OtterCookie, NWHStealer, and ClickFix: Multi-Vector Infostealer Surge — OTX Pulse Analysis

---
title: Potential Malicious NPM Package Execution (OtterCookie)
id: 8b0f6c22-5a7a-4e2b-9c1d-3a5e7f8b9a0e
status: experimental
description: Detects execution of suspicious Node.js processes often associated with malicious npm packages like OtterCookie spawning system shells or obfuscated scripts.
references:
    - https://otx.alienvault.com/pulse/6425a7b1c9b8a001
author: Security Arsenal
date: 2026/04/16
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\node.exe'
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\wscript.exe'
    condition: selection
falsepositives:
    - Legitimate development scripts spawning shells
level: high
---
title: Force-Installed Chrome Extension via Policy (ClickFix)
id: 9d1e7a33-6b8c-5f3c-0d2e-4b6f8g0c1d2e
status: experimental
description: Detects registry modifications that force-install Chrome extensions, a technique used by the ClickFix Brazilian banking campaign.
references:
    - https://otx.alienvault.com/pulse/6425a7b1c9b8a005
author: Security Arsenal
date: 2026/04/16
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    category: registry_set
detection:
    selection:
        TargetObject|contains: 'SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist'
    condition: selection
falsepositives:
    - Authorized IT administration deploying legitimate extensions
level: medium
---
title: Infostealer C2 Network Traffic
id: 0e2f8b44-7c9d-6a1e-1f3c-5d7g9h0i2j4k
status: experimental
description: Detects DNS queries or network connections to known C2 infrastructure associated with OtterCookie, NWHStealer, and Chrome Extension campaigns.
references:
    - https://otx.alienvault.com/pulse/6425a7b1c9b8a001
author: Security Arsenal
date: 2026/04/16
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: dns_query
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'cloudapi.stream'
            - 'get-proton-vpn.com'
            - 'newworld-helloworld.icu'
            - 'xpie348.online'
    condition: selection
falsepositives:
    - Unknown
level: critical


kql
// Hunt for suspicious process chains related to Node.js or npm (OtterCookie)
DeviceProcessEvents
| where Timestamp > ago(1d)
| where (InitiatingProcessFileName has "node.exe" or InitiatingProcessFileName has "npm.cmd")
  and (FileName in~ ("powershell.exe", "cmd.exe", "bash.exe") or ProcessCommandLine has "base64" or ProcessCommandLine has "Invoke-Expression")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, ProcessCommandLine, FileName

// Hunt for network connections to known C2 domains/IPs
DeviceNetworkEvents
| where Timestamp > ago(1d)
| where RemoteUrl has_any ("cloudapi.stream", "get-proton-vpn.com", "xpie348.online", "coockie.pro")
   or RemoteIP in ("144.172.110.228", "144.126.135.238", "83.217.209.88")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName


powershell
# IOC Hunt Script: Checks for Chrome Force-Install Policies and Suspicious File Locations
Write-Host "Checking for Chrome Extension Force-Install Policies..." -ForegroundColor Yellow
$regPath = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
if (Test-Path $regPath) {
    Get-Item $regPath | Select-Object -ExpandProperty Property | ForEach-Object {
        Write-Host "Found Force-Install Extension ID: $_" -ForegroundColor Red
    }
} else {
    Write-Host "No force-install policies found in HKLM." -ForegroundColor Green
}

Write-Host "`nChecking for suspicious NWHStealer/OtterCookie file artifacts..." -ForegroundColor Yellow
$suspiciousPaths = @(
    "$env:TEMP\node_modules",
    "$env:APPDATA\npm",
    "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions"
)
foreach ($path in $suspiciousPaths) {
    if (Test-Path $path) {
        Write-Host "Path exists: $path (Manual review recommended)" -ForegroundColor Cyan
    }
}