Lumma Stealer via ClickFix + Star Blizzard AiTM Phishing + n0n AI-Assisted Extortion: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Threat Summary

Five live OTX pulses paint a converging picture: credential theft and infostealer distribution remain the dominant initial-access economy, and threat actors are industrializing it with AI tooling and trusted-platform abuse.

ClickFix via ChatGPT Custom GPTs (Lumma Stealer, SectopRAT, AMOS, MacSync) — Adversaries purchase sponsored Google search results that route victims to attacker-built Custom GPTs impersonating legitimate ChatGPT assistants. Victims are bounced to Google Sites pages hosting fake Cloudflare CAPTCHAs that instruct them to paste attacker-controlled PowerShell into the Windows Run dialog (the ClickFix technique). The obfuscated PowerShell chain sideloads through trusted binaries (Canon DLL sideloading observed) and delivers Lumma Stealer on Windows and AMOS/MacSync on macOS, with SectopRAT providing hands-on-keyboard access. Objective: browser credential stores, session cookies, crypto wallets, and corporate SSO tokens.
n0n Ransomware — AI-assisted extortion — An exposed staging server revealed a complete operator workspace: breach tooling, encryptor source, extortion infrastructure, and an LLM coding-agent environment with $7,000+ in paid API usage. At least 23 victims across 14 countries. Initial access is FortiGate SSL-VPN credential stuffing; post-compromise includes data exfiltration and backup destruction. This is the monetization endpoint for exactly the credentials harvested by the stealers above.
Star Blizzard (Callisto / FSB Centre 18) — Russian state espionage group running large-scale spear-phishing and EvilGinx-based adversary-in-the-middle (AiTM) credential theft against government, defense, NGO, and academia targets across NATO countries, the UK, US, and Ukraine. Their malware ecosystem (SPICA, LOSTKEYS, NOROBOT, GHOSTBLADE, SIMPLEFIX) is modular and document-lure driven, exploiting CVE-2022-30190 (Follina), CVE-2023-36884, CVE-2023-38831 (WinRAR), and CVE-2024-4947.
PHP2Shell / kkkkevin777 — Web shell weaponization against Japanese real estate and finance targets via shared-hosting credential reuse (CVE-2026-109618, CVE-2026-109619). 16,061 customer records stolen — credentials harvested from one compromise reused to pivot into ~20 related sites.
Fake Bid Invitation credential phishing — Password-protected PDFs (to evade sandbox scanning) containing fake OneDrive buttons leading to Microsoft login spoofing pages hosted on compromised legitimate domains (lastingonlineexperiences.de subdomains) and disposable .online infrastructure.

Collective assessment: The common denominator is identity compromise. Stealers harvest credentials and session tokens at the endpoint; phishing kits capture them at the perimeter; ransomware crews and APTs consume them for initial access. Defending any one layer in isolation is insufficient.

Threat Actor / Malware Profile

Lumma Stealer / SectopRAT (ClickFix chain)

Distribution: Sponsored search ads → impersonated ChatGPT Custom GPTs → Google Sites fake CAPTCHA → user-executed PowerShell (ClickFix). Because the user runs the payload themselves, macro/email-gateway controls are bypassed entirely.
Payload behavior: Obfuscated PowerShell stages download encrypted payloads; Canon legitimate binaries are abused for DLL sideloading to execute the stealer under a signed process. Lumma enumerates browsers (Chromium/Gecko), extracts cookies, stored credentials, autofill data, and cryptocurrency wallet extensions; SectopRAT establishes interactive remote access.
C2: HTTPS to rotating infrastructure; exfiltration staged as archives over encrypted channels.
Persistence: Run keys and scheduled tasks under user context; masqueraded binary names.
Anti-analysis: CAPTCHA-gated delivery defeats crawlers and sandboxes; multi-stage obfuscation; user-execution requirement defeats detonation environments.

