MacSync Stealer, Phantom Infostealer & Global Phishing Surge: OTX Pulse Analysis

title: MacSync Stealer Suspicious Shell Execution via Curl
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects potential MacSync infection chain involving curl downloading scripts piped to zsh.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/macsync-stealer-rat-reverse-engineering
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/curl'
        CommandLine|contains:
            - 'claude.ai'
            - 'paste'
        CommandLine|contains: '|'
    condition: selection
falsepositives:
    - Legitimate developer tool installation
level: high
---
title: Phantom Stealer PowerShell Loader Activity
id: 9b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects PowerShell patterns used by Phantom Stealer, including downloading cradles and steganography references.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/phantom-stealer-unmasked
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'DownloadString'
            - 'FromBase64String'
            - '.bmp'
            - '.png'
            - 'clipboard'
    condition: all of selection_*
falsepositives:
    - Administrative scripts
level: high
---
title: PasasteSinTAG Credential Harvesting Domain Access
id: 0c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects network connections to domains associated with the PasasteSinTAG phishing campaign.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/pasastesintag-phishing
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Initiated: 'true'
        DestinationHostname|contains:
            - 'pasastesintag'
            - 'parastesintago'
            - 'pasastesintap'
    condition: selection
falsepositives:
    - Unknown
level: critical

// Hunt for PasasteSinTAG and Indian Tax Phishing Domains
DeviceNetworkEvents
| where RemoteUrl has "pasastesintag" 
   or RemoteUrl has "parastesintago" 
   or RemoteUrl has "gov-xnui.com" 
   or RemoteUrl has "indiaaba.com" 
   or RemoteUrl has "laoshunfa.xyz"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| order by Timestamp desc

// Hunt for Phantom Stealer File Hashes
union DeviceFileEvents, DeviceProcessEvents
| where SHA256 in (
    "2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e", 
    "b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32",
    "be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab"
)
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessAccountName

<#
.SYNOPSIS
    Hunt script for Phantom Stealer artifacts and credential harvesting indicators.
.DESCRIPTION
    Scans for Phantom Stealer file hashes and checks for suspicious process execution patterns.
#>

$PhantomHashes = @(
    "2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e",
    "b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32",
    "be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab",
    "382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961"
)

Write-Host "[!] Hunting for Phantom Stealer Hashes..." -ForegroundColor Yellow

# Scan C: drive for known hashes (Recursive, skipping hidden/system dirs to speed up)
Get-ChildItem -Path "C:\Users" -Recurse -ErrorAction SilentlyContinue -File | ForEach-Object {
    $file = $_
    try {
        $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
        if ($PhantomHashes -contains $hash) {
            Write-Host "[+] MATCH FOUND: $($file.FullName)" -ForegroundColor Red
            Write-Host "    Hash: $hash"
        }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[!] Checking for suspicious PowerShell processes (Steganography/DownloadString)..." -ForegroundColor Yellow

$SuspiciousProcs = Get-Process -Name powershell -ErrorAction SilentlyContinue | Where-Object { 
    $_.StartTime -gt (Get-Date).AddHours(-24) 
}

if ($SuspiciousProcs) {
    Write-Host "[+] Recent PowerShell processes found. Investigate command lines via EDR." -ForegroundColor Cyan
}