Mirage2FA AiTM PhaaS + CopyCop/Storm-1516 Influence Infrastructure: OTX Pulse Detection Pack

---
title: OTX Mirage2FA and CopyCop Infrastructure Contact
id: 8f2b1c10-2026-08-20-001
status: experimental
description: Detects DNS, proxy or network contact to OTX-listed Mirage2FA AiTM phishing infrastructure and CopyCop/Storm-1516 impersonation domains.
author: Security Arsenal
logsource:
  category: dns
  product: windows
 detection:
  selection_query:
    query|contains:
      - 'galatasaraydanhaberler.com'
      - 'sopbtech.store'
      - 'pcvgtech.store'
      - 'verpox.shop'
      - 'gizmodo.cc'
      - 'haaretz24.com'
      - 'politico-24.com'
      - 'tech-crunch.org'
  condition: selection_query
falsepositives:
  - Threat intel validation, brand-protection scanning, sandbox detonation
level: high
tags:
  - attack.t1566
  - attack.t1557
  - attack.t1071.001
  - attack.t1583.001
---
title: Mirage2FA HTML Smuggling Followed By Script or LOLBin Execution
id: 8f2b1c10-2026-08-20-002
status: experimental
description: Detects browser-created HTML files in user-writable locations followed by mshta, powershell, rundll32 or wscript execution consistent with HTML smuggling lures used to route users into AiTM credential/session theft.
author: Security Arsenal
date: 2026/08/20
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_cli:
    CommandLine|contains:
      - 'Downloads'
      - 'AppData\Local\Temp'
      - '.html'
      - '.htm'
      - 'javascript:'
      - 'blob:'
  condition: selection_img and selection_parent and selection_cli
falsepositives:
  - Developer debugging, internal portals, browser test automation
level: medium
tags:
  - attack.t1059.001
  - attack.t1059.007
  - attack.t1027
  - attack.t1204.002
---
title: Possible Microsoft 365 AiTM Session Replay After Phishing Infrastructure Contact
id: 8f2b1c10-2026-08-20-003
status: experimental
description: Generic analytic logic for M365/Entra logs where a sign-in from a new ASN, VPN, VPS or unusual user agent occurs with satisfied MFA claim shortly after mail/web contact to phishing infrastructure; tune fields to your Entra ID schema.
author: Security Arsenal
date: 2026/08/20
logsource:
  product: azure
  service: signinlogs
detection:
  selection_success:
    ResultType: 0
  selection_auth:
    AuthenticationRequirement: 'multiFactorAuthentication'
  selection_context|contains:
    IPAddress:
      - '192.52.166.55'
      - '209.205.197.130'
      - '181.214.165.173'
      - '83.147.53.130'
  selection_risk|contains:
    RiskDetail:
      - 'anonymizedIPAddress'
      - 'unfamiliarFeatures'
      - 'unlikelyTravel'
      - 'maliciousIPAddress'
  condition: selection_success and selection_auth and (selection_context or selection_risk)
falsepositives:
  - Legitimate VPN users, travelers, new device rollouts
level: critical
tags:
  - attack.t1557
  - attack.t1539
  - attack.t1078
  - attack.t1550.004

let MirageIps = dynamic(['192.52.166.55','209.205.197.130','181.214.165.173','83.147.53.130']);
let BadDomains = dynamic(['galatasaraydanhaberler.com','sopbtech.store','pcvgtech.store','verpox.shop','gizmodo.cc','haaretz24.com','politico-24.com','tech-crunch.org']);
let Lookback = 14d;
let NetHits = union isfuzzy=true
    (DeviceNetworkEvents
     | where Timestamp > ago(Lookback)
     | where RemoteIP in (MirageIps) or RemoteUrl has_any (BadDomains)
     | project Source='DeviceNetworkEvents', Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
    (DeviceEvents
     | where Timestamp > ago(Lookback)
     | where AdditionalFields has_any (BadDomains) or AdditionalFields has_any (MirageIps)
     | project Source='DeviceEvents', Timestamp, DeviceName, InitiatingProcessFileName=coalesce(InitiatingProcessFileName,''), InitiatingProcessCommandLine=coalesce(InitiatingProcessCommandLine,''), RemoteIP=column_ifexists('RemoteIP',''), RemoteUrl=column_ifexists('RemoteUrl',''), ActionType);
NetHits
| join kind=leftouter (
    SigninLogs
    | where TimeGenerated > ago(Lookback)
    | where ResultType == 0
    | where IPAddress in (MirageIps) or RiskDetail has_any ('anonymizedIPAddress','unfamiliarFeatures','unlikelyTravel','maliciousIPAddress') or IsRisky == true
    | project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, ClientAppUsed, AuthenticationRequirement, RiskDetail, Status, CorrelationId
) on $left.RemoteIP == $right.IPAddress
| project Timestamp, Source, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, SigninTime, UserPrincipalName, AppDisplayName, ClientAppUsed, AuthenticationRequirement, RiskDetail, CorrelationId
| order by Timestamp desc;

$ErrorActionPreference = 'SilentlyContinue'
$ips = @('192.52.166.55','209.205.197.130','181.214.165.173','83.147.53.130')
$domains = @('galatasaraydanhaberler.com','sopbtech.store','pcvgtech.store','verpox.shop','gizmodo.cc','haaretz24.com','politico-24.com','tech-crunch.org')
$findings = New-Object System.Collections.Generic.List[object]

Get-NetTCPConnection -State Established | Where-Object {$ips -contains $_.RemoteAddress} | ForEach-Object {
  $p = Get-Process -Id $_.OwningProcess
  $findings.Add([pscustomobject]@{Type='LiveConnection'; Host=$env:COMPUTERNAME; User=$env:USERNAME; Process=$p.ProcessName; Path=$p.Path; Remote=$_.RemoteAddress; LocalPort=$_.LocalPort; RemotePort=$_.RemotePort; Time=Get-Date})
}

$cache = Get-DnsClientCache | Where-Object {$d = $_.Entry; $domains | ForEach-Object { $d -like ('*' + $_ + '*') }}
$cache | ForEach-Object { $findings.Add([pscustomobject]@{Type='DnsCache'; Host=$env:COMPUTERNAME; Entry=$_.Entry; Data=$_.Data; Time=Get-Date}) }

$userDirs = Get-ChildItem 'C:/Users' -Directory
foreach ($u in $userDirs) {
  $roots = @($u.FullName + '/Downloads', $u.FullName + '/AppData/Local/Temp', $u.FullName + '/AppData/Roaming/Microsoft/Windows/Recent')
  foreach ($r in $roots) {
    Get-ChildItem $r -Recurse -Include *.html,*.htm,*.url,*.iso,*.zip -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-14)} | ForEach-Object {
      $hit = Select-String -Path $_.FullName -Pattern $domains -SimpleMatch -ErrorAction SilentlyContinue
      if ($hit) { $findings.Add([pscustomobject]@{Type='SuspiciousFileIOC'; Host=$env:COMPUTERNAME; Owner=$u.Name; Path=$_.FullName; Match=($hit.Pattern -join ','); LastWrite=$_.LastWriteTime}) }
    }
  }
}

$runKeys = @('HKCU:/Software/Microsoft/Windows/CurrentVersion/Run','HKLM:/Software/Microsoft/Windows/CurrentVersion/Run','HKCU:/Software/Microsoft/Windows/CurrentVersion/RunOnce','HKLM:/Software/Microsoft/Windows/CurrentVersion/RunOnce')
foreach ($k in $runKeys) {
  Get-ItemProperty $k | ForEach-Object {
    $_.PSObject.Properties | Where-Object {$_.Name -notmatch '^PS'} | Where-Object {$_.Value -match 'mshta|powershell|wscript|rundll32|AppData|Temp|http'} | ForEach-Object {
      $findings.Add([pscustomobject]@{Type='PersistenceRunKey'; Host=$env:COMPUTERNAME; Key=$k; Name=$_.Name; Value=$_.Value; Time=Get-Date})
    }
  }
}

Get-ScheduledTask | Where-Object {$_.Actions.Execute -match 'mshta|powershell|wscript|rundll32' -and $_.Actions.Arguments -match 'http|AppData|Temp|html'} | ForEach-Object {
  $findings.Add([pscustomobject]@{Type='SuspiciousScheduledTask'; Host=$env:COMPUTERNAME; Task=$_.TaskName; Action=($_.Actions.Execute + ' ' + $_.Actions.Arguments); Time=Get-Date})
}

$findings | Sort-Object Time -Descending | Format-List
if ($findings.Count -gt 0) { $findings | Export-Csv -NoTypeInformation ('./otx_hunt_' + $env:COMPUTERNAME + '.csv') }