Powercat Java Stealer via Fake Xeno Roblox Cheats + keyv/cacheable npm Supply Chain Compromise: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Powercat Java Stealer Execution via Xbox Game Bar Masquerading
id: 9f1a2c44-7b21-4c9e-8f3a-pc2026080501
status: experimental
description: Detects Java runtime execution of payloads staged in Xbox Game Bar directories, consistent with the Powercat infostealer delivered via fake Xeno Roblox executors.
author: Security Arsenal Threat Intelligence
date: 2026/08/05
references:
    - https://www.bitdefender.com/en-us/blog/labs/fake-xeno-roblox-discord-executor
logsource:
    category: process_creation
    product: windows
detection:
    selection_java:
        Image|endswith:
            - '\java.exe'
            - '\javaw.exe'
    selection_path:
        CommandLine|contains:
            - 'XboxGameBar'
            - 'Xbox Game Bar'
    selection_param:
        CommandLine|contains:
            - '-jar'
            - '.jar'
    condition: selection_java and selection_path and selection_param
falsepositives:
    - Legitimate Java-based gaming tooling (rare in Xbox Game Bar paths)
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1036
---
title: Powercat C2 Communication to High-Entropy XYZ Domain
id: 9f1a2c44-7b21-4c9e-8f3a-pc2026080502
status: experimental
description: Detects DNS queries to the known Powercat C2 domain and high-entropy hex-style .xyz subdomains associated with the fake Xeno Roblox campaign.
author: Security Arsenal Threat Intelligence
date: 2026/08/05
logsource:
    category: dns
detection:
    selection_known:
        query|contains:
            - 'ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz'
    selection_heuristic:
        query|re: '^[a-f0-9]{48,}\.xyz$'
    condition: selection_known or selection_heuristic
falsepositives:
    - Rare legitimate hex-labeled .xyz services
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Malicious npm Preinstall Hook Spawning Bun Runtime
id: 9f1a2c44-7b21-4c9e-8f3a-npm2026080501
status: experimental
description: Detects npm install processes spawning Bun runtime or download utilities, consistent with the keyv/cacheable supply chain compromise executing preinstall payloads.
author: Security Arsenal Threat Intelligence
date: 2026/08/05
references:
    - https://www.netskope.com/blog/npm-stealer-reads-its-c2-from-an-ethereum-contract
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\npm.cmd'
            - '\npm.exe'
            - '\node.exe'
    selection_child:
        Image|endswith:
            - '\bun.exe'
            - '\curl.exe'
            - '\powershell.exe'
            - '\certutil.exe'
    selection_preinstall:
        CommandLine|contains:
            - 'preinstall'
    condition: selection_parent and (selection_child or selection_preinstall)
falsepositives:
    - Legitimate packages using Bun or preinstall scripts; baseline and tune against approved package lists
level: high
tags:
    - attack.initial_access
    - attack.t1195
    - attack.t1059

// Hunt: Powercat Java execution + npm preinstall abuse + Powercat C2 beaconing
let C2Domain = "ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz";
let PowercatHashes = dynamic(["0aadd62b535e683a5a2fe31fde546d07","0d03faf1764297c908158da77c8ffcae","163c8d117ef5a4e4e9c3e92a726af0eb","26a94168fa25af0bcb46a18ede50af86","2ead73ed62f1c2beb9043ce92e774e0b","1a462c76efc4e73725b9e95c4a00fddb","4bdaf7792e908f163ebef137854c571d"]);
let NpmHashes = dynamic(["54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668","9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc","fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb","4140f7e17e6f97f83aa3472473e01add","7bcf8d9f6834c44450eac145a967d2f2","f92ee93a0af971a3966bfa8efa9c2625"]);
union isfuzzy=true
(DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where (FileName in~ ("java.exe","javaw.exe") and ProcessCommandLine has "XboxGameBar")
     or (InitiatingProcessFileName in~ ("npm.cmd","npm.exe","node.exe")
         and (FileName =~ "bun.exe" or ProcessCommandLine has "preinstall" or ProcessCommandLine has "curl"))
     or (MD5 in (PowercatHashes) or MD5 in (NpmHashes) or SHA256 in (NpmHashes))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256, MD5
| extend HuntType = "Process/Hash"),
(DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl contains C2Domain or RemoteUrl matches regex @"^[a-f0-9]{48,}\.xyz$"
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend HuntType = "Network/C2")
| sort by TimeGenerated desc

# PowerShell IOC Hunt: Powercat + npm Supply Chain Compromise
$md5Hashes = @("0aadd62b535e683a5a2fe31fde546d07","0d03faf1764297c908158da77c8ffcae","163c8d117ef5a4e4e9c3e92a726af0eb","26a94168fa25af0bcb46a18ede50af86","2ead73ed62f1c2beb9043ce92e774e0b","1a462c76efc4e73725b9e95c4a00fddb","4bdaf7792e908f163ebef137854c571d","4140f7e17e6f97f83aa3472473e01add","7bcf8d9f6834c44450eac145a967d2f2","f92ee93a0af971a3966bfa8efa9c2625")
$c2Domain  = "ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz"

Write-Host "[1] Scanning Xbox Game Bar dirs for suspicious .jar payloads..."
$xboxPaths = @("$env:LOCALAPPDATA\Microsoft\XboxGameBar","$env:LOCALAPPDATA\Packages\Microsoft.XboxGamingOverlay*")
foreach ($p in $xboxPaths) {
    Get-ChildItem -Path $p -Recurse -Include *.jar,*.class,*.js -ErrorAction SilentlyContinue |
        ForEach-Object { Write-Host "  SUSPICIOUS: $($_.FullName)" }
}

Write-Host "[2] Hash-hunting user-writable directories..."
$scanDirs = @("$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA")
foreach ($d in $scanDirs) {
    Get-ChildItem -Path $d -Recurse -File -ErrorAction SilentlyContinue |
        Where-Object { $_.Length -lt 50MB } |
        ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($h -and ($md5Hashes -contains $h.ToLower())) {
                Write-Host "  IOC MATCH: $($_.FullName) [$h]"
            }
        }
}

Write-Host "[3] Checking for compromised npm packages (keyv/cacheable, Aug 2026)..."
$nmPaths = Get-ChildItem -Path "C:\","$env:USERPROFILE" -Recurse -Directory -Filter "node_modules" -ErrorAction SilentlyContinue -Depth 4
foreach ($nm in $nmPaths) {
    foreach ($pkg in @("keyv","cacheable")) {
        $pkgJson = Join-Path $nm.FullName "$pkg\package.json"
        if (Test-Path $pkgJson) {
            $meta = Get-Content $pkgJson | ConvertFrom-Json
            Write-Host "  FOUND $($pkg) v$($meta.version) at $pkgJson"
            if ($meta.scripts.preinstall) { Write-Host "  ALERT: preinstall hook present -> $($meta.scripts.preinstall)" }
        }
    }
}

Write-Host "[4] Checking DNS cache for Powercat C2..."
Get-DnsClientCache | Where-Object { $_.Entry -match $c2Domain -or $_.Entry -match "^[a-f0-9]{48,}\.xyz$" } |
    ForEach-Object { Write-Host "  C2 HIT: $($_.Entry) -> $($_.Data)" }

Write-Host "[5] Checking for Bun runtime drops..."
Get-ChildItem -Path "$env:USERPROFILE","C:\ProgramData" -Recurse -Filter "bun.exe" -ErrorAction SilentlyContinue -Depth 4 |
    ForEach-Object { Write-Host "  BUN FOUND: $($_.FullName)" }

Write-Host "Hunt complete. Review hits and isolate affected hosts."