NWHStealer, notnullOSX & ClickFix: OTX Analysis of Multi-Platform Infostealer Surge

title: Potential Malicious Chrome Extension Force Install via ClickFix
id: 8c4f9c21-1a2b-4c3d-8e5f-6a7b8c9d0e1f
description: Detects the modification of Chrome ExtensionInstallForcelist policies, a common technique in ClickFix campaigns to force-install malicious extensions like the Brazilian Banking Stealer.
status: experimental
date: 2026/04/16
author: Security Arsenal Research
references:
    - https://intel.breakglass.tech/post/clickfix-chrome-extension-banking-stealer-59-victims-unauthenticated-c2
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    registry:
        - create
        - modify
detection:
    selection:
        TargetObject|contains: '\Software\Policies\Google\Chrome\ExtensionInstallForcelist'
    filter:
        Details|contains: 'ghbmnnjooekpmoecnnnilnnbdlolhkhi' # Example of known good, adjust as needed
    condition: selection and not filter
falsepositives:
    - Legitimate administrative software deployment
level: high
---
title: Suspicious NWHStealer Fake VPN Installer Execution
id: a1b2c3d4-e5f6-4a5b-8c9d-0e1f2a3b4c5d
description: Detects execution of installers from suspicious paths or with names mimicking Proton VPN, a known vector for NWHStealer distribution.
status: experimental
date: 2026/04/16
author: Security Arsenal Research
references:
    - https://securityboulevard.com/2026/04/from-fake-proton-vpn-sites-to-gaming-mods-this-windows-infostealer-is-everywhere/
tags:
    - attack.execution
    - attack.t1204
logsource:
    product: windows
    process_creation:
    - create
detection:
    selection_img:
        Image|endswith:
            - '\setup.exe'
            - '\installer.exe'
            - '\updater.exe'
    selection_cli:
        CommandLine|contains:
            - 'proton'
            - 'vpn'
            - 'setup'
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate VPN software updates
level: medium
---
title: NKAbuse C2 Network Connection via NKN Blockchain
id: f0e1d2c3-b4a5-467b-8c9d-0e1f2a3b4c5d
description: Detects network connections to known NKAbuse infrastructure IPs or non-standard ports associated with NKN blockchain C2 activity observed in the CVE-2026-39987 exploit.
status: experimental
date: 2026/04/16
author: Security Arsenal Research
references:
    - https://www.sysdig.com/blog/cve-2026-39987-update-how-attackers-weaponized-marimo-to-deploy-a-blockchain-botnet-via-huggingface
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    network_connection:
    - create
detection:
    selection_ip:
        DestinationIp|contains:
            - '111.90.145.139'
            - '185.225.17.176'
            - '38.147.173.172'
    selection_port:
        DestinationPort in range:
            - 9000-10000 # Typical NKN node ranges vary, monitor for suspicious non-HTTP traffic
    condition: 1 of selection_*
falsepositives:
    - Legitimate blockchain node traffic (rare in typical corp env)
level: high

// Hunt for connections to malicious C2 infrastructure (ClickFix & Chrome Extension campaign)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("cloudapi.stream", "xpie348.online", "get-proton-vpn.com", "vpn-proton-setup.com") 
   or RemoteIP in ("144.126.135.238", "144.126.140.33", "83.217.209.88")
| extend DeviceCustom = pack_all()
| summarize Count=count(), Devices=dcount(DeviceId) by RemoteUrl, RemoteIP, DeviceName
| order by Count desc


kql
// Hunt for ClickFix execution pattern: PowerShell/Certutil downloading update.xml from non-Microsoft domains
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine contains "update.xml" 
   and (InitiatingProcessFileName =~ "powershell.exe" or InitiatingProcessFileName =~ "cmd.exe" or InitiatingProcessFileName =~ "certutil.exe")
| where ProcessCommandLine !contains "microsoft.com" and ProcessCommandLine !contains "windowsupdate.com"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, FolderPath

<#
.SYNOPSIS
    Hunt script for NWHStealer indicators and Chrome Extension persistence.
.DESCRIPTION
    Checks for specific file hashes mentioned in OTX pulses and suspicious Chrome registry policies.
#>

# Define NWHStealer Hashes from OTX Pulse
$MaliciousHashes = @( 
    "5cb3b902ae5993ae4e502f1c29cfb4e0", # MD5
    "2494709b8a2646640b08b1d5d75b6bfb3167540ed4acdb55ded050f6df9c53b3", # SHA256
    "e97cb6cbcf2583fe4d8dcabd70d3f67f6cc977fc9a8cbb42f8a2284efe24a1e3"  # SHA256
)

Write-Host "[+] Scanning for NWHStealer File Hashes..."
$PathsToScan = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\ProgramData", "$env:PUBLIC")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Length -gt 0kb -and $_.Length -lt 50mb } | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash.ToLower()
            if ($MaliciousHashes -contains $Hash) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for Malicious Chrome Extension Policies (ClickFix)..."
$RegPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
if (Test-Path $RegPath) {
    $Policies = Get-Item $RegPath
    $Policies.Property | ForEach-Object {
        $Val = Get-ItemProperty -Path $RegPath -Name $_
        # Alert on any forced extensions that are not standard corporate apps
        Write-Host "[!] Suspicious Chrome Policy Found: $_ = $($Val.$_)" -ForegroundColor Yellow
    }
} else {
    Write-Host "[-] No system-wide Chrome force-install policies detected."
}

Write-Host "[+] Checking for NWHStealer Domains in DNS Cache..."
$Domains = @("get-proton-vpn.com", "vpn-proton-setup.com", "newworld-helloworld.icu")
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($Domain in $Domains) {
    if ($DnsCache | Where-Object { $_.Entry -like "*$Domain*" }) {
        Write-Host "[!] Hit found in DNS Cache for: $Domain" -ForegroundColor Red
    }
}


---