OTX Pulse Analysis: TeamPCP Supply Chain Attack, LofyStealer, & Lumma Campaigns

title: Potential TeamPCP PyPI Supply Chain Attack
id: 8a4f3b1c-9d2e-4f5a-8b1c-3d4e5f6a7b8c
description: Detects Python processes downloading potentially malicious files, specifically WAV or audio files, which may contain steganographic payloads as seen in the TeamPCP Telnyx SDK attack.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://hexastrike.com/resources/blog/threat-intelligence/ringing-in-chaos-how-teampcp-weaponized-the-telnyx-python-sdk
tags:
    - attack.initial_access
    - attack.t1195.002
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        InitiatorProcessName|endswith: '\python.exe'
        DestinationHostname|contains:
            - 'github.com'
            - 'pypi.org'
            - 'raw.githubusercontent.com'
    filter_legit:
        DestinationPort: 443
    condition: selection and not filter_legit
falsepositives:
    - Legitimate Python package management
level: high
---
title: Suspicious PowerShell ClickFix Activity
id: 1b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
description: Detects PowerShell commands executing obfuscated scripts or downloading MSI payloads from non-standard ports, indicative of ClickFix campaigns distributing Lumma Stealer.
status: experimental
date: 2026/05/04
author: Security Arsenal
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'IEX'
            - 'FromBase64String'
    selection_network:
        CommandLine|contains: '.msi'
    condition: all of selection_*
falsepositives:
    - System administration scripts
level: critical
---
title: LofyStealer Node.js Loader Execution
id: 2c3d4e5f-6a7b-8c9d-0e1f-2a3b4c5d6e7f
description: Detects the execution of Node.js processes with arguments suggestive of loading in-memory payloads or spawning suspicious child processes, associated with LofyStealer.
status: experimental
date: 2026/05/04
author: Security Arsenal
tags:
    - attack.defense_evasion
    - attack.t1055.012
logsource:
    category: process_creation
    product: windows
detection:
    selection_node:
        Image|endswith: '\node.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'eval'
            - 'Buffer'
            - 'child_process'
    condition: all of selection_*
falsepositives:
    - Legitimate Node.js development
level: medium

// Hunt for TeamPCP and ClickFix IOCs and behaviors
let IOCs = dynamic(["85.11.161.198", "retreaw.click", "serv.biz", "api.biz", "scan.aquasecurtiy.org"]);
let MaliciousHashes = dynamic(["6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a", "d21a5d08b4614005c8fcd9d0068f0190", "ddd2994acd25bde5ac32a03f1cf30b41"]);
// Network Connections to C2
DeviceNetworkEvents
| where RemoteUrl in~ IOCs or RemoteIP in~ IOCs
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| union (
    DeviceProcessEvents
    | where SHA256 in~ MaliciousHashes or MD5 in~ MaliciousHashes
    | project Timestamp, DeviceName, FileName, SHA256,FolderPath
)
| union (
    // Hunt for PowerShell downloading MSI (ClickFix)
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ "powershell.exe"
    | where ProcessCommandLine has ".msi" and (ProcessCommandLine has "Invoke-WebRequest" or ProcessCommandLine has "DownloadString")
    | project Timestamp, DeviceName, InitiatingProcessFileName, ProcessCommandLine
)

<#
.SYNOPSIS
    IOC Hunt for TeamPCP, LofyStealer, and KYCShadow related artifacts.
.DESCRIPTION
    Scans for specific file hashes, suspicious process names, and registry keys associated with the OTX pulses.
#>

$MaliciousHashes = @(
    "6cf223aea68b0e8031ff68251e30b6017a0513fe152e235c26f248ba1e15c92a",
    "8395c3268d5c5dbae1c7c6d4bb3c318c752ba4608cfcd90eb97ffb94a910eac2",
    "d21a5d08b4614005c8fcd9d0068f0190",
    "ddd2994acd25bde5ac32a03f1cf30b41"
)

$SuspiciousProcesses = @("chromelevator", "GrabBot", "node.exe")

Write-Host "[+] Scanning for malicious file hashes..."
foreach ($hash in $MaliciousHashes) {
    Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0 } | 
    ForEach-Object {
        $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($fileHash -eq $hash) {
            Write-Host "[!] MATCH FOUND: $($_.FullName)" -ForegroundColor Red
        }
    }
}

Write-Host "[+] Checking for suspicious running processes..."
Get-Process | Where-Object { $SuspiciousProcesses -contains $_.ProcessName } | 
Select-Object ProcessName, Id, Path | Format-Table

Write-Host "[+] Checking for recent Python/Node executions..."
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} -MaxEvents 1000 -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'python.exe' -or $_.Message -match 'node.exe' } |
Select-Object TimeCreated, Message | Format-List