MadApe Device-Code Phishing Kit + NetScaler & Zimbra Webshell Clusters: OTX Pulse Analysis — Credential Theft Detection Pack

Threat Summary

Four OTX pulses published between 2026-10-29 and 2026-10-31 reveal a credential-theft ecosystem operating across three distinct but complementary layers of the enterprise attack surface. While the pulses are attributed to unknown actors, the operational tradecraft forms a coherent picture: adversaries are harvesting credentials and session material at the identity layer (MadApe Microsoft Device Code phishing), at the network edge (CVE-2026-88771 in Citrix NetScaler ADC/Gateway), and at the collaboration layer (CVE-2026-73570 in Zimbra Collaboration Suite). A fourth pulse documents unauthorized AI relay services silently exfiltrating enterprise LLM traffic — including developer prompts, source code, and embedded secrets — through third-party infrastructure.

The shared objective across all four campaigns is credential and session-material acquisition at scale, with strong downstream monetization indicators consistent with initial access broker (IAB) activity and dark web credential markets:

• Citrix NetScaler CVE-2026-88771 (LevelBlue THOR): a critical pre-authentication command-injection flaw actively exploited across multiple customer environments. Attackers created malicious authentication events using attacker-controlled usernames containing pitboss and NSPPE strings, dropped Perl (update_c08937.pl) and Python (main.py) tooling, staged configuration exfiltration archives (update_result_3567cs.tgz), and deployed reverse shells and web shells. NetScaler config theft yields LDAP bind credentials, RADIUS shared secrets, and session keys — everything needed to replay identity internally.
• Zimbra CVE-2026-73570 (Microsoft Threat Intelligence): an unauthenticated OS command injection in Zimbra's SNMP notification path, exploited in the zero-day window between patch availability (2026-07-20) and public disclosure (2026-08-13). Actors delivered JSP webshells (China Chopper, Godzilla) and reverse shells, with tooling clusters named Looptik and NeedyMantis, achieving privilege escalation on internet-facing mail servers — prime real estate for mailbox credential harvesting and business email compromise staging.
• MadApe (Group-IB): a previously undocumented Microsoft Device Code phishing kit using business-themed PDF lures, configurable redirect chains, and fake document-sharing pages. Rather than capturing passwords, MadApe abuses the legitimate Microsoft device-code OAuth flow to obtain access tokens directly — bypassing MFA on non-compliant flows. The campaign shows targeting bias toward Israel, and the pulse carries a heavy indicator set (565 IOCs), signaling a mature, actively rotated phishing infrastructure.
• Unauthorized AI relays (Security.com): a service installing genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise hosts, then reconfiguring them to proxy through attacker-controlled relay domains (aiok.me, nuoda.vip, sorryios.io, mirbuds.com). Active since early 2026, impacting manufacturing, semiconductor, healthcare, transportation, energy, and technology sectors across China, South Korea, Taiwan, and Malaysia. This is credential and IP exfiltration by configuration tampering — a sandbox-bypass pattern that converts trusted AI tooling into an egress channel.

Collectively, these pulses describe an adversary economy that no longer needs to crack passwords: it steals tokens via device-code flows, dumps edge appliance configs for stored secrets, implants webshells on mail infrastructure for mailbox access, and hijacks AI CLI trust paths for continuous data egress.

Threat Actor / Malware Profile

MadApe Phishing Kit

• Distribution: Business-themed PDF lures linking to configurable redirect chains terminating in fake document-sharing pages (Microsoft 365 branding).
• Payload behavior: No credential capture on-page. The kit initiates a real Microsoft device-code authentication flow and socially engineers the victim into entering the attacker-generated code at the legitimate Microsoft login portal. The attacker's session receives valid OAuth tokens — access and refresh — granting durable M365 access.
• C2 / infrastructure: Large rotating domain pool (565 indicators; e.g., sucdens.com, cepoffices.com, zakosta.info, nsboards.com, adastraerrans.com, travestiilan.com, nysndigital.com, powerlivings.com). Redirect chains are kit-configurable, indicating phishing-as-a-service resale — meaning these tokens will surface on dark web access markets.
• Persistence: Refresh-token abuse. Stolen tokens persist independent of the phishing page; revocation requires Azure AD/Entra token revocation, not just password reset.
• Anti-analysis: Multi-stage redirects, legitimate Microsoft endpoints in the final hop, and PDF-lure indirection to evade URL-reputation engines.

