Remus Stealer, ClickFix & AI Framework Abuse: Cross-Platform Infostealer Campaigns — OTX Pulse Analysis

title: Potential macOS ClickFix Terminal Download
id: 7a8e9f1a-2b3c-4d5e-6f7a-8b9c0d1e2f3a
description: Detects Terminal processes executing curl or wget commands to download executables, a pattern seen in ClickFix campaigns.
author: Security Arsenal
date: 2026/05/08
status: experimental
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: '/Terminal.app/Contents/MacOS/Terminal'
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_download:
    CommandLine|contains:
      - ' | sh'
      - 'chmod +x'
      - 'http://'
  condition: all of selection*
falsepositives:
  - Legitimate software installation via terminal
level: high
tags:
  - attack.execution
  - attack.t1059.04
---
title: Remcos/GhostLoader MSI Sideload via PowerShell
id: b9c0d1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
description: Detects PowerShell downloading MSI files which subsequently load DLLs from suspicious paths or via signed binaries, indicative of the OpenClaw Remcos campaign.
author: Security Arsenal
date: 2026/05/08
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'DownloadFile'
      - '.msi'
  selection_msiexec:
    Image|endswith: '\msiexec.exe'
    CommandLine|contains: '.msi'
  selection_sideload:
    Image|endswith:
      - '\GoToMeeting.exe'
      - '\g2mcomm.exe'
    CommandLine|contains: '.dll'
  timeframe: 5m
  condition: selection_ps and (selection_msiexec or selection_sideload)
falsepositives:
  - Legitimate GoToMeeting installation (rare via scripted MSI)
level: critical
tags:
  - attack.defense_evasion
  - attack.t1574.002
---
title: Remus Stealer Network Activity
id: 1c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
description: Detects outbound connections to known Remus Stealer C2 infrastructure IP addresses.
author: Security Arsenal
date: 2026/05/08
status: experimental
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp|startswith:
      - '217.156.122.'
      - '45.151.106.'
    DestinationPort:
      - 80
      - 443
      - 8080
  condition: selection
falsepositives:
  - Unknown (Specific IP ranges)
level: critical
tags:
  - attack.command_and_control
  - attack.c2

// Hunt for ClickFix style PowerShell/Command downloads and OpenClaw Remcos indicators
// Check for processes contacting known malicious domains
DeviceNetworkEvents
| where RemoteUrl has_any ("jihiz.com", "kayeart.com", "bintail.com", "malext.com", "miappl.com", "dropras.xyz", "trackpipe.dev")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| union (
    // Check for execution of files with known malicious hashes
    DeviceFileEvents
    | where SHA1 in ("470c3803bd5a4770eb5470a84a831f187f591c64") or MD5 in (
        "1c267cab0a800a7b2d598bc1b112d5ce", "2a5f619c966ef79f4586a433e3d5e7ba", 
        "2c4b7c8b48e6b4e5f3e8854f2abfedb5", "82536825e700f4c863238a90dd314687", 
        "cc1af839a956c8e2bf8e721f5d3b7373"
    )
    | project Timestamp, DeviceName, FileName, FolderPath, SHA1, MD5, InitiatingProcessAccountName
)
| order by Timestamp desc

<#
    IOC Hunter for OpenClaw/Remcos Campaign
    Scans for specific file hashes associated with the malicious MSI and DLL payloads.
#>

$MaliciousMD5 = @(
    "1c267cab0a800a7b2d598bc1b112d5ce",
    "2a5f619c966ef79f4586a433e3d5e7ba",
    "2c4b7c8b48e6b4e5f3e8854f2abfedb5",
    "82536825e700f4c863238a90dd314687",
    "cc1af839a956c8e2bf8e721f5d3b7373"
)

Write-Host "[+] Starting IOC Scan for OpenClaw Remcos/GhostLoader Artifacts..." -ForegroundColor Cyan

# Search C: Drive for files matching MD5 hashes
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
ForEach-Object {
    $file = $_
    try {
        $hash = (Get-FileHash -Path $file.FullName -Algorithm MD5 -ErrorAction Stop).Hash.ToLower()
        if ($MaliciousMD5 -contains $hash) {
            Write-Host "[!] MALICIOUS FILE DETECTED: $($file.FullName)" -ForegroundColor Red
            Write-Host "    MD5: $hash" -ForegroundColor Red
        }
    } catch {
        # Ignore access errors
    }
}

# Check for connections to Remus C2 IPs
Write-Host "[+] Checking active connections for Remus C2 IPs..." -ForegroundColor Cyan
$RemusIPs = @("217.156.122.57", "217.156.122.75", "217.156.122.12", "45.151.106.110")
$connections = Get-NetTCPConnection -ErrorAction SilentlyContinue

foreach ($ip in $RemusIPs) {
    $matches = $connections | Where-Object { $_.RemoteAddress -eq $ip }
    if ($matches) {
        Write-Host "[!] C2 CONNECTION DETECTED to $ip" -ForegroundColor Red
        $matches | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
    }
}

Write-Host "Scan Complete." -ForegroundColor Green