Phexia macOS Infostealer, NIKKE K2F Supply Chain RAT & VAPOR PANDA ARTEX: OTX Pulse Analysis — Enterprise Detection Pack

The five OTX pulses published 2026-11-04 through 2026-11-05 paint a consistent picture: credential theft is the connective tissue across every active campaign this week, spanning consumer phishing, supply chain compromise, and state-nexus espionage. Security teams should treat identity and credential infrastructure as the primary blast radius for all five reporting threads.

Phexia (WithSecure / AlienVault) is a modular macOS backdoor and infostealer distributed through ClickFix social engineering since late 2025. Victims are lured into pasting malicious commands into Terminal, which downloads shell scripts, establishes LaunchAgent persistence, and deploys AppleScript-based loaders. A May 2026 evolution introduced Polygon blockchain-based C2 resolution — a takedown-resistant dead-drop mechanism — and the payload roster includes XMRig cryptomining, MacSync, and Atomic macOS stealer modules targeting browser credentials, keychain data, and crypto wallets.

BO Team (Black Owl) executed a full-stack supply chain compromise of a software developer's infrastructure (Kaspersky ICS-CERT). Initial access came via CVE-2021-44228 (Log4Shell) against VMware vCenter, after which the actors seized domain controllers, Ansible orchestration, backups, and security tooling. Credential dumping with Nanodump and tunneling via Global Socket and ReverseSSH gave them durable, low-visibility access to nearly the entire estate.

The NIKKE PC launcher compromise (Level Infinite / PiyoLog) is a textbook CDN supply chain attack: four script files on the official CDN were tampered with between September 27 and November 4, 2026, pushing the K2F remote access agent to players. K2F executes arbitrary commands and steals credentials from browsers, cryptocurrency wallets, and cloud service tokens — meaning a trusted game update channel became a mass infostealer delivery mechanism for over a month.

GTA VI phishing lures (Netcraft) show opportunistic actors pre-positioning 121+ domains impersonating leaker 'CyberLeek' and Rockstar Games ahead of the November 19, 2026 release, harvesting credentials and pushing trojanized APKs and content lockers.

VAPOR PANDA (CrowdStrike) rounds out the set with the most strategically significant development: the China-nexus actor used the ARTEX AI-driven agentic framework with DeepSeek and commercial LLMs to orchestrate parallel intrusions against 200+ organizations — foreign ministries, semiconductor, defense, nuclear, and telecom — beginning October 17, 2026. Credential spraying is a primary initial access vector, with BLOODALCHEMY malware deployed post-compromise.

The collective signal: whether the lure is a fake GTA VI download, a poisoned game CDN, a ClickFix terminal paste, or AI-scaled credential spraying, the objective converges on identity material — browser stores, cloud tokens, AD credentials, and wallet keys.

Threat Actor / Malware Profile

Phexia (macOS Backdoor / Infostealer)

• Distribution: ClickFix campaigns — fake CAPTCHA/fix-it pages instructing users to paste base64 or curl commands into Terminal.
• Payload behavior: Multi-stage shell script droppers fetch AppleScript-based loaders; deploys Atomic macOS stealer modules (browser cookies, saved passwords, keychain, Telegram/session data, crypto wallets) and XMRig for resource theft.
• C2 communication: May 2026 evolution uses Polygon blockchain transactions as a dead-drop resolver for live C2 addresses, defeating static blocklists; fallback C2 over HTTPS to throwaway TLDs (.site, .xyz, .lol, .sbs).
• Persistence: LaunchAgents (user-level plist in ~/Library/LaunchAgents) masquerading as Apple/Google updaters.
• Anti-analysis: AppleScript obfuscation, DGA-style rotating domains, blockchain C2 indirection, and shell script staging that leaves minimal on-disk artifacts.

BO Team (Black Owl) — Supply Chain APT

• Initial access: CVE-2021-44228 (Log4Shell) against internet-facing VMware vCenter.
• Credential theft: Nanodump for LSASS memory dumping on domain controllers; Ansible vault and backup repository theft for lateral secrets.
• C2 / tunneling: Global Socket (gs-netcat) and ReverseSSH for NAT/firewall-traversing persistent access — both blend with legitimate admin tooling.
• Persistence: Hypervisor-level compromise (vCenter/ESXi) provides stealth below the guest OS EDR plane; backdoored orchestration playbooks re-infect rebuilt systems.

K2F (NIKKE Launcher Supply Chain RAT)

• Distribution: Tampered LuaJIT script files on the official Level Infinite CDN, delivered through the legitimate launcher update channel (Sept 27 – Nov 4, 2026).
• Payload behavior: Arbitrary command execution; credential harvesting from browsers, crypto wallets, and cloud service configuration files (~/.aws, gcloud, kubeconfig).
• C2: Infrastructure impersonating analytics services (analytics.insightjs.com, insightjs.org).
• Anti-analysis: Delivery through a signed, trusted update path bypasses most reputation controls.

VAPOR PANDA / ARTEX

• Distribution: AI-scaled credential spraying and password-guessing against internet-facing services, orchestrated by the ARTEX agentic framework leveraging DeepSeek and commercial LLMs for target triage, exploit selection, and parallel intrusion management.
• Payload: BLOODALCHEMY backdoor (documented China-nexus tooling) for persistent espionage access.
• C2: Domains spoofing legitimate infrastructure naming (sqlserver-sqlite.com, nginxmysql.com, www.ddduuuppp.com) to blend with database/web server traffic.
• Objective: Long-dwell espionage against foreign ministries, defense, semiconductor, nuclear, and telecom — 200+ organizations in parallel, a scale previously infeasible without agentic automation.

IOC Analysis

The indicator set spans four operational classes:

IPv4 addresses (C2 / infrastructure): 62.60.226.50 (Phexia), 89.126.250.172, 89.127.233.127 (K2F), 45.153.126.223 (VAPOR PANDA). These are blockable at egress but assume short TTLs — treat as retrospective hunt anchors (90 days of firewall/proxy/DNS logs) rather than forward-only controls.

Domains / hostnames: Phexia uses high-entropy throwaway TLDs (hf98x4d.site, apdhlhs3.xyz, d9mjs.sbs) consistent with DGA or bulk registration. K2F and VAPOR PANDA instead use impersonation domains (analytics.insightjs.com, sqlserver-sqlite.com, nginxmysql.com) engineered to survive analyst eyeballing. GTA VI lures (gta6cyberleek.com, contact-rockstargames.com, mygta6.icu) are newly registered domains — feed NRD feeds into your DNS security layer and alert on brand-keyword matches.

File hashes (MD5/SHA1/SHA256): BO Team Nanodump/tunneling tool hashes, K2F launcher payloads, and ARTEX/BLOODALCHEMY samples. Note the BO Team set is MD5-only — normalize and pivot to SHA256 via sandbox detonation or OTX pulse cross-reference before deploying EDR block policies, since MD5-only intel is fragile against recompilation.

CVEs: CVE-2021-44228 (Log4Shell) — five years post-disclosure and still delivering APT initial access. Any unpatched vCenter or Java middleware is an open door. CVE-2026-98432 (NIKKE launcher) should be checked against the vendor advisory.

Operationalization: Push all domains/IPs to DNS sinkhole and egress proxy blocklists; load hashes into EDR custom indicator lists (Defender AlertInfo/FileProfile, CrowdStrike IOC management); run retro-hunts on 90 days of DNS and netflow. For blockchain C2 (Phexia), static blocking fails — detection must key on behavior: LaunchAgent creation, AppleScript execution chains, and Terminal child processes spawned from browsers.

Detection Engineering

The following detections target the specific behaviors in these pulses: ClickFix-style Terminal/browser-to-shell execution and LaunchAgent persistence (Phexia), LSASS access by unsigned tooling (Nanodump / BO Team), and CDN-delivered script tampering with child-process spawning from game launchers (K2F).

---
title: Phexia macOS ClickFix — Browser-Spawned Terminal Shell Execution
id: 8f3a2c11-phex-4a01-b001-macclickfix01
status: experimental
description: Detects Terminal or shell processes spawned from browser processes followed by curl/osascript execution, consistent with ClickFix-delivered Phexia macOS infostealer staging.
author: Security Arsenal Threat Intelligence
references:
    - https://www.withsecure.com/en/resources-hub/w-labs/phexia-macos-malware
date: 2026/11/05
tags:
    - attack.initial_access
    - attack.t1204
    - attack.t1059.004
    - attack.t1059.007
logsource:
    product: macos
    category: process_creation
detection:
    selection_parent:
        ParentImage|contains:
            - 'Safari'
            - 'Google Chrome'
            - 'firefox'
    selection_child:
        Image|endswith:
            - '/zsh'
            - '/bash'
            - '/sh'
            - '/osascript'
            - '/curl'
    selection_cmd:
        CommandLine|contains:
            - 'curl'
            - 'base64'
            - 'osascript'
            - '| sh'
            - '| bash'
    condition: selection_parent and selection_child and selection_cmd
falsepositives:
    - Developer workflows invoking terminal from browser extensions
level: high
---
title: macOS LaunchAgent Persistence — Suspicious plist Creation (Phexia)
id: 8f3a2c12-phex-4a02-b002-launchagent02
status: experimental
description: Detects creation of LaunchAgent plist files by non-Apple processes, a persistence mechanism used by Phexia and Atomic macOS stealer.
author: Security Arsenal Threat Intelligence
date: 2026/11/05
tags:
    - attack.persistence
    - attack.t1543.001
    - attack.t1543.004
logsource:
    product: macos
    category: file_event
detection:
    selection_path:
        TargetFilename|contains:
            - '/Library/LaunchAgents/'
            - '~/Library/LaunchAgents/'
    selection_ext:
        TargetFilename|endswith: '.plist'
    filter_apple:
        Image|contains:
            - '/System/Library/'
            - 'com.apple.'
    condition: selection_path and selection_ext and not filter_apple
falsepositives:
    - Legitimate third-party software installers (MDM-enrolled agents)
level: medium
---
title: LSASS Memory Access by Unsigned Process — Nanodump / BO Team
id: 8f3a2c13-bote-4a03-b003-nanodump003
status: experimental
description: Detects suspicious access to LSASS memory by unsigned or non-standard processes, consistent with Nanodump credential dumping observed in BO Team intrusions.
author: Security Arsenal Threat Intelligence
references:
    - https://ics-cert.kaspersky.com/publications/reports/2026/11/05/supply-chain-attack-bo-team-in-a-software-developers-infrastructure/
date: 2026/11/05
tags:
    - attack.credential_access
    - attack.t1003.001
logsource:
    product: windows
    category: process_access
    service: sysmon
detection:
    selection_target:
        TargetImage|endswith: '\lsass.exe'
    selection_access:
        GrantedAccess|contains:
            - '0x1010'
            - '0x1FFFFF'
            - '0x1410'
    filter_legit:
        SourceImage|contains:
            - 'C:\Windows\System32\'
            - 'C:\Program Files\Microsoft Defender\'
            - 'C:\ProgramData\Microsoft\Windows Defender\'
    condition: selection_target and selection_access and not filter_legit
falsepositives:
    - EDR/AV products accessing LSASS (add your security tooling paths to filter)
level: critical

// Security Arsenal — OTX 2026-11-05 Unified IOC & Behavior Hunt
// Covers: Phexia C2, K2F supply chain RAT, VAPOR PANDA ARTEX, GTA VI phishing lures
let MaliciousDomains = dynamic([
    "hf98x4d.site","apdhlhs3.xyz","coeuzgoq.bahisbiz.com","vg5sgxv.lol",
    "d9mjs.sbs","couhe79.xyz","xzttyt.xyz",
    "analytics.insightjs.com","insightjs.org",
    "sqlserver-sqlite.com","nginxmysql.com","www.ddduuuppp.com",
    "gta6cyberleek.com","cyberleek.click","mygta6.icu","gta6keycodes.com",
    "cyberleek.my","contact-rockstargames.com","cyberleek.cfd","cyberleek.world"
]);
let MaliciousIPs = dynamic(["62.60.226.50","89.126.250.172","89.127.233.127","45.153.126.223"]);
let NetHits = DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl in~ (MaliciousDomains) or RemoteIP in (MaliciousIPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, ActionType
    | extend HuntTag = "Network-IOC";
let DNSHits = DeviceEvents
    | where TimeGenerated > ago(90d)
    | where ActionType == "DnsQueryResponse"
    | extend Query = tostring(parse_json(AdditionalFields).DnsQueryString)
    | where Query has_any (MaliciousDomains)
    | project TimeGenerated, DeviceName, Query, InitiatingProcessFileName
    | extend HuntTag = "DNS-IOC";
// Behavioral: game launcher or updater spawning shells/scripting (K2F pattern)
let LauncherAbuse = DeviceProcessEvents
    | where TimeGenerated > ago(45d)
    | where InitiatingProcessFileName has_any ("launcher","updater","Nikke")
    | where FileName in~ ("powershell.exe","cmd.exe","wscript.exe","cscript.exe","mshta.exe","curl.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, SHA256
    | extend HuntTag = "K2F-Launcher-Abuse";
union NetHits, DNSHits, LauncherAbuse
| sort by TimeGenerated desc

# Security Arsenal — Phexia / K2F / BO Team Endpoint IOC Hunt
# Run on Windows endpoints via your RMM/SCCM; adapt paths for fleet execution
$Report = @()

# --- 1. K2F / BO Team file hash presence (MD5 sample set from pulses) ---
$BadMD5 = @(
  "346b04985ec6c5d107ba0ddf32fe7691","5aa8c19c897176502cf8d8fc543fafc7",
  "5e04b2891635cbaa83ad619fe248e85b","68957de915e2a58339fa477f8078bdf4",
  "6d12efa1db15121f88d58b9952e301ef","719e813e527920e83349e061b5b1590f",
  "86ff08749e77d5d078e929e5f9748504","481e9b5ab8fb93406bf31980b53e0578",
  "bd0a6c382bd1fc44ef2669b6b0534d84"
)
$ScanPaths = @("$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA","C:\Users\Public","C:\ProgramData")
foreach ($p in $ScanPaths) {
  Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash -Algorithm MD5 -Path $_.FullName -ErrorAction SilentlyContinue).Hash
    if ($BadMD5 -contains $h.ToLower()) {
      $Report += [pscustomobject]@{Check='HashMatch'; Detail=$_.FullName; MD5=$h}
    }
  }
}

# --- 2. LSASS dump artifacts (Nanodump default output patterns) ---
$DumpPatterns = @("*lsass*.dmp","*nanodump*","*procdump*lsass*","*.dmp")
foreach ($pat in $DumpPatterns) {
  Get-ChildItem -Path $ScanPaths -Recurse -Filter $pat -ErrorAction SilentlyContinue | ForEach-Object {
    $Report += [pscustomobject]@{Check='LSASSDumpArtifact'; Detail=$_.FullName; MD5=''}
  }
}

# --- 3. Active connections to OTX-listed C2 IPs ---
$BadIPs = @("62.60.226.50","89.126.250.172","89.127.233.127","45.153.126.223")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
  $BadIPs -contains $_.RemoteAddress
} | ForEach-Object {
  $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
  $Report += [pscustomobject]@{Check='C2Connection'; Detail="$($_.RemoteAddress):$($_.RemotePort) [$proc]"; MD5=''}
}

# --- 4. Suspicious scheduled tasks / Run keys (persistence sweep) ---
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
                "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" -ErrorAction SilentlyContinue |
  ForEach-Object { $_.PSObject.Properties } | Where-Object {
    $_.Value -match 'appdata|temp|powershell|curl|mshta|wscript'
  } | ForEach-Object {
    $Report += [pscustomobject]@{Check='SuspiciousRunKey'; Detail="$($_.Name) = $($_.Value)"; MD5=''}
  }

if ($Report.Count -eq 0) { Write-Output "[+] No IOC hits on $env:COMPUTERNAME" }
else { $Report | Format-Table -AutoSize; $Report | Export-Csv ".\otx_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }

For macOS fleets (Phexia), deploy the Sigma rules above via your EDR and run: ls -la ~/Library/LaunchAgents/ | grep -v com.apple and ps aux | grep -i osascript to surface persistence and loader activity.

Response Priorities

Immediate (0–4 hours):

• Block all listed domains and IPs at DNS resolver, egress proxy, and firewall — prioritize analytics.insightjs.com / insightjs.org (K2F) and the VAPOR PANDA database-spoofing domains, which blend with legitimate traffic.
• Retro-hunt 90 days of DNS/netflow for all indicators; any K2F CDN-period hit (Sept 27 – Nov 4) means the NIKKE launcher delivered a RAT to that host.
• Search email gateways and web proxy logs for the 25 GTA VI phishing domains; quarantine and pull messages.
• Validate vCenter/ESXi patch posture against CVE-2021-44228 — BO Team proves Log4Shell is still yielding full-domain compromise.

24 Hours (identity-focused — all five pulses involve credential theft):

• Force password resets and session-token revocation for any user on a host with a confirmed Phexia, K2F, or phishing hit. Assume browser stores, keychain, cloud CLI tokens (~/.aws, gcloud, kubeconfig), and crypto wallets on the endpoint are compromised.
• Rotate service accounts, Ansible vault secrets, and CI/CD credentials if any BO Team-style infrastructure touch is detected — orchestration compromise means secrets are already exfiltrated.
• Review IdP sign-in logs for credential-spraying patterns (VAPOR PANDA/ARTEX): distributed low-and-slow attempts across many accounts, impossible travel, and MFA fatigue events. Enforce phishing-resistant MFA (FIDO2) on all remote-access and privileged accounts.
• Check dark web credential monitoring for corporate domains appearing in fresh infostealer logs — Phexia/Atomic Stealer output typically surfaces on Telegram and stealer-log markets within 48–72 hours.

1 Week (architecture hardening):

• Segment and re-architect hypervisor management planes: vCenter must never be internet-facing; isolate backup and orchestration (Ansible) infrastructure from general AD trust paths (BO Team lesson).
• For macOS fleets: deploy MDM controls blocking unsigned LaunchAgents, alert on browser→Terminal process chains, and consider Gatekeeper/lockdown policies for non-developer users (ClickFix mitigations).
• Audit CDN and third-party software update integrity controls — require hash/signature verification of launcher-side scripts (K2F lesson) and vendor notification SLAs for tamper events.
• Establish agentic-threat readiness: AI-orchestrated campaigns (ARTEX) mean intrusion volume and parallelism will keep scaling — prioritize identity attack surface reduction, credential hygiene automation, and SOC triage augmentation.
• Pre-register and monitor brand-keyword NRD feeds (your org + consumer brands your users follow) to catch lure infrastructure before campaigns peak.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub