LofyStealer & JINX-0164 Campaigns: OTX Pulse Analysis — Node.js & macOS Supply Chain Threats

title: Potential LofyStealer Node.js Loader Execution
description: Detects the execution of a Node.js process with a command line argument pattern consistent with LofyStealer's large loader or staging behavior.
status: experimental
date: 2026/05/29
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6537e9f67c6c6
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\node.exe'
        CommandLine|contains: 'lofy' # Social engineering lure often in filename
    condition: selection
falsepositives:
    - Legitimate Node.js development (low FP due to specific lure)
level: critical
tags:
    - attack.execution
    - attack.t1059.001
    - lofystealer
    - infostealer
---
title: JINX-0164 macOS Malware C2 Communication
description: Detects network connections from a macOS host to known JINX-0164 C2 infrastructure or download servers.
status: experimental
date: 2026/05/28
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6537e9f67c6c7
logsource:
    category: network_connection
    product: macos
detection:
    selection_host:
        DestinationHostname|endswith:
            - '.live.us.org'
            - 'driver-updater.net'
    selection_ip:
        DestinationIp: '89.36.224.5'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - jinx-0164
    - macos-malware
---
title: GHOST STADIUM Phishing Domain Access
description: Detects DNS queries or HTTP requests to domains associated with the GHOST STADIUM FIFA World Cup phishing campaign.
status: experimental
date: 2026/05/27
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6537e9f67c6c8
logsource:
    category: dns
    product: zeek
detection:
    selection:
        query|contains:
            - 'fifa.gold'
            - 'fifa.black'
            - 'fifa.tax'
            - 'fifaweb.com'
            - 'fifa.red'
            - 'fifa.fund'
    condition: selection
falsepositives:
    - Legitimate access to official FIFA sites (e.g., fifa.com), which are not in this list.
level: high
tags:
    - attack.initial_access
    - attack.t1566.002
    - ghost-stadium
    - phishing

// Hunt for LofyStealer indicators
let LofyHashes = dynamic(["d21a5d08b4614005c8fcd9d0068f0190", "fb203c0ac030a97281960d7c28d86ebf", "9b1264eb4ff5ee8f00b8b80341fb6917dc3d3148", "f9fe23f24d45eae418c60819c523a83ddba4ca50", "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881", "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7"]);
DeviceProcessEvents
| where SHA256 in (LofyHashes) or MD5 in (LofyHashes) or SHA1 in (LofyHashes)
| project Timestamp, DeviceName, AccountName, FileName, SHA256,FolderPath, InitiatingProcessFileName
| extend Alert = "Potential LofyStealer Execution"

--

// Hunt for network connections to JINX-0164 infrastructure
let JINXDomains = dynamic(["driver-updater.net", "login.teamicrosoft.com", "live.ong", "teams.live.us.org", "www.driver-updater.net", "www.live.us.org"]);
DeviceNetworkEvents
| where RemoteUrl has_any (JINXDomains)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend Alert = "Potential JINX-0164 C2 Communication"

# IOC Hunt Script for LofyStealer and JINX-0164 Activity
# Requires Administrator privileges

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# Define IOCs
$LofyHashes = @(
    "d21a5d08b4614005c8fcd9d0068f0190",
    "fb203c0ac030a97281960d7c28d86ebf",
    "9b1264eb4ff5ee8f00b8b80341fb6917dc3d3148",
    "f9fe23f24d45eae418c60819c523a83ddba4ca50",
    "293006cec43c663ccff331795d662c3b73b4d7af5f8584e2899e286c672c9881",
    "45d4040e76a0d357dd6e236e185aba2eb82420d78640bfd1f3dede32b33931f7"
)

$SuspiciousFiles = @(
    # Common lure paths for LofyStealer, adjust as more intelligence comes in
    "$env:APPDATA\Minecraft\lofy.exe",
    "$env:TEMP\minecraft-loader.exe"
)

# 1. File Hash Scan
Write-Host "Scanning for known malicious file hashes..." -ForegroundColor Yellow
$drive = Get-PSDrive -Name C
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { 
        $_.Length -gt 50MB -and $_.Length -lt 60MB -and $_.Extension -eq '.exe' 
    } | 
    ForEach-Object {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
        if ($LofyHashes -contains $hash) {
            Write-Host "ALERT: LofyStealer file found at $($_.FullName)" -ForegroundColor Red
        }
    }

# 2. Path-based Scan for Suspicious Files
Write-Host "Scanning for suspicious file paths..." -ForegroundColor Yellow
foreach ($file in $SuspiciousFiles) {
    if (Test-Path $file) {
        Write-Host "ALERT: Suspicious file found at $file" -ForegroundColor Red
    }
}

# 3. DNS Cache Scan for JINX-0164 Domains
Write-Host "Scanning DNS cache for JINX-0164 related domains..." -ForegroundColor Yellow
$JINXDomains = @("driver-updater.net", "login.teamicrosoft.com", "live.ong")
Get-DnsClientCache | Where-Object { $JINXDomains -contains $_.Entry.Split(".")[-2] + "." + $_.Entry.Split(".")[-1] } | 
    ForEach-Object { Write-Host "ALERT: DNS cache entry for $($_.Name) found resolving to $($_.Data)" -ForegroundColor Red }

Write-Host "IOC Hunt complete." -ForegroundColor Cyan