NetScaler Exploitation Tooling (CVE-2026-88771)

• Distribution: Direct exploitation of internet-facing NetScaler ADC/Gateway; pre-authentication command injection.
• Payload behavior: Perl dropper update_c08937.pl retrieved from http://64.94.85.67:443/update_c08937.pl; Python second stage main.py; exfiltration bundle update_result_3567cs.tgz containing appliance configuration. Attacker-created usernames embedding pitboss and NSPPE strings are a high-fidelity hunt artifact.
• C2: Direct IP-based staging over port 443 to 64.94.85.67 — deliberately blending with HTTPS while serving plain HTTP, an anomaly worth alerting on.
• Persistence: Rogue local accounts on the appliance plus web-shell implantation.
• Anti-analysis: Tooling masquerades as legitimate update artifacts (update_* naming convention).

Zimbra Webshell Cluster (CVE-2026-73570: China Chopper, Godzilla, Looptik, NeedyMantis)

• Distribution: Unauthenticated command injection via Zimbra's SNMP notification path; exploitation began pre-disclosure (zero-day window).
• Payload behavior: JSP webshell deployment (China Chopper — MITRE S0020 — and Godzilla), reverse shells, privilege escalation to root on mail servers. Godzilla provides AES-encrypted traffic and a plugin ecosystem; Chopper offers a minimal one-line footprint ideal for log-sparse environments.
• C2: Attacker infrastructure includes psk1zim.abrdns.com and tls.psk1zim.abrdns.com — dynamic-DNS-style naming for disposable callback endpoints.
• Persistence: Webshells in the Zimbra webroot; root-level shells enable cron, systemd service, and sshd-key persistence.
• Anti-analysis: Encrypted webshell channels (Godzilla), exploitation confined to the pre-disclosure window to maximize dwell time before signatures existed.

Unauthorized AI Relay Service

• Distribution: Socially engineered or bundled installation of genuine OpenAI Codex and Anthropic Claude Code CLIs, followed by silent reconfiguration (PowerShell-based) to point at third-party relay endpoints.
• Payload behavior: All LLM requests — prompts, code, file contents, and frequently embedded API keys and credentials — are proxied through attacker infrastructure (vibe.aiok.me, chat.nuoda.vip).
• C2: HTTPS to relay domains: aiok.me, sorryios.io, nuoda.vip, mirbuds.com.
• Persistence: Configuration file tampering in the CLI's config directories; the legitimate signed binaries survive application allowlisting.
• Anti-analysis: The tooling is authentic vendor software — only the configuration and network destination are malicious. This defeats hash-based blocklisting and most EDR reputation models. Detection must focus on configuration drift and egress destination.

IOC Analysis

The pulse set contains five indicator classes, each requiring a different operationalization path:

Tooling to decode and operationalize: OTX pulses export natively to STIX/TAXII — pull them directly into your TIP (MISP, OpenCTI, ThreatConnect) and push to enforcement points via API. Use otx Python SDK or the pulse CSV export for bulk ingestion. For hash sweeping at scale, Velociraptor or osquery fleet queries; for DNS retro-hunt, your SIEM's DNS index. Behavioral strings like pitboss belong in authentication log alerting, not blocklists.

