Multi-Vector Credential Heist: NWHStealer, notnullOSX, and Chrome Extension Botnets — OTX Pulse Analysis

---
title: Potential Malicious Chrome Extension Connection to Cloudapi C2
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
description: Detects network connections to known malicious C2 infrastructure used by infostealer Chrome extensions.
status: experimental
date: 2026/04/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/661f7e1d85f5a0d6c1d8e9f0
tags:
    - attack.credential_access
    - attack.collection
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'cloudapi.stream'
            - 'multiaccount.cloudapi.stream'
            - 'crm.cloudapi.stream'
            - 'xpie348.online'
    condition: selection
falsepositives:
    - Legitimate administrative traffic (unlikely given the specific TLD)
level: critical

---
title: NWHStealer Fake VPN Process Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects execution of suspicious processes often associated with NWHStealer distribution from fake VPN directories.
status: experimental
date: 2026/04/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/661e9a0b85f5a0d6c1d8e9e5
tags:
    - attack.execution
    - attack.initial_access
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\vpn-client.exe'
            - '\proton-vpn-setup.exe'
            - '\installer.exe'
    selection_path:
        CurrentDirectory|contains:
            - '\Downloads\'
            - '\Temp\'
            - '\AppData\Local\Temp\'
    condition: all of selection_*
falsepositives:
    - Legitimate VPN software installations
level: high

---
title: Chrome Force-Install via Group Policy (ClickFix BCB)
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects registry modifications indicative of force-installing Chrome extensions, a technique used in the Brazilian ClickFix campaign.
status: experimental
date: 2026/04/17
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/661e9a0b85f5a0d6c1d8e9e4
tags:
    - attack.persistence
    - attack.privilege_escalation
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist'
    filter:
        Details|startswith: 'ghbmnnjooekpmoecnnnilnnbdlolhkhi' # Legitimate extension example, adjust for allowlist
    condition: selection and not filter
level: high

// Hunt for network connections to malicious infrastructure and IOCs
let MaliciousDomains = pack_array('cloudapi.stream', 'xpie348.online', 'get-proton-vpn.com', 'vpn-proton-setup.com');
let MaliciousIPs = pack_array('144.126.135.238', '144.126.140.33', '83.217.209.88', '111.90.145.139');
DeviceNetworkEvents
| where RemoteUrl in (MaliciousDomains) or RemoteIP in (MaliciousIPs)
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, InitiatingProcessAccountName = InitiatingProcessAccountName
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessSHA256
| order by Timestamp desc

# IOC Hunt: Chrome Extension Force-Install and Suspicious File Presence
Write-Host "Starting Hunt for Chrome Extension Persistence and Malicious Files..." -ForegroundColor Cyan

# 1. Check for Force-Installed Chrome Extensions (ClickFix/Banking Campaign)
$RegPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
if (Test-Path $RegPath) {
    $Extensions = Get-Item $RegPath
    Write-Host "[ALERT] Found Force-Install Policy for Chrome Extensions:" -ForegroundColor Red
    $Extensions.Property | ForEach-Object {
        Write-Host "Extension ID: $_" -ForegroundColor Yellow
    }
} else {
    Write-Host "[INFO] No force-install Chrome policy detected in HKLM." -ForegroundColor Green
}

# 2. Scan for specific NWHStealer/NotnullOSX file hashes (Requires HashDB or manual check)
$TargetHashes = @( 
    "2494709b8a2646640b08b1d5d75b6bfb3167540ed4acdb55ded050f6df9c53b3", 
    "070402c2c531aa3a87b9ccd080532a51d17b01d982b205fc4487246d58de8913",
    "401c125517b1f845289bf0a7a33e5db0391034f631eab85dd65b76b7fec9a959"
)

Write-Host "Scanning drive C: for known malicious hashes..."
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0kb -and $_.Length -lt 50mb } | 
    ForEach-Object {
        $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($TargetHashes -contains $Hash) {
            Write-Host "[MALWARE FOUND] $($_.FullName) matches known malicious hash." -ForegroundColor Red
        }
    }

Write-Host "Hunt Complete."


---