OTX Pulse Analysis: Lumma, LofyStealer, and Supply Chain Attacks — Credential Theft Surge

title: Potential TeamPCP Python SDK Supply Chain Attack
id: 0c8f3c1e-1b2a-4a5c-9d6e-1f2g3h4i5j6k
date: 2026/05/02
status: experimental
description: Detects execution of msbuild.exe or suspicious processes spawned by python.exe, potentially indicating the TeamPCP trojanized SDK payload execution.
references:
    - https://hexastrike.com/resources/blog/threat-intelligence/ringing-in-chaos-how-teampcp-weaponized-the-telnyx-python-sdk
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\python.exe'
        Image|endswith:
            - '\msbuild.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    filter_legit_dev:
        CommandLine|contains: 'build'
    condition: selection and not filter_legit_dev
falsepositives:
    - Legitimate developer build environments
level: high
tags:
    - attack.execution
    - attack.supply_chain
    - attack.t1204

---

title: ClickFix PowerShell Execution Pattern
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
date: 2026/05/02
status: experimental
description: Detects PowerShell commands downloading MSI files, a technique used in ClickFix campaigns to deliver HijackLoader and Lumma Stealer.
references:
    - Internal OTX Analysis
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
    selection_download:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadFile'
    selection_msi:
        CommandLine|contains: '.msi'
    condition: all of selection_*
falsepositives:
    - System administration scripts
level: critical
tags:
    - attack.execution
    - attack.user_execution
    - attack.t1059.001

---

title: LofyStealer Node.js Loader Activity
id: 12345678-1234-1234-1234-123456789012
date: 2026/05/02
status: experimental
description: Detects Node.js processes spawning native Windows binaries, indicative of LofyStealer's loader executing its C++ payload.
references:
    - https://zenox.ai/en/lofystealer-malware-mirando-jogadores-de-minecraft
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\node.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Legitimate Node.js development
level: high
tags:
    - attack.defense_evasion
    - attack.t1202

// Hunt for TeamPCP C2 Domains and GhostSocks Infrastructure
let IoC_Domains = dynamic(["aquasecurtiy.org", "tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io", "retreaw.click", "serv.biz", "serv.xyz", "api.biz"]);
let IoC_IPs = dynamic(["24.152.36.241", "85.11.161.198"]);
let IoC_Hashes = dynamic(["6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a", "d21a5d08b4614005c8fcd9d0068f0190", "ddd2994acd25bde5ac32a03f1cf30b41", "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc"]);

// Network Connections
DeviceNetworkEvents
| where RemoteUrl in IoC_Domains or RemoteIP in IoC_IPs
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort

// Process Execution with Known Hashes
DeviceProcessEvents
| where SHA256 in IoC_Hashes or MD5 in IoC_Hashes or SHA1 in IoC_Hashes
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, SHA256
| union (
    // File Creation for hashes
    DeviceFileEvents
    | where SHA256 in IoC_Hashes or MD5 in IoC_Hashes
    | project Timestamp, DeviceName, FileName, FolderPath, SHA256
)

# IOC Hunter for TeamPCP, LofyStealer, and KYCShadow campaigns
# Checks running processes and specific file paths against known hashes.

$TargetHashes = @(
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "fb203c0ac030a97281960d7c28d86ebf",
    "ddd2994acd25bde5ac32a03f1cf30b41",
    "f31a8953531ffb5c14e2d8347e283e1f8f3c732a5a9a68f611c96f4730e8a7dc"
)

function Get-FileHashLocal {
    param ([string]$Path)
    if (Test-Path $Path) {
        $hash = Get-FileHash -Path $Path -Algorithm SHA256 -ErrorAction SilentlyContinue
        if ($hash) { return $hash.Hash }
    }
    return $null
}

# 1. Scan Running Processes
Write-Host "[+] Scanning running processes for malicious hashes..."
$Processes = Get-Process
foreach ($proc in $Processes) {
    try {
        $path = $proc.Path
        if ($path) {
            $fileHash = Get-FileHashLocal -Path $path
            if ($fileHash -in $TargetHashes) {
                Write-Host "[!] MALICIOUS PROCESS DETECTED: $($proc.ProcessName) (PID: $($proc.Id)) Path: $path" -ForegroundColor Red
            }
        }
    } catch {
        # Access denied errors expected for system processes
    }
}

# 2. Scan Common Cache/Temp Directories for Suspicious Files (LofyStealer/ClickFix)
Write-Host "[+] Scanning temp directories..."
$pathsToScan = @("$env:TEMP", "$env:APPDATA")
foreach ($targetPath in $pathsToScan) {
    if (Test-Path $targetPath) {
        Get-ChildItem -Path $targetPath -Recurse -Include *.msi, *.wav, *.exe -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = Get-FileHashLocal -Path $_.FullName
            if ($hash -in $TargetHashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 3. DNS Cache Check for TeamPCP C2
Write-Host "[+] Checking DNS Cache for malicious domains..."
$MaliciousDomains = @("aquasecurtiy.org", "retreaw.click", "serv.biz", "serv.xyz")
$DnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
if ($DnsCache) {
    foreach ($domain in $MaliciousDomains) {
        $matches = $DnsCache | Where-Object { $_.Entry -like "*$domain*" }
        if ($matches) {
            Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND: $domain" -ForegroundColor Yellow
            $matches | Format-Table Entry, Data, Type
        }
    }
}

Write-Host "Scan complete."