Psychedelic Stealer ClickFix Campaign + MadApe Device Code Phishing + CVE-2026-73570: OTX Enterprise Detection Pack

---
title: Psychedelic Stealer ClickFix Execution
id: 8f3e2a1c-4b5d-4e6f-9a8b-7c6d5e4f3a2b
status: experimental
description: Detects ClickFix social engineering technique leading to msiexec execution of Psychedelic Stealer payloads
author: Security Arsenal
references:
    - https://connect.securonix.com/threat-research-intelligence-62/the-psychedelic-stealer-when-the-captcha-is-the-installer-582
date: 2026/11/01
tags:
    - attack.t1203
    - attack.t1218
detection:
    selection:
        Image|endswith: '\msiexec.exe'
        CommandLine|contains:
            - 'uasputnik.com'
            - 'fsputnik.com'
            - '/i http'
    condition: selection
falsepositives:
    - Legitimate administrative software installation via MSI
level: high
---
title: Zimbra CVE-2026-73570 Exploitation Attempt
id: 9a4f3b2d-5c6e-4f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects exploitation attempts against Zimbra Collaboration Suite SNMP notification path
author: Security Arsenal
date: 2026/11/01
tags:
    - attack.t1190
    - attack.t1059
detection:
    selection:
        Image|endswith:
            - '\java.exe'
            - '\zmmailboxd'
        CommandLine|contains:
            - 'snmp'
            - 'notification'
    filter:
        CommandLine|contains: 'zimbra'
    condition: selection and not filter
falsepositives:
    - Zimbra administrative scripts
level: critical
---
title: MadApe Device Code Phishing Indicators
id: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects suspicious process execution associated with MadApe phishing kit infrastructure
author: Security Arsenal
date: 2026/11/01
tags:
    - attack.t1566
    - attack.t1550
detection:
    selection:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        CommandLine|contains:
            - 'sucdens.com'
            - 'cepoffices.com'
            - 'zakosta.info'
            - 'nsboards.com'
    condition: selection
falsepositives:
    - Legitimate browsing to these domains (unlikely)
level: high

// Hunt for Psychedelic Stealer ClickFix execution and C2 communication
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("uasputnik.com", "fsputnik.com")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, SHA256
| join kind=leftouter (
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIP == "107.175.82.242" or RemoteUrl has_any ("uasputnik.com", "fsputnik.com")
) on DeviceName
| summarize by DeviceName, AccountName, ProcessCommandLine, RemoteIP, RemoteUrl

// Hunt for MadApe Device Code authentication anomalies
let MadApeDomains = dynamic(["sucdens.com", "cepoffices.com", "zakosta.info", "nsboards.com", "adastraerrans.com"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (MadApeDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
) on DeviceName
| summarize by DeviceName, RemoteUrl, InitiatingProcessFileName

// Hunt for Zimbra exploitation and webshell deployment
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "java.exe" or FolderPath has "zimbra"
| where ProcessCommandLine has_any ("snmp", "notification", "cmd", "bash", "wget", "curl")
| project TimeGenerated, DeviceName, ProcessCommandLine, FolderPath, SHA256
| join kind=leftouter (
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has ".jsp"
    | where SHA256 in ("dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a", "aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d")
) on DeviceName

# OTX Threat Intelligence IOC Hunt Script
# Checks for Psychedelic Stealer, MadApe, and Zimbra exploitation artifacts

$ErrorActionPreference = 'SilentlyContinue'

# Psychedelic Stealer Registry Persistence
Write-Host "[+] Checking for Psychedelic Stealer registry artifacts..." -ForegroundColor Cyan
$PsychedelicKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\Psychedelic",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Psychedelic",
    "HKCU:\Software\Classes\psychedeliclove"
)
foreach ($key in $PsychedelicKeys) {
    if (Test-Path $key) {
        Write-Host "[!] SUSPICIOUS: Found registry key $key" -ForegroundColor Red
        Get-ItemProperty $key | Select-Object *
    }
}

