Mirage2FA PhaaS, Offside Wallet Theft Factory & T-Mobile Smishing: OTX Pulse Analysis — Credential Theft Detection Pack

---
title: Mirage2FA AiTM Phishing - HTML Smuggling Attachment Execution
id: 4f2a9c1e-8b7d-4e3a-9f1c-mirage2fa001
status: experimental
description: Detects HTML smuggling delivery pattern used by Mirage2FA PhaaS - browser process spawned from email client or HTML attachment written to temp/download directories then opened
author: Security Arsenal Threat Intelligence
references:
  - https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/
date: 2026/09/19
logsource:
  category: process_creation
  product: windows
detection:
  selection_browser:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  selection_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\thunderbird.exe'
      - '\explorer.exe'
  selection_cmdline:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '.htm'
  condition: selection_browser and selection_parent and selection_cmdline
falsepositives:
  - Legitimate HTML attachments opened from email clients
level: medium
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.t1027.006
---
title: Malicious Firefox Extension C2 Communication - Offside Wallet Theft Factory
id: 7c3d5e2a-1f9b-4a6c-8d2e-offside7702
status: experimental
description: Detects Firefox browser connections to known Offside Wallet Theft Factory C2 domains or suspicious cloud relay infrastructure used for credential exfiltration
author: Security Arsenal Threat Intelligence
references:
  - https://socket.dev/blog/firefox-crypto-wallet-theft
date: 2026/09/19
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith: '\firefox.exe'
  selection_c2_domains:
    DestinationHostname|contains:
      - 'browser-app.com'
      - 'browsify.net'
      - 'gemachriverdale.org'
      - 'e-wl.com'
  selection_cloud_relay:
    DestinationHostname|endswith:
      - '.supabase.co'
      - '.workers.dev'
  condition: selection_image and (selection_c2_domains or selection_cloud_relay)
falsepositives:
  - Legitimate Web3 extensions using Supabase backends - validate against installed extension inventory
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
  - attack.credential_access
  - attack.t1555.003
---
title: Mirage2FA AiTM C2 Domain Resolution - Session Hijack Infrastructure
id: 9e1f4b8c-3a2d-4f7e-b5c9-mirage2fa003
status: experimental
description: Detects DNS resolution of known Mirage2FA phishing infrastructure domains used for Microsoft 365 AiTM session theft
author: Security Arsenal Threat Intelligence
date: 2026/09/19
logsource:
  category: dns
  product: windows
detection:
  selection:
    query|contains:
      - 'galatasaraydanhaberler.com'
      - 'sopbtech.store'
      - 'pcvgtech.store'
      - 'verpox.shop'
      - 'cementslabconstruction.com'
      - 'pslcertlive.site'
      - 'rsxbenefits.com'
      - 'vslbertlive.info'
  condition: selection
falsepositives:
  - Unlikely - infrastructure confirmed malicious
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.004
  - attack.credential_access
  - attack.t1557

// Hunt: Mirage2FA AiTM infra + T-Mobile smishing pivot pattern + extension C2
let AiTMDomains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info"]);
let ExtensionC2 = dynamic(["browser-app.com","browsify.net","gemachriverdale.org","e-wl.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| extend RemoteHost = tostring(parse_url(RemoteUrl).Host)
| where RemoteHost in~ (AiTMDomains) or RemoteHost in~ (ExtensionC2)
   or RemoteUrl matches regex @"t-mobile\.[a-z]{6}\.top"
   or (InitiatingProcessFileName =~ "firefox.exe" and (RemoteHost endswith ".supabase.co" or RemoteHost endswith ".workers.dev"))
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType;
let BrowserProcessHits = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("msedge.exe","chrome.exe","firefox.exe")
| where InitiatingProcessFileName in~ ("OUTLOOK.EXE","explorer.exe")
| where ProcessCommandLine has_any ("\\AppData\\Local\\Temp\\","\\Downloads\\") and ProcessCommandLine has ".htm"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
union NetworkHits, BrowserProcessHits
| sort by TimeGenerated desc

# Hunt Script: Offside Wallet Theft Factory extensions + Mirage2FA artifacts
# Run elevated on endpoints or via remote execution tooling (Intune/Defender Live Response)

$ExtensionHashes = @(
  "08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2f",
  "4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb",
  "26427220b9965e22deca0e617657c2c65b78f750183355d1265c147818367bd7",
  "252119fc48ad93b0c930d7a62fb49420cf8986716539e4e9d4d5c1bad700d435"
)
$MaliciousDomains = @("browser-app.com","browsify.net","e-wl.com","sopbtech.store","verpox.shop","pslcertlive.site")

Write-Host "=== [1] Hashing Firefox extension XPI files across user profiles ===" -ForegroundColor Cyan
Get-ChildItem "C:\Users\*\AppData\Roaming\Mozilla\Firefox\Profiles\*\extensions" -ErrorAction SilentlyContinue |
  ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($ExtensionHashes -contains $h.ToLower()) {
      Write-Host "[!] MALICIOUS EXTENSION: $($_.FullName) [$h]" -ForegroundColor Red
    }
  }

Write-Host "=== [2] Checking DNS cache for C2/smishing infrastructure ===" -ForegroundColor Cyan
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
  $entry = $_.Entry
  ($MaliciousDomains | Where-Object { $entry -like "*$_*" }) -or
  ($entry -match "t-mobile\.[a-z]{6}\.top")
} | Select-Object Entry, Data | Format-Table -AutoSize

Write-Host "=== [3] Active connections to Supabase/Workers relays from browsers ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.OwningProcess -in (Get-Process firefox,chrome,msedge -ErrorAction SilentlyContinue).Id } |
  ForEach-Object {
    $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName) 2>$null
    if ($rdns -match "supabase\.co|workers\.dev") {
      Write-Host "[!] Suspicious cloud relay: $rdns (PID $($_.OwningProcess))" -ForegroundColor Yellow
    }
  }

Write-Host "=== [4] Recent HTML files in Temp/Downloads (HTML smuggling check) ===" -ForegroundColor Cyan
Get-ChildItem "C:\Users\*\AppData\Local\Temp","C:\Users\*\Downloads" -Include *.htm,*.html -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) -and (Select-String -Path $_.FullName -Pattern "Blob|atob|createObjectURL" -Quiet -ErrorAction SilentlyContinue) } |
  Select-Object FullName, LastWriteTime | Format-Table -AutoSize

Write-Host "=== Hunt complete. Escalate any [!] findings to IR immediately. ===" -ForegroundColor Green