Detection Engineering

Sigma Rules

---
title: NetScaler CVE-2026-88771 Exploitation - Rogue Account and Staging Artifact
description: Detects artifacts from active exploitation of Citrix NetScaler pre-auth command injection, including attacker-created usernames containing pitboss/NSPPE strings and retrieval of update_c08937.pl or exfiltration bundles.
author: Security Arsenal Threat Intel
status: experimental
date: 2026/11/01
logsource:
  category: authentication
  product: citrix
detection:
  selection_usernames:
    User|contains:
      - 'pitboss'
      - 'NSPPE'
  condition: selection_usernames
falsepositives:
  - Legitimate NSPPE references in NetScaler internal service accounts (validate against baseline)
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1136
---
title: Zimbra CVE-2026-73570 Webshell Execution - Java Spawning Shell Processes
description: Detects JSP webshell activity (China Chopper, Godzilla, Looptik, NeedyMantis) on Zimbra mail servers via the Zimbra java/mailboxd process spawning shell interpreters or command execution binaries.
author: Security Arsenal Threat Intel
status: experimental
date: 2026/11/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - '/opt/zimbra/'
      - 'mailboxd'
      - 'java'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
  condition: selection_parent and selection_child
falsepositives:
  - Zimbra administrative scripts (rare from mailboxd context; investigate all hits)
level: critical
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1505.003
---
title: Rogue AI CLI Relay Configuration and Suspicious Outbound to Known Relay Domains
description: Detects network connections to unauthorized AI relay infrastructure (aiok.me, nuoda.vip, sorryios.io, mirbuds.com) or PowerShell reconfiguration of OpenAI Codex / Claude Code CLI settings, indicating sandbox-bypass exfiltration of developer traffic.
author: Security Arsenal Threat Intel
status: experimental
date: 2026/11/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_domains:
    DestinationHostname|contains:
      - 'aiok.me'
      - 'nuoda.vip'
      - 'sorryios.io'
      - 'mirbuds.com'
  selection_process:
    Image|endswith:
      - '\codex.exe'
      - '\claude.exe'
      - '\node.exe'
      - '\powershell.exe'
  condition: selection_domains and selection_process
falsepositives:
  - None expected; these domains are not legitimate vendor endpoints
level: critical
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.command_and_control
  - attack.t1071.001

Microsoft Sentinel KQL Hunt

// Unified hunt: NetScaler staging, Zimbra C2, MadApe phishing domains, AI relay egress
let MadApeDomains = dynamic(["sucdens.com","cepoffices.com","zakosta.info","nsboards.com","adastraerrans.com","travestiilan.com","nysndigital.com","powerlivings.com"]);
let RelayDomains = dynamic(["aiok.me","vibe.aiok.me","sorryios.io","nuoda.vip","chat.nuoda.vip","mirbuds.com","psk1zim.abrdns.com","tls.psk1zim.abrdns.com"]);
let NetScalerC2 = "64.94.85.67";
union isfuzzy=true
(DeviceNetworkEvents
| where RemoteUrl has_any (MadApeDomains) or RemoteUrl has_any (RelayDomains) or RemoteIP == NetScalerC2
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType
| extend HuntCategory = case(RemoteIP == NetScalerC2, "NetScaler-CVE-2026-88771", RemoteUrl has_any (MadApeDomains), "MadApe-Phishing", "AI-Relay-Egress")),
(DeviceProcessEvents
| where ProcessCommandLine has_any ("update_c08937.pl", "main.py", "update_result_3567cs.tgz")
   or (ProcessCommandLine has_any ("codex", "claude") and ProcessCommandLine has_any ("config", "set", "base-url", "endpoint"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
| extend HuntCategory = "Config-Tamper-or-Dropper"),
(SigninLogs
| extend AuthDetail = tostring(AuthenticationDetails)
| where AuthDetail has "device code" or UserAgent has_any ("device_code", "devicecode")
| project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, UserAgent, ResultType, Location
| extend HuntCategory = "DeviceCode-Auth-Anomaly")
| order by TimeGenerated desc

PowerShell IOC Hunt Script

# Security Arsenal - OTX Pulse Hunt: NetScaler/Zimbra artifacts, MadApe domains, AI relay tampering
# Run elevated on endpoints; outputs CSV findings per host

$results = @()

# --- 1. DNS cache check: MadApe phishing + AI relay + Zimbra C2 domains ---
$malDomains = @('sucdens.com','cepoffices.com','zakosta.info','nsboards.com','adastraerrans.com',
  'travestiilan.com','nysndigital.com','powerlivings.com','aiok.me','vibe.aiok.me','sorryios.io',
  'nuoda.vip','chat.nuoda.vip','mirbuds.com','psk1zim.abrdns.com','tls.psk1zim.abrdns.com')

$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $malDomains) {
    $hit = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) {
        $results += [pscustomobject]@{ Host=$env:COMPUTERNAME; Category='MaliciousDNS'; Indicator=$d; Detail=($hit.Entry -join ';') }
    }
}

# --- 2. Active/historical connections to NetScaler C2 ---
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq '64.94.85.67' }
foreach ($c in $conns) {
    $results += [pscustomobject]@{ Host=$env:COMPUTERNAME; Category='NetScalerC2-Connection'; Indicator=$c.RemoteAddress; Detail="State:$($c.State) Port:$($c.RemotePort) PID:$($c.OwningProcess)" }
}