# Check for psychedeliclove.exe in common locations
$MalwarePaths = @(
    "$env:TEMP\psychedeliclove.exe",
    "$env:APPDATA\psychedeliclove.exe",
    "$env:LOCALAPPDATA\psychedeliclove.exe",
    "$env:ProgramData\psychedeliclove.exe"
)
foreach ($path in $MalwarePaths) {
    if (Test-Path $path) {
        Write-Host "[!] SUSPICIOUS: Found file $path" -ForegroundColor Red
        Get-FileHash $path -Algorithm SHA256
    }
}

# Browser extension check for native messaging bridge
Write-Host "[+] Checking browser native messaging hosts..." -ForegroundColor Cyan
$NativeMessagingPaths = @(
    "$env:LOCALAPPDATA\Google\Chrome\User Data\NativeMessagingHosts",
    "$env:APPDATA\Mozilla\NativeMessagingHosts",
    "HKLM:\SOFTWARE\Google\Chrome\NativeMessagingHosts",
    "HKCU:\SOFTWARE\Google\Chrome\NativeMessagingHosts"
)
foreach ($path in $NativeMessagingPaths) {
    if (Test-Path $path) {
        Get-ChildItem $path -Recurse -Filter "*.json" | ForEach-Object {
            $content = Get-Content $_.FullName -Raw | ConvertFrom-Json
            if ($content.path -like "*psychedelic*" -or $content.name -like "*psychedelic*") {
                Write-Host "[!] SUSPICIOUS: Found native messaging config $($_.FullName)" -ForegroundColor Red
                $content
            }
        }
    }
}

# Network connections to known C2
Write-Host "[+] Checking active network connections to C2 infrastructure..." -ForegroundColor Cyan
$C2IPs = @("107.175.82.242")
$Connections = Get-NetTCPConnection -State Established
foreach ($conn in $Connections) {
    if ($C2IPs -contains $conn.RemoteAddress) {
        Write-Host "[!] SUSPICIOUS: Active connection to C2 IP $($conn.RemoteAddress):$($conn.RemotePort)" -ForegroundColor Red
        $conn | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess
        Get-Process -Id $conn.OwningProcess | Select-Object ProcessName, Path
    }
}

# Check DNS cache for malicious domains
Write-Host "[+] Checking DNS cache for malicious domains..." -ForegroundColor Cyan
$MaliciousDomains = @("uasputnik.com", "fsputnik.com", "sucdens.com", "cepoffices.com", "zakosta.info", "psk1zim.abrdns.com", "aiok.me", "sorryios.io", "nuoda.vip")
$DNSCache = Get-DnsClientCache
foreach ($entry in $DNSCache) {
    foreach ($domain in $MaliciousDomains) {
        if ($entry.Entry -like "*$domain*") {
            Write-Host "[!] SUSPICIOUS: DNS cache entry for $($entry.Entry)" -ForegroundColor Red
        }
    }
}

# Check for Zimbra webshells
Write-Host "[+] Checking for suspicious JSP files (Zimbra webshells)..." -ForegroundColor Cyan
$WebDirs = @("C:\zimbra\jetty\webapps", "C:\opt\zimbra\jetty\webapps", "/opt/zimbra/jetty/webapps")
foreach ($dir in $WebDirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -Filter "*.jsp" | ForEach-Object {
            $hash = Get-FileHash $_.FullName -Algorithm SHA256
            $SuspiciousHashes = @("dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a", "aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d")
            if ($SuspiciousHashes -contains $hash.Hash.ToLower()) {
                Write-Host "[!] SUSPICIOUS: Found webshell $($_.FullName) with hash $($hash.Hash)" -ForegroundColor Red
            }
        }
    }
}

# Scheduled tasks check
Write-Host "[+] Checking scheduled tasks for persistence..." -ForegroundColor Cyan
$Tasks = Get-ScheduledTask | Where-Object {$_.TaskName -like "*psychedelic*" -or $_.TaskName -like "*update*"}
foreach ($task in $Tasks) {
    if ($task.Actions[0].Execute -like "*powershell*" -or $task.Actions[0].Execute -like "*cmd*") {
        Write-Host "[!] SUSPICIOUS: Scheduled task $($task.TaskName) - $($task.Actions[0].Execute) $($task.Actions[0].Arguments)" -ForegroundColor Red
    }
}

Write-Host "[+] IOC Hunt Complete" -ForegroundColor Green