title: Potential Fake Browser Update or SocGholish Activity
description: Detects execution of script files often associated with fake browser updates leading to malware loaders like IcedID or Pikabot.
references:
  - https://otx.alienvault.com/pulse/operation-endgame-vs-socgholish-fake-updates/
author: Security Arsenal
date: 2026/06/19
tags:
  - attack.initial_access
  - attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
    CommandLine|contains:
      - '.js'
      - '.jse'
      - 'update.js'
      - 'chrome_update'
      - 'firefox_update'
  condition: selection
falsepositives:
  - Legitimate administrative scripts
level: high
---
title: Potential ClickFix Fake CAPTCHA Execution
description: Detects suspicious PowerShell commands often copy-pasted by victims tricked by fake CAPTCHAs or browser errors.
references:
  - https://otx.alienvault.com/pulse/clickfix-campaign-generated-via-ai-delivers-smartrat/
author: Security Arsenal
date: 2026/06/19
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_pwsh:
    Image|endswith: '\powershell.exe'
    ParentImage|contains:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
  selection_cli:
    CommandLine|contains:
      - 'clipboard'
      - 'Get-WinUserLanguageList'
      - 'FromBase64String'
      - 'iex'
  condition: all of selection_*
falsepositives:
  - Low
level: critical
---
title: Okendo Reviews Compromise - Suspicious Outbound Connection
description: Detects potential C2 callbacks associated with the SmartApeSG Okendo supply chain attack.
references:
  - https://otx.alienvault.com/pulse/okendo-reviews-supply-chain-attack/
author: Security Arsenal
date: 2026/06/19
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains:
      - 'wigetticks.com'
      - 'wizzleticks.com'
  condition: selection
falsepositives:
  - None
level: critical

// Hunt for suspicious PowerShell execution patterns associated with ClickFix/SmartRAT
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("clipboard", "iex", "FromBase64String") 
| where InitiatingProcessFileName in~ ("chrome.exe", "firefox.exe", "msedge.exe", "iexplore.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend FullURL = extract(@'(https?://[\w.-]+)', 1, ProcessCommandLine)
| distinct Timestamp, DeviceName, FullURL

// Hunt for network connections to IOCs related to INC Ransomware and SocGholish
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any ("incblog.su", "windowsupdate-cdn.com", "crefisa.online", "wiggett", "wizzle") 
   or RemoteIP in ("162.141.111.227")
| summarize count() by DeviceName, RemoteUrl, RemoteIP
| order by count_ desc

<#
.SYNOPSIS
    Hunt script for indicators associated with June 2026 OTX Pulses.
.DESCRIPTION
    Checks for file presence of known SmartRAT/INC hashes and registry keys for persistence.
#>

$IOC_Hashes = @(
    "6cd349eda0fa6c8b274a0920852c68f8b727afea1fdbc69ad183cef05d9cf141", # INC Ransomware
    "297eb45f028d44d750297d2f932b9c91", # SmartRAT variant
    "3c72e1f37f115b00c3ad6ed31bacfe8a",
    "6bf4d4c62b5138ace281ce3d08297787",
    "b17ccdb5531555e43f082d6e77c07227",
    "46e32500cd24395dd140293758e72fe8671217f5f5b0307858fc118a125aab8c"  # ACRStealer/LummaC2
)

$SearchPaths = @("C:\Windows\Temp", "$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:LOCALAPPDATA")

Write-Host "[+] Hunting for malicious file hashes..." -ForegroundColor Cyan

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Where-Object { !$_.PSIsContainer } | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hash -in $IOC_Hashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName) (SHA256: $hash)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "[+] Checking for suspicious Scheduled Tasks (SmartRAT/ClickFix persistence)..." -ForegroundColor Cyan

Get-ScheduledTask | Where-Object { $_.State -eq 'Ready' -and $_.Actions.Execute -like '*powershell*' } | ForEach-Object {
    $taskAction = $_.Actions.Execute + " " + $_.Actions.Arguments
    if ($taskAction -match 'clipboard|FromBase64String|iex') {
        Write-Host "[!] SUSPICIOUS TASK FOUND: $($_.TaskName)" -ForegroundColor Yellow
        Write-Host "    Action: $taskAction" -ForegroundColor Gray
    }
}

Write-Host "[+] Hunt complete."


# Response Priorities

*   **Immediate:**
    *   Block all listed IOCs (domains, IPs, hashes) at the firewall, proxy, and EDR levels.
    *   Isolate endpoints exhibiting PowerShell execution chains spawned from web browsers (ClickFix behavior).
    *   Review e-commerce platforms for the `okendo-reviews.js` file version; roll back to a clean version if compromised.

*   **24 Hours:**
    *   Initiate credential resets for accounts accessible from endpoints where SmartRAT or Infostealers (LummaC2, ACRStealer) were detected.
    *   Conduct forensic analysis on the specific file hashes identified in the "May 2026 Infostealer Trend" pulse to determine data exfiltration scope.

*   **1 Week:**
    *   Update script blocking policies (CSP) to prevent unauthorized JavaScript loading on external customer-facing sites.
    *   Implement browser isolation or strict URL filtering for typosquatting domains targeting financial institutions.
    *   Review vendor access and supply chain security for third-party widgets like Okendo.