Star Blizzard (Callisto)

Distribution: Highly personalized spear-phishing with relationship-building pretexts; malicious document lures exploiting Follina (CVE-2022-30190), WinRAR ACE (CVE-2023-38831), and Office remote template injection (CVE-2023-36884).
Credential theft: EvilGinx AiTM proxy phishing pages relay MFA sessions in real time, capturing session cookies that bypass MFA entirely.
Implants: SPICA (Rust backdoor), LOSTKEYS, NOROBOT/YESROBOT/MAYBEROBOT chain loaders, GHOSTBLADE/SIMPLEFIX persistence components.
C2: Lookalike domains such as preentootmist.org and captchanom.top, plus IPv4 103.245.231.248.

n0n Ransomware

Initial access: Credential stuffing against FortiGate SSL-VPN portals — likely consuming stealer-log credentials purchased or harvested upstream.
Tooling: AI coding agents used to accelerate encryptor development, tooling generation, and operational scripting — materially lowering the skill floor for destructive operations.
Impact: Data exfiltration followed by encryption and deliberate backup destruction to remove recovery leverage.
Infrastructure: 198.13.158.143, 217.18.55.185, 45.132.114.241, and the DGA-style hostname beaconipv4185.157.161.93ntpsync.io masquerading as NTP synchronization traffic.

IOC Analysis

The pulse indicator set spans five operationalizable types:

FileHash-SHA256/MD5 (30+): Primarily Lumma/SectopRAT stage-2 payloads and the fake-bid PDF attachments. Hashes are the highest-fidelity but shortest-lived indicators — push them to EDR blocklists immediately, but expect repacking within days. Feed them to VirusTotal/MalwareBazaar pivots for cluster expansion.
IPv4 (6): n0n extortion/staging infrastructure, Star Blizzard C2, and the kkkkevin777 staging server (96.126.130.81). Block at perimeter egress and ingest into threat-intelligence platforms (MISP, Sentinel TI) for retroactive netflow matching.
Domain/Hostname (5): preentootmist.org, captchanom.top, nbpn.lastingonlineexperiences.de, slotpastimaxwin50jt.online, beaconipv4185.157.161.93ntpsync.io. Note the last one embeds an IP-looking string to evade naive parsers — decode with regex normalization before blocklisting. Sinkhole at DNS; the lastingonlineexperiences.de subdomains indicate a compromised legitimate host, so alert the registrar/host rather than blocking the apex blindly.
URL (4): The fake-bid phishing URLs include victim-email parameters (?email=) — pre-filled credential pages. Extract the email parameter from proxy logs to identify targeted users directly.
CVE (5): Map against your attack surface: Follina, WinRAR, Office template injection, Chrome V8 (CVE-2024-4947), and the two PHP2Shell CVEs for shared-hosting environments.

Tooling: Decode/normalize indicators with CyberChef and ioc-fanger; validate hashes via MalwareBazaar API; expand infrastructure with Validin/PassiveTotal; operationalize via MISP → Sentinel/Splunk TI feeds and EDR custom indicator lists.

Detection Engineering

YAML

---
title: ClickFix Fake CAPTCHA User-Executed PowerShell (Lumma/SectopRAT Delivery)
id: 7a3f1c2e-9d44-4b1a-a5c6-2026clickfix01
status: experimental
description: Detects PowerShell launched from the Windows Run dialog or explorer with encoded/obfuscated commands consistent with ClickFix fake CAPTCHA lures delivering Lumma Stealer or SectopRAT.
author: Security Arsenal Threat Intelligence
references:
  - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
date: 2026/10/29
logsource:
  category: process_creation
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\rundll32.exe'
  selection_encoded:
    CommandLine|contains:
      - ' -enc '
      - ' -ec '
      - 'FromBase64String'
      - 'IEX'
      - 'iwr '
      - 'Invoke-WebRequest'
  selection_lure:
    CommandLine|contains:
      - 'mshta'
      - 'powershell'
  condition: selection_parent and selection_encoded and selection_lure
falsepositives:
  - Admin scripting launched interactively via Run dialog
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1204.002
---
title: Star Blizzard AiTM Phishing Domain Resolution
id: 8b4e2d3f-1c55-4f2b-b6d7-2026starbliz02
status: experimental
description: Detects DNS resolution of known Star Blizzard (Callisto/FSB Centre 18) credential phishing and C2 infrastructure including EvilGinx AiTM proxy domains.
author: Security Arsenal Threat Intelligence
references:
  - https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/
date: 2026/10/29
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'preentootmist.org'
      - 'captchanom.top'
      - 'ntpsync.io'
  condition: selection
falsepositives:
  - Threat research and sandbox detonation
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1557
---
title: Fake Bid Invitation Phishing Landing Page Access
id: 9c5f3e4a-2d66-4a3c-c7e8-2026fakebid03
status: experimental
description: Detects web requests to fake OneDrive/Microsoft login phishing infrastructure used in the Project Bid Invitation credential phishing campaign, including compromised-host subdomains and victim-email URL parameters.
author: Security Arsenal Threat Intelligence
references:
  - https://cofense.com/blog/locked-and-loaded-phishing-through-fake-bids-and-protected-documents
date: 2026/10/29
logsource:
  category: proxy
detection:
  selection_host:
    c-uri-host|contains:
      - 'lastingonlineexperiences.de'
      - 'slotpastimaxwin50jt.online'
  selection_param:
    c-uri-query|contains:
      - 'email='
  condition: selection_host and selection_param
falsepositives:
  - None expected; apex domain is a compromised legitimate host
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1078

KQL — Microsoft Sentinel / Defender

// Hunt: ClickFix user-executed PowerShell + n0n/Star Blizzard C2 connections
// Microsoft Sentinel / Defender XDR
let C2IPs = dynamic(["198.13.158.143", "217.18.55.185", "45.132.114.241", "96.126.130.81", "103.245.231.248"]);
let PhishDomains = dynamic(["preentootmist.org", "captchanom.top", "ntpsync.io", "lastingonlineexperiences.de", "slotpastimaxwin50jt.online"]);
let ClickFix = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("explorer.exe", "rundll32.exe")
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_any ("-enc", "FromBase64String", "IEX", "iwr", "Invoke-WebRequest", "mshta")
| project ClickFixTime=TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, DeviceId;
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in (C2IPs) or RemoteUrl has_any (PhishDomains)
| project NetTime=TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, DeviceId;
ClickFix
| join kind=fullouter NetHits on DeviceId
| extend LummaHashSeen = iif(ProcessCommandLine has "22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4", "Yes", "No")
| order by DeviceName asc

PowerShell

# Security Arsenal - Infostealer & Phishing Campaign Hunt Script
# Targets: Lumma Stealer persistence, ClickFix artifacts, n0n/Star Blizzard C2
# Run elevated on Windows endpoints. Output: JSON findings to C:\Hunt\results.json

$findings = @()
$C2 = @("198.13.158.143","217.18.55.185","45.132.114.241","96.126.130.81","103.245.231.248")
$Hashes = @("22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4",
            "0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f",
            "9ca705d6466d4d71c3fb0cae5097933afe1de1bc139d53bb63565a52dc9ebccb",
            "87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48")

# 1) Active/recent connections to known C2
Get-NetTCPConnection -State Established,SynSent -ErrorAction SilentlyContinue |
  Where-Object { $C2 -contains $_.RemoteAddress } |
  ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $findings += [PSCustomObject]@{Type="C2Connection"; Host=$env:COMPUTERNAME;
      RemoteIP=$_.RemoteAddress; Process=$proc.ProcessName; Path=$proc.Path}
  }

# 2) Run-key persistence (Lumma/SectopRAT style masqueraded entries)
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
  Get-ItemProperty $key -ErrorAction SilentlyContinue | ForEach-Object {
    $_.PSObject.Properties | Where-Object {
      $_.Value -match "(powershell|mshta|AppData\\Local\\Temp|\.ps1|base64)" } |
      ForEach-Object { $findings += [PSCustomObject]@{Type="SuspiciousRunKey";
        Host=$env:COMPUTERNAME; Key=$key; Name=$_.Name; Value=$_.Value} }
  }
}

# 3) Scheduled tasks executing from Temp/AppData (stealer persistence)
Get-ScheduledTask | Where-Object {
  ($_.Actions | ForEach-Object { $_.Execute + " " + $_.Arguments }) -match
  "(Temp|AppData|powershell.*-enc|mshta)" } | ForEach-Object {
    $findings += [PSCustomObject]@{Type="SuspiciousScheduledTask";
      Host=$env:COMPUTERNAME; Task=$_.TaskName;
      Action=($_.Actions | ForEach-Object { $_.Execute }) -join ";"}
  }

# 4) Hash sweep of common drop locations (Lumma payloads, phishing PDFs)
$paths = @("$env:TEMP", "$env:LOCALAPPDATA\Temp", "$env:USERPROFILE\Downloads")
foreach ($p in $paths) {
  Get-ChildItem $p -Recurse -File -ErrorAction SilentlyContinue |
    ForEach-Object {
      $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
      if ($Hashes -contains $h) {
        $findings += [PSCustomObject]@{Type="KnownMalwareHash"; Host=$env:COMPUTERNAME;
          Path=$_.FullName; SHA256=$h}
      }
    }
}

# 5) DNS cache check for phishing/AiTM domains
ipconfig /displaydns | Select-String -Pattern "preentootmist|captchanom|ntpsync|lastingonlineexperiences|slotpastimaxwin" |
  ForEach-Object { $findings += [PSCustomObject]@{Type="DNSCacheHit";
    Host=$env:COMPUTERNAME; Entry=$_.Line.Trim()} }

New-Item -ItemType Directory -Path C:\Hunt -Force | Out-Null
$findings | ConvertTo-Json -Depth 4 | Out-File C:\Hunt\results.json
if ($findings.Count -gt 0) { Write-Host "[!] $($findings.Count) findings - escalate to IR" -ForegroundColor Red }
else { Write-Host "[+] Clean" -ForegroundColor Green }

Response Priorities

Immediate (0-4 hours)

Block all IPv4 IOCs (198.13.158.143, 217.18.55.185, 45.132.114.241, 96.126.130.81, 103.245.231.248) at egress firewall, proxy, and EDR network protection.
Sinkhole preentootmist.org, captchanom.top, *.ntpsync.io, and slotpastimaxwin50jt.online at DNS. For lastingonlineexperiences.de, block the enumerated subdomains and report the compromise to the hosting provider.
Push all SHA256/MD5 hashes to EDR blocklists; run the PowerShell hunt script across endpoints, prioritizing users in procurement, finance, and executive staff (fake-bid lure demographics).
Deploy the ClickFix Sigma rule — user-executed PowerShell is the single highest-signal detection in this bulletin.
Search proxy logs for the phishing URL ?email= parameter to enumerate targeted users directly.

24 Hours

Force credential resets and revoke all sessions for any user whose device shows ClickFix execution artifacts or C2 connections. Lumma exfiltrates session cookies — password resets alone are insufficient; revoke OAuth refresh tokens and Entra ID/Google sessions, and re-enroll MFA.
Audit FortiGate SSL-VPN logs for credential-stuffing patterns (n0n's entry vector): repeated failed logins from disparate geographies followed by success. Enforce MFA on all VPN portals if not already mandatory.
For any user who visited Star Blizzard AiTM infrastructure, assume session-cookie theft bypassing MFA — revoke sessions and review mailbox forwarding rules, OAuth grants, and inbox delegation for persistence.
Retro-hunt 30 days of DNS/netflow for the indicator set to catch earlier compromise.

1 Week

Attack-vector hardening: Block PowerShell execution via Run dialog for standard users (AppLocker/WDAC policies restricting interactive script execution); this neutralizes the ClickFix technique structurally. Restrict mshta.exe and unsigned script execution.
Deploy browser isolation or conditional-access policies that block sponsored-search redirects to untrusted domains for high-risk user groups.
Address the Star Blizzard CVE surface: patch WinRAR (CVE-2023-38831), ensure Office Follina mitigations (CVE-2022-30190), and update Chromium-based browsers (CVE-2024-4947).
For any shared-hosting web assets, remediate CVE-2026-109618/109619 and enforce unique credentials per hosting account — the kkkkevin777 pivot succeeded purely through credential reuse.
Review backup architecture against n0n's destruction playbook: immutable/air-gapped backups with separate credentials so ransomware operators cannot delete recovery points.
Deliver targeted awareness training on ClickFix lures: no legitimate CAPTCHA, ChatGPT, or verification page will ever ask you to paste commands into the Run dialog.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Lumma Stealer via ClickFix + Star Blizzard AiTM Phishing + n0n AI-Assisted Extortion: OTX Pulse Analysis — Enterprise Detection Pack