# --- 3. Known malicious file hashes on disk (sweep common drop locations) ---
$badHashes = @(
 'e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c',
 '974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938',
 'dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a',
 'aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d',
 '6ab7de2509038edf580aef6229c1c3db17f4da8f2d7d940818faf617d1938244',
 'bf28f38122bf20d5fac969cc414daa6a890cdea872d389ca93d2092b6b7773cf',
 'b594a42b8f1c6f090327bb9a3361c2d3515537fb7ac8da6b9061b9a3f330e159',
 '2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24',
 '4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb'
)
$scanPaths = @("$env:TEMP","$env:USERPROFILE\Downloads","$env:USERPROFILE\AppData\Local","$env:USERPROFILE\AppData\Roaming","C:\ProgramData")
foreach ($p in $scanPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash -Algorithm SHA256 -Path $_.FullName -ErrorAction SilentlyContinue).Hash
        if ($badHashes -contains ($h -replace '-','').ToLower()) {
            $results += [pscustomobject]@{ Host=$env:COMPUTERNAME; Category='MaliciousFileHash'; Indicator=$h; Detail=$_.FullName }
        }
    }
}

# --- 4. AI CLI configuration tampering (Codex / Claude Code relay redirection) ---
$configPaths = @("$env:USERPROFILE\.codex","$env:USERPROFILE\.claude","$env:USERPROFILE\.config\codex","$env:USERPROFILE\.claude.json")
foreach ($cp in $configPaths) {
    if (Test-Path $cp) {
        Get-ChildItem -Path $cp -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
            $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
            foreach ($d in @('aiok.me','nuoda.vip','sorryios.io','mirbuds.com')) {
                if ($content -match [regex]::Escape($d)) {
                    $results += [pscustomobject]@{ Host=$env:COMPUTERNAME; Category='AIRelay-ConfigTamper'; Indicator=$d; Detail=$_.FullName }
                }
            }
        }
    }
}

# --- 5. Suspicious scheduled tasks / persistence referencing dropper names ---
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = ($_.Actions | Out-String)
    if ($actions -match 'update_c08937|main\.py|codex|claude' -and $actions -match 'http|powershell -enc|-e ') {
        $results += [pscustomobject]@{ Host=$env:COMPUTERNAME; Category='SuspiciousScheduledTask'; Indicator=$_.TaskName; Detail=$actions.Trim() }
    }
}

$results | Export-Csv -Path ".\OTX_Hunt_$($env:COMPUTERNAME)_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. Findings: $($results.Count)" -ForegroundColor Cyan

Response Priorities

Immediate (0–4 hours)

• Block all IOC domains and 64.94.85.67 at DNS sinkhole, secure web gateway, and perimeter firewall; import the SHA256 set into EDR block lists.
• Inventory internet-facing Citrix NetScaler ADC/Gateway and Zimbra Collaboration instances; verify patch status for CVE-2026-88771 and CVE-2026-73570. If unpatched and internet-exposed, treat as potentially compromised — pull NetScaler authentication logs for pitboss/NSPPE usernames and inspect Zimbra webroots for unauthorized JSP files.
• Run the KQL hunt and PowerShell sweep across the fleet; escalate any AI-relay config tampering as confirmed exfiltration.

24 Hours

• Identity verification (credential-stealing activity confirmed): Query Entra ID/Azure AD sign-in logs for device-code authentication events; identify any user who completed a device-code flow outside known workflows (headless devices, IoT). For hits: revoke all refresh tokens (Revoke-AzureADUserAllRefreshToken), force password reset, re-register MFA, and review mailbox rules and app consents created in the exposure window.
• Rotate credentials stored on potentially compromised NetScaler appliances — LDAP bind accounts, RADIUS secrets, and any service accounts referenced in appliance configs.
• Audit Zimbra mailboxes for suspicious forwarding rules and delegated access grants.

1 Week

• Architecture hardening: Remove management interfaces from internet exposure on all edge appliances; enforce conditional access policies blocking device-code flows where not operationally required; deploy token-binding / continuous access evaluation to limit replayed-token utility.
• Establish an AI tooling governance policy: only vendor-signed CLI binaries from managed software catalogs, with egress allowlisting for api.openai.com and api.anthropic.com and alerting on any AI-tool process contacting non-approved endpoints.
• Add webshell file-integrity monitoring to mail server webroots and integrate OTX TAXII feeds into automated IOC pipelines so future pulses operationalize without manual triage.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub