---
title: Potential MacSync Stealer Activity - macOS
description: Detects execution of AppleScript via shell often used by MacSync loaders following a download.
status: experimental
date: 2026/04/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6616a9b1f4ac2e3d93a9f9b1/
tags:
    - attack.execution
    - attack.t1059.002
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/bin/sh'
        CommandLine|contains: 'osascript'
    condition: selection
falsepositives:
    - Legitimate administrative scripts
level: high
---
title: Suspicious Node.js Child Process - OtterCookie
description: Detects Node.js spawning PowerShell or cmd, a behavior observed in npm-based supply chain attacks like OtterCookie.
status: experimental
date: 2026/04/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6616a9b1f4ac2e3d93a9f9b2/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    parent:
        Image|endswith: '\node.exe'
    child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
    condition: parent and child
falsepositives:
    - Legitimate development build scripts
level: high
---
title: Chrome Extension Policy Registry Modification - ClickFix
description: Detects modifications to Chrome Extension Install Policies which may indicate force-installation via Cloud Management tokens.
status: experimental
date: 2026/04/14
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6616a9b1f4ac2e3d93a9f9b3/
tags:
    - attack.persistence
    - attackT1542.001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: '\\Software\\Policies\\Google\\Chrome\\ExtensionInstallForcelist'
    condition: selection
falsepositives:
    - IT administration management
level: medium

// Hunt for network connections to known C2 infrastructure from OtterCookie and Vidar campaigns
let C2IPs = dynamic(['144.172.110.228', '107.189.22.20', '147.45.197.92', '94.228.161.88', '144.126.135.238', '144.126.140.33']);
DeviceNetworkEvents
| where RemoteIP in (C2IPs) or RemoteUrl contains "cloudapi.stream" or RemoteUrl contains "xpie348.online"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort
| extend IOCHit = "OTX-Pulse-C2"

<#
    OTX Pulse IOC Hunter - MacSync, OtterCookie, Vidar, ClickFix
    Scans for running processes connecting to malicious IPs and checks for specific file hashes.
#>

$MaliciousIPs = @(
    '144.172.110.228', '144.172.110.96', '144.172.110.132', 
    '147.45.197.92', '94.228.161.88', '144.126.140.33'
)

Write-Host "[+] Checking active network connections for malicious C2 IPs..."
$Connections = Get-NetTCPConnection -State Established

foreach ($IP in $MaliciousIPs) {
    $Hits = $Connections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Hits) {
        $Processes = $Hits | ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue }
        Write-Host "[!] ALERT: Connection to $IP detected from process:" -ForegroundColor Red
        $Processes | Select-Object ProcessName, Id, Path
    }
}

# Check for specific MacSync File Hashes (if files present on disk)
$TargetHashes = @(
    '5190ef1733183a0dc63fb623357f56d6', 
    '866993e9950250ac2ce8c3b4c6a8bd39285e0fafd93860f235a3b0370f160dd1'
)

Write-Host "[+] Scanning user download folders for MacSync stealer hashes..."
$Users = Get-ChildItem -Path "C:\Users" -Directory
foreach ($User in $Users) {
    $Downloads = Join-Path -Path $User.FullName -ChildPath "Downloads"
    if (Test-Path $Downloads) {
        Get-ChildItem -Path $Downloads -File -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                Write-Host "[!] CRITICAL: Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}


# Response Priorities

*   **Immediate:**
    *   Block all identified IP ranges (144.172.x.x, 94.228.x.x) and domains (cloudapi.stream, xpie348.online) at the firewall and proxy.
    *   Quarantine endpoints matching the provided file hashes (MD5/SHA256).
    *   Disable any Chrome extensions force-installed via policy that do not originate from corporate whitelists.

*   **24 Hours:**
    *   Initiate credential verification and password resets for accounts accessed from infected machines, specifically targeting Google/Microsoft O365 sessions and cryptocurrency wallets.
    *   Review npm package supply chains; block access to the specific malicious package versions mentioned in the OtterCookie pulse.

*   **1 Week:**
    *   Harden macOS endpoints against ClickFix by restricting the execution of unsigned AppleScript payloads.
    *   Review GitHub repository permissions and educate developers on the risks of cloned/trojanized repositories related to the "Claude Code" leak.