KEY","VERCEL_TOKEN","NETLIFY_AUTH_TOKEN")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, SHA256
),
(
    DeviceFileEvents
    | where TimeGenerated > ago(14d)
    | where FolderPath has "LaunchAgents" and (FileName has "sysmond" or FileName endswith ".plist")
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName
)
| order by TimeGenerated desc

# KeyHunter + Claude Code backdoor + phishing IOC hunt
$KeyHunterIPs = @("14.47.118.194","190.114.197.2","46.39.24.98")
$PhishDomains = @("53primaryset.com","authorize-valley.com","commercial-atfirst.com","protect-pinnaclefp.com","juanwangccbotgithubgithub.com")
$BadHashes = @("7e0a52885fadee05544a9e99eb18c792bec05900a5e1a66d68f8383decb0e278","ecb58cb29078d9646ad1dcdbe51526f2d9cfea06be5fb2ab183e8ecc3ab6bf15","f49bcd657ef1e626e85ce858958c1769","7d52fa561468f0c77bca112f8393399dec078d02")

Write-Host "=== Active network connections to KeyHunter infrastructure ==="
Get-NetTCPConnection | Where-Object { $KeyHunterIPs -contains $_.RemoteAddress } |
  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess |
  Format-Table -AutoSize

Write-Host "=== DNS cache entries for phishing / bot domains ==="
Get-DnsClientCache | Where-Object { $d = $_.Entry; $PhishDomains | ForEach-Object { $d -like "*$_*" } } |
  Select-Object Entry,Data,TimeToLive | Format-Table -AutoSize

Write-Host "=== Suspicious SSH reverse tunnels ==="
Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -match "ssh .*-R" } |
  Select-Object ProcessId,Name,CommandLine | Format-List

Write-Host "=== File hash sweep in common dev directories ==="
$paths = @("$env:USERPROFILE\Downloads","$env:USERPROFILE\.cursor","$env:USERPROFILE\.vscode")
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      $h = Get-FileHash $_.FullName -ErrorAction SilentlyContinue
      if ($BadHashes -contains $h.Hash) {
        Write-Host "MALICIOUS FILE FOUND: $($_.FullName)  Hash: $($h.Hash)"
      }
    }
  }
}

Write-Host "=== macOS LaunchAgent check (run on Mac endpoints via bash) ==="
Write-Host "ls ~/Library/LaunchAgents | grep -i sysmond ; launchctl list | grep -i sysmond"

Response Priorities

Immediate (0–24 hours)

• Block the KeyHunter IPs (14.47.118.194, 190.114.197.2, 46.39.24.98) and all listed phishing/bot domains at DNS, proxy, and egress firewalls.
• Push the four file hashes to EDR/MDE block lists and sweep developer workstations for the trojanized Claude Code extension versions 2.1.313 and 2.1.312.
• Hunt for LaunchAgent persistence (~/Library/LaunchAgents/*sysmond*) and active SSH reverse tunnels on macOS endpoints.
• Inventory cloud deployments on Vercel, Netlify, and Railway for exposed environment variables or CI logs containing LLM/SaaS API keys.

Within 24 hours

• Because multiple campaigns are credential-stealing, force rotation of any LLM, cloud, or SaaS keys found in code repos, build systems, or developer machines.
• Require identity verification and MFA re-registration for users who may have entered credentials on phishing sites; reset sessions for affected banking or treasury portal users.
• Review sign-in logs for impossible travel, new device enrollments, and OAuth grants tied to exposed keys.

Within 1 week

• Harden CI/CD pipelines: secret scanning, masked environment variables, and block on commit of API keys.
• Restrict outbound SSH from endpoints except through approved jump hosts; alert on new LaunchAgents on macOS.
• Implement DMARC/brand-monitoring and automated takedown workflows for look-alike domains; educate treasury and finance staff on the fake-takedown cloaking technique.
• Patch or mitigate systems affected by CVE-2026-41940 and validate WAF rules for the associated exploitation pattern.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub