Powercat Infostealer Campaign: Fake Game Cheats Deploying Java Loader for Discord Session Hijacking & Crypto Theft — OTX Detection Pack

---
title: Powercat Infostealer - Fake Game Cheat Initial Execution
id: 9f2c41a7-3d1e-4b8a-a5c2-7e6f1d0b9a34
status: production
description: Detects execution of executables masquerading as game cheats/utilities from user-writable directories, consistent with Powercat stage-1 delivery targeting Roblox, Minecraft, and GTA V users.
author: Security Arsenal Threat Intelligence
references:
  - https://www.threatlocker.com/blog/powercat-malware-campaign-fake-game-cheats-deliver-infostealer-targeting-discord-roblox-and-crypto-wallets
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_keywords:
    Image|contains:
      - 'cheat'
      - 'hack'
      - 'trainer'
      - 'roblox'
      - 'minecraft'
      - 'gta'
      - 'mod'
      - 'exploit'
  filter_legit:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_path and selection_keywords and not filter_legit
falsepositives:
  - Legitimate open-source game mods installed by end users
  - Game modding tools run from Downloads folders
level: high
tags:
  - attack.initial_access
  - attack.t1204.002
---
title: Powercat Infostealer - Discord Token and Crypto Wallet Access
id: 1a7e5b2c-8f4d-4c9e-b3a1-6d0f2e8c5b77
status: production
description: Detects non-browser, non-Discord processes reading Discord Local Storage LevelDB files or cryptocurrency wallet browser extension storage, consistent with Powercat infostealer token and wallet theft.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
logsource:
  category: file_access
  product: windows
detection:
  selection_discord:
    TargetFilename|contains:
      - '\discord\Local Storage\leveldb'
      - '\discordcanary\Local Storage\leveldb'
      - '\discordptb\Local Storage\leveldb'
  selection_wallet:
    TargetFilename|contains:
      - 'nkbihfbeogaeaoehlefnkodbefgpgknn'  # MetaMask
      - 'bfnaelmomeimhlpmgjnjophhpkkoljpa'  # Phantom
      - 'ejbalbakoplchlghecdalmeeeajnimhm'  # MetaMask Flask
      - '\Exodus\'
      - '\Electrum\wallets'
  filter_legit_process:
    SourceImage|endswith:
      - '\discord.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\brave.exe'
      - '\firefox.exe'
  condition: (selection_discord or selection_wallet) and not filter_legit_process
falsepositives:
  - Backup software scanning AppData
  - Endpoint backup or DLP agents (whitelist by signer)
level: critical
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1528
---
title: Powercat Infostealer - Java Loader C2 and Persistence Behavior
id: 4c9d2f81-6b3a-4e7c-9d5f-2a1b8e0c7d46
status: production
description: Detects the Powercat Java-based loader stage - Java runtime processes spawned from user directories making network connections, and persistence via Run key registration by Java processes.
author: Security Arsenal Threat Intelligence
date: 2026/08/11
logsource:
  category: process_creation
  product: windows
detection:
  selection_java:
    Image|endswith:
      - '\java.exe'
      - '\javaw.exe'
  selection_userdir:
    Image|startswith:
      - 'C:\Users\'
      - 'C:\ProgramData\'
      - 'C:\Windows\Temp\'
  selection_parent:
    ParentImage|startswith:
      - 'C:\Users\'
  condition: selection_java and (selection_userdir or selection_parent)
falsepositives:
  - Legitimate Java-based games (Minecraft) - filter on signed Mojang launcher parent
  - Enterprise Java applications deployed to user profiles (rare)
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.command_and_control
  - attack.t1071.001

// Powercat Campaign Hunt: C2 communications, Java loader execution, and credential store access
// Microsoft Sentinel / Defender XDR - 7-day lookback
let PowercatIOCs = dynamic(["powercat.dog"]);
let SuspectHashes = dynamic([
    "a33a96cbd92eef15116c0c1dcaa8feb6eee28a818046ac9576054183e920eeb5",
    "a9b4823a1b2c0702a1eb8a1bf18db2d9c9604d2d2dd98a99f1d388bf7cfa71e3",
    "c0c3a0331b57d10d23a172a79bdf13ab066255de41774e5a19dd8a8e8446e1fa"]);
// Part 1: Network connections to Powercat C2
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (PowercatIOCs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
// Part 2: Java loader execution from user-writable paths
let JavaLoader = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("java.exe", "javaw.exe")
| where FolderPath has_any (@"\Users\", @"\ProgramData\", @"\AppData\") 
    or InitiatingProcessFolderPath has @"\Users\"
| where not(FolderPath has_any (@"Minecraft", @"Mojang", @"Eclipse Adoptium", @"Microsoft\jdk"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName, SHA256;
// Part 3: Execution of known Powercat file hashes
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where SHA256 has_any (SuspectHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName;
// Part 4: Suspicious processes accessing Discord token stores (via command-line indicators)
let DiscordAccess = DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any (@"Local Storage\leveldb", "discord", "leveldb", "nkbihfbeogaeaoehlefnkodbefgpgknn")
| where not(FileName in~ ("chrome.exe", "msedge.exe", "discord.exe", "brave.exe"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath;
union NetHits, JavaLoader, HashHits, DiscordAccess
| sort by TimeGenerated desc

# Powercat Infostealer Hunt Script
# Checks for persistence artifacts, C2 connections, Discord token theft staging, and known hashes
# Run elevated; intended for fleet-wide execution via RMM/Intune/Defender Live Response

$report = [System.Collections.Generic.List[object]]::new()

# 1. Check for known Powercat file hashes across user-writable directories
$suspectHashes = @(
    "a33a96cbd92eef15116c0c1dcaa8feb6eee28a818046ac9576054183e920eeb5",
    "a9b4823a1b2c0702a1eb8a1bf18db2d9c9604d2d2dd98a99f1d388bf7cfa71e3",
    "c0c3a0331b57d10d23a172a79bdf13ab066255de41774e5a19dd8a8e8446e1fa"
)

$scanPaths = @("$env:USERPROFILE\Downloads", "$env:TEMP", "C:\ProgramData", "$env:APPDATA")
foreach ($path in $scanPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -Include *.exe,*.jar -ErrorAction SilentlyContinue |
            ForEach-Object {
                $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($suspectHashes -contains $h.ToLower()) {
                    $report.Add([pscustomobject]@{Finding="IOC_HASH_MATCH"; Detail=$_.FullName; Hash=$h; Severity="CRITICAL"})
                }
            }
    }
}

# 2. Persistence: Run keys referencing user-writable paths, Java, or cheat-themed names
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue |
        ForEach-Object { $_.PSObject.Properties } |
        Where-Object { $_.Value -match "(java|javaw|AppData|Temp|ProgramData|cheat|trainer|roblox)" -and $_.Name -notmatch "^PS" } |
        ForEach-Object {
            $report.Add([pscustomobject]@{Finding="SUSPICIOUS_RUNKEY"; Detail="$key\$($_.Name) = $($_.Value)"; Hash=""; Severity="HIGH"})
        }
}

# 3. Scheduled tasks launching Java or binaries from user paths
Get-ScheduledTask | ForEach-Object {
    $actions = $_.Actions | Out-String
    if ($actions -match "(java|javaw|AppData|\\Temp\\)" -and $_.TaskPath -notmatch "Microsoft") {
        $report.Add([pscustomobject]@{Finding="SUSPICIOUS_SCHEDTASK"; Detail="$($_.TaskName) -> $actions"; Hash=""; Severity="HIGH"})
    }
}

# 4. Active or recent connections to the Powercat C2 domain
$dns = Resolve-DnsName -Name "powercat.dog" -ErrorAction SilentlyContinue
if ($dns) {
    foreach ($record in $dns) {
        $conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.RemoteAddress -eq $record.IPAddress }
        if ($conns) {
            foreach ($c in $conns) {
                $proc = (Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue).ProcessName
                $report.Add([pscustomobject]@{Finding="C2_CONNECTION"; Detail="$($record.IPAddress) via $proc (PID $($c.OwningProcess))"; Hash=""; Severity="CRITICAL"})
            }
        }
    }
}

# 5. DNS cache evidence of C2 resolution
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -match "powercat" } |
    ForEach-Object {
        $report.Add([pscustomobject]@{Finding="C2_DNS_CACHE"; Detail="$($_.Entry) -> $($_.Data)"; Hash=""; Severity="CRITICAL"})
    }

# 6. Java artifacts in user directories (loader staging)
Get-ChildItem -Path "$env:APPDATA","$env:LOCALAPPDATA","$env:TEMP" -Recurse -Filter *.jar -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
    ForEach-Object {
        $report.Add([pscustomobject]@{Finding="RECENT_JAR_IN_USERDIR"; Detail="$($_.FullName) (modified $($_.LastWriteTime))"; Hash=(Get-FileHash $_.FullName -Algorithm SHA256).Hash; Severity="MEDIUM"})
    }

if ($report.Count -eq 0) { Write-Host "[+] No Powercat indicators found on $env:COMPUTERNAME" -ForegroundColor Green }
else { $report | Format-Table -AutoSize; $report | Export-Csv -Path ".\powercat_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }