Octagon Android MaaS + APT36 Operation RapidRust + Mirage2FA AiTM Kit: OTX Pulse Analysis — Mobile Banking Fraud, GitHub C2 Backdoors, and M365 Session Hijacking Detection Pack | Security Arsenal

Three concurrent OTX pulses paint a consistent picture of the 2026 threat landscape: commoditized fraud tooling sold as a service, nation-state toolchains rebuilt in Rust with legitimate-platform C2, and industrial-scale adversary-in-the-middle phishing that neutralizes MFA. All three share a common denominator — they monetize or persist through stolen authenticated sessions, and all three defeat controls that enterprises still treat as sufficient.

Threat Summary

These pulses collectively reveal three distinct but converging threat streams:

Octagon (AndroidKitKat) — A previously undocumented Android fraud bot identified in June 2026, sold as malware-as-a-service by a Russian-speaking actor for $1,400/month. Octagon targets cryptocurrency wallets, exchanges, and banking applications using accessibility-service overlays, hidden VNC (HVNC), SMS interception, unlock-pattern capture, and in-app balance reading. The economics matter: at that price point, the buyer pool is wide, and financial-sector exposure extends to any organization whose customers or employees bank from mobile devices.
Operation RapidRust (APT36 / Transparent Tribe, Operation C-Major) — In August 2026, the Pakistan-nexus actor APT36 launched a refreshed campaign against government and defense organizations in India and Afghanistan. The updated arsenal includes RUSTYSHADE (a Rust-based backdoor using private GitHub repositories as C2 with AES-256-GCM encrypted tasking), RUSTYMOVE (USB-based lateral movement), PSNATCH and BASHNATCH (PowerShell/Bash credential and data stealers), GITSHELLPAD, and GOSHELL. This is a deliberate cross-platform toolchain rebuilt in Rust to evade signature-based detections tuned for APT36's historical .NET/CrimsonRAT tooling.
Mirage2FA (LinX Coders) — An active phishing-as-a-service kit performing Adversary-in-the-Middle (AiTM) attacks against Microsoft 365. It proxies real authentication flows, harvesting credentials and authenticated session cookies to bypass MFA. Analysis shows 63.7% of victims in the US (4,000+ victims), spanning Technology, Manufacturing, Education, Finance, Healthcare, and Telecommunications. Delivery uses HTML smuggling; C2/session relay rides WebSocket channels on lookalike domains.

Collective objective: session and credential theft at scale. Whether via mobile overlay fraud, nation-state espionage backdoors, or AiTM session replay, the endgame is the same — authenticated access that survives password resets because the session token itself is stolen.

Threat Actor / Malware Profile

Octagon (AndroidKitKat — MaaS, Russian-speaking)

Distribution: MaaS subscription ($1,400/mo); sideloaded APKs distributed via phishing and third-party app stores.
Payload behavior: Accessibility-service abuse for overlay injection over banking/crypto apps; HVNC for full remote device control; SMS interception for OTP theft; unlock-pattern capture; automated balance reading for fraud prioritization.
C2: Operator-controlled panels; HVNC channel for interactive sessions.
Persistence: Accessibility service retention, battery-optimization exemption requests, notification-listener abuse.
Anti-analysis: Overlay-based concealment of malicious UI state; emulator heuristics typical of modern Android bankers.

Operation RapidRust (APT36 / Operation C-Major)

Distribution: Spearphishing against government/defense targets in India and Afghanistan (targeting also touches British Indian Ocean Territory infrastructure).
Payload behavior: RUSTYSHADE provides remote tasking; PSNATCH (PowerShell) and BASHNATCH (Bash) harvest credentials and files on Windows and Linux respectively; RUSTYMOVE propagates via removable USB media — a classic air-gap/defense-network pivot; GITSHELLPAD and GOSHELL round out shell/staging capability.
C2: Private GitHub repositories as dead-drop/tasking infrastructure, with AES-256-GCM encrypted content — blending into legitimate developer traffic and defeating domain-reputation controls.
Persistence: Implant-specific (scheduled tasks / shell profiles typical of this actor's playbook).
Anti-analysis: Rust compilation (poor static signature coverage), encrypted C2 payloads, abuse of a trusted SaaS platform (GitHub) for command channels.

Mirage2FA (LinX Coders — PhaaS)

Distribution: Phishing emails with HTML smuggling attachments that assemble the lure client-side, evading gateway inspection.
Payload behavior: Reverse-proxy AiTM pages cloning Microsoft 365 login; captures credentials and post-authentication session cookies; relays over WebSocket channels for real-time session theft.
Scale: 4,000+ US victims (63.7% of observed total); also Canada, UK, India, Saudi Arabia, Singapore, South Africa.
Anti-analysis: HTML smuggling (no malicious binary crosses the wire), ephemeral lookalike domains (e.g., office.pcvgtech.store, ver.verpox.shop, adp.pslcertlive.site).

IOC Analysis

The indicator mix across these pulses breaks into two operational classes:

File hashes (MD5/SHA1/SHA256 — Octagon, RapidRust): Use for retro-hunting and blocking, not primary detection. Hash-only coverage decays fast against MaaS tooling where affiliates re-pack payloads. Ingest SHA256 values into your EDR blocklist and VirusTotal/OTX lookup pipelines; treat MD5/SHA1 as enrichment-only given collision and tooling drift. Priority pivot: submit RapidRust hashes to sandbox detonation to extract GitHub C2 repository paths — the repo URLs are the durable indicator.

Domains/hostnames (Mirage2FA): The 68-indicator set is dominated by lookalike phishing infrastructure (*.store, *.shop, *.site, *.info TLDs with corporate-name prefixes like office., adp., ans.). Operationalize via:

DNS sinkhole/proxy block on full domain list; alert (don't just block) on historical lookups for retro scoping.
TLS certificate transparency monitoring for lookalike patterns (*certlive*, *benefits*, *tech.store impersonating payroll/SSO brands).
WebSocket egress alerting: AiTM kits hold long-lived WS connections to relay sessions — unusual for standard browsing.

Tooling: OTX DirectConnect/API for pulse sync; YARA on unpacked APK/PE samples; git API monitoring for suspicious private-repo beaconing patterns; Suricata/Zeek JA3+WS logging for AiTM relay detection.

Detection Engineering

YAML

---
title: APT36 RUSTYSHADE GitHub C2 Beaconing
description: Detects periodic HTTPS connections to GitHub API/raw content endpoints from non-developer processes, consistent with RUSTYSHADE backdoor using private GitHub repositories for AES-256-GCM encrypted C2 in Operation RapidRust.
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'api.github.com'
      - 'raw.githubusercontent.com'
      - 'objects.githubusercontent.com'
  selection_process:
    Image|endswith:
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\cmd.exe'
  filter_dev_tools:
    Image|endswith:
      - '\git.exe'
      - '\code.exe'
      - '\devenv.exe'
      - '\idea64.exe'
  condition: selection_domain and selection_process and not filter_dev_tools
falsepositives:
  - Legitimate scripted GitHub API usage by IT automation
level: high
tags:
  - attack.command_and_control
  - attack.t1102
  - attack.t1573
status: experimental
date: 2026/09/17
---
title: Mirage2FA AiTM Phishing Infrastructure DNS Lookup
description: Detects DNS resolution of known Mirage2FA phishing-as-a-service lookalike domains used for Microsoft 365 session hijacking via adversary-in-the-middle WebSocket relay.
logsource:
  category: dns
detection:
  selection_exact:
    query|contains:
      - 'galatasaraydanhaberler.com'
      - 'sopbtech.store'
      - 'office.pcvgtech.store'
      - 'ver.verpox.shop'
      - 'cementslabconstruction.com'
      - 'adp.pslcertlive.site'
      - 'ans.rsxbenefits.com'
      - 'ari.vslbertlive.info'
  selection_pattern:
    query|contains:
      - 'certlive.'
      - 'bertlive.'
      - 'vtech.store'
  condition: 1 of selection_*
falsepositives:
  - Threat research and sandbox detonation
level: critical
tags:
  - attack.initial_access
  - attack.t1566
  - attack.t1557
  - attack.t1539
status: experimental
date: 2026/09/17
---
title: PowerShell Credential and Data Theft Staging Consistent with PSNATCH
description: Detects PowerShell execution patterns associated with APT36 PSNATCH stealer — encoded commands combined with browser credential store or document-staging access and outbound exfiltration.
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cli:
    CommandLine|contains:
      - '-enc'
      - '-encodedcommand'
      - 'FromBase64String'
  selection_target:
    CommandLine|contains:
      - 'Login Data'
      - 'Local State'
      - '\\Cookies'
      - 'Compress-Archive'
      - 'Invoke-WebRequest'
      - 'curl'
  condition: selection_img and (selection_cli or selection_target)
falsepositives:
  - Administrative automation scripts accessing browser profiles (rare)
level: high
tags:
  - attack.credential_access
  - attack.t1555
  - attack.t1059.001
  - attack.t1560
status: experimental
date: 2026/09/17

KQL — Microsoft Sentinel / Defender

// Mirage2FA AiTM + RapidRust GitHub C2 + Octagon hash retro-hunt
let PhishDomains = dynamic(["galatasaraydanhaberler.com","sopbtech.store","pcvgtech.store","verpox.shop","cementslabconstruction.com","pslcertlive.site","rsxbenefits.com","vslbertlive.info"]);
let OctagonHashes = dynamic(["3530b1600e059468e585d48482bb2f375edfe5cb5c23862b01d8405ab56376b9","41d922a220ac28a4af8cbed3ffff517bfc5087f11c52801a1be0353e22a71fe0"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(7d)
 | where RemoteUrl has_any (PhishDomains)
 | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, ActionType
 | extend Hunt = "Mirage2FA AiTM Domain"),
(DeviceNetworkEvents
 | where TimeGenerated > ago(7d)
 | where RemoteUrl has_any ("api.github.com","raw.githubusercontent.com")
 | where InitiatingProcessFileName in~ ("powershell.exe","cmd.exe","rundll32.exe","mshta.exe","wscript.exe")
 | summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Targets=make_set(RemoteUrl) by DeviceName, InitiatingProcessFileName, RemoteIP
 | extend Hunt = "RUSTYSHADE GitHub C2"),
(DeviceProcessEvents
 | where TimeGenerated > ago(7d)
 | where SHA256 has_any (OctagonHashes)
 | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessCommandLine
 | extend Hunt = "Known Pulse Hash Execution"),
(SigninLogs
 | where TimeGenerated > ago(3d)
 | where ResultType == 0
 | summarize Signins=count(), IPs=make_set(IPAddress), Locations=make_set(Location) by UserPrincipalName, bin(TimeGenerated, 10m)
 | where array_length(IPs) > 1
 | extend Hunt = "Possible Session Cookie Replay — Multi-IP Auth");

PowerShell

# RapidRust (PSNATCH) + AiTM artifact hunt — run elevated on Windows endpoints
# Checks: suspicious GitHub beaconing, Run-key persistence, recent USB staging, M365 AiTM DNS cache

Write-Host "[1] Persistence — Run keys with encoded/odd PowerShell" -ForegroundColor Cyan
$keys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
          "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
          "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($k in $keys) {
    if (Test-Path $k) {
        Get-ItemProperty $k | Get-Member -MemberType NoteProperty | ForEach-Object {
            $v = (Get-ItemProperty $k).($_.Name)
            if ($v -match "-enc|-encodedcommand|FromBase64String|githubusercontent") {
                Write-Host "  SUSPICIOUS: $k\$($_.Name) = $v" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[2] Non-developer processes with GitHub connections (RUSTYSHADE C2)" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemotePort -eq 443 } |
  ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p -and $p.ProcessName -match "powershell|cmd|rundll32|mshta|wscript") {
        $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName) 2>$null
        Write-Host "  CHECK: $($p.ProcessName) (PID $($p.Id)) -> $($_.RemoteAddress):443 $rdns" -ForegroundColor Yellow
    }
  }

Write-Host "[3] Recent USB-mounted volumes (RUSTYMOVE lateral movement)" -ForegroundColor Cyan
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR" -ErrorAction SilentlyContinue |
  ForEach-Object { Write-Host "  USB device: $($_.PSChildName)" }

Write-Host "[4] DNS cache — Mirage2FA AiTM lookalike domains" -ForegroundColor Cyan
$bad = "certlive","bertlive","pcvgtech","verpox","sopbtech","rsxbenefits","galatasaraydanhaberler","cementslabconstruction"
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $n = $_.Entry; $bad | Where-Object { $n -match $_ }
} | Select-Object Entry, Data | Format-Table -AutoSize

Write-Host "[5] Scheduled tasks invoking PowerShell/Bash-style stealers" -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $a = ($_.Actions | Out-String)
    if ($a -match "powershell.*-enc|curl|Invoke-WebRequest|wget") {
        Write-Host "  REVIEW TASK: $($_.TaskName) :: $($a.Trim())" -ForegroundColor Yellow
    }
}
Write-Host "Hunt complete. Escalate Red findings to IR immediately." -ForegroundColor Green

Response Priorities

Immediate (0–4h)

Block all Mirage2FA domains/hostnames at DNS, proxy, and email gateway; sinkhole and alert on resolution for retro scoping of the 68-indicator set.
Push Octagon and RapidRust SHA256 hashes to EDR blocklists; sweep mobile fleet (via MDM) for unknown sideloaded APKs with accessibility-service grants.
Alert on non-developer process egress to api.github.com / raw.githubusercontent.com — potential RUSTYSHADE C2.
Hunt for USB-mount artifacts on defense/government-adjacent endpoints (RUSTYMOVE vector).

24 hours

Because Mirage2FA steals sessions, not just passwords: force revocation of all active M365 refresh tokens (Revoke-AzureADUserAllRefreshToken / revoke sessions in Entra ID) for any user who resolved a listed domain — password resets alone do not evict stolen session cookies.
Review SigninLogs for multi-IP/impossible-travel authentications indicating cookie replay; audit newly created inbox rules and OAuth consent grants post-compromise.
Identity verification for finance/HR personnel with crypto-wallet or banking-app access from managed Android devices.

1 week

Deploy phishing-resistant MFA (FIDO2/passkeys) for M365 — AiTM proxies cannot replay hardware-bound authenticators; this is the architectural kill-shot for Mirage2FA-class kits.
Enforce conditional access + token binding/continuous access evaluation so stolen cookies expire against device/compliance context.
Restrict outbound GitHub API access to sanctioned developer identities/hosts via egress proxy policy (RapidRust C2 denial).
MDM policy hardening: block sideloading, alert on accessibility-service grants outside an allowlist, and deploy mobile threat defense against Octagon-class overlay/HVNC bankers.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Octagon Android MaaS + APT36 Operation RapidRust + Mirage2FA AiTM Kit: OTX Pulse Analysis — Mobile Banking Fraud, GitHub C2 Backdoors, and M365 Session Hijacking Detection Pack