Storm-3121/Storm-3032 Passkey AiTM Phishing + AI-Driven PaperCut Exploitation: OTX Pulse Analysis — Identity & Credential Defense Pack

---
title: Suspicious Passkey or Security Key Registration on User Account
title_note: Detects addition of FIDO2 passkey/security key following potential AiTM phishing - Storm-3121/3032 TTP
id: 7f3a1c2e-9b4d-4e1a-a8c5-2d6f9e1b3a44
status: experimental
description: Detects registration of new passkey or security key methods on Entra ID accounts, a persistence technique used by Storm-3121/Storm-3032 after AiTM or device code phishing. Correlate with sign-in from unusual ASN or helpdesk-themed inbound calls.
author: Security Arsenal Threat Intel
date: 2026/09/12
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
logsource:
    service: auditlogs
    product: azure
detection:
    selection:
        OperationName|contains:
            - 'Register security info'
            - 'Add FIDO2 security key'
            - 'User registered security info'
        TargetResources|contains:
            - 'Passkey'
            - 'Fido2AuthenticationMethod'
    condition: selection
falsepositives:
    - Legitimate new-hire passkey enrollment during onboarding
    - IT-driven hardware key rollouts
level: high
tags:
    - attack.persistence
    - attack.t1556
    - attack.t1078.004
---
title: OAuth Device Code Flow Authentication from Unusual Source
title_note: Detects device authorization grant abuse consistent with Storm-3121/3032 phishing
description: Identifies sign-ins using the OAuth 2.0 device code authentication protocol, which Storm-3121/Storm-3032 abuse by tricking victims into entering attacker-generated codes at microsoft.com/devicelogin.
id: 2b8d4e6a-1c3f-4a2b-b7d9-5e8a0c1f6d55
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/12
references:
    - https://www.microsoft.com/en-us/security/blog/2026/09/09/passkey-themed-social-engineering-leads-identity-cloud-compromise/
logsource:
    service: signinlogs
    product: azure
detection:
    selection:
        AuthenticationProtocol|contains:
            - 'deviceCode'
        Status|contains:
            - 'Success'
    condition: selection
falsepositives:
    - Legitimate CLI tooling (Azure CLI, Az PowerShell) on managed devices
    - IoT and kiosk device enrollment
level: medium
tags:
    - attack.credential_access
    - attack.t1550.004
    - attack.t1566
---
title: PaperCut Server Process Spawning Shell or Network Implant
title_note: Post-exploitation behavior for CVE-2026-81578 / CVE-2026-82078 AI-driven campaign
id: 9c1e5f7b-3d2a-4c8e-a6f1-8b3d7e2a9c66
status: experimental
description: Detects PaperCut print server processes (pc-app.exe, pc-server.exe, java.exe under PaperCut install paths) spawning shells, scripting interpreters, or proxy tooling, consistent with reverse shell and SOCKS proxy deployment observed in the AI-automated exploitation campaign.
author: Security Arsenal Threat Intel
date: 2026/09/12
references:
    - https://blackpointcyber.com/blog/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|contains:
            - '\PaperCut'
            - 'pc-app.exe'
            - 'pc-server.exe'
        ParentCommandLine|contains:
            - 'papercut'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\curl.exe'
            - '\nc.exe'
            - '\ncat.exe'
            - '\socat.exe'
    condition: selection_parent and selection_child
falsepositives:
    - PaperCut health-check scripts in tightly managed environments
level: critical
tags:
    - attack.execution
    - attack.t1059
    - attack.t1105
    - attack.t1090

// Security Arsenal - Hunt: Storm-3121/3032 passkey AiTM phishing domains + PaperCut post-exploitation
// Sentinel tables: DeviceNetworkEvents, DeviceProcessEvents, SigninLogs, AuditLogs

// Part 1: Endpoint connections to known passkey phishing infrastructure
let PhishDomains = dynamic(["setupmypasskey.com","validationsetupac.com","portalsetuphub.com","myconnectkey.com","oskeysync.com","keysyncos.com","oskeyregister.com","passkeyhelpdesk.com"]);
let PhishHits = DeviceNetworkEvents
| where TimeGenerated > ago(120d)
| where RemoteUrl has_any (PhishDomains)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName, InitiatingProcessFileName;
// Part 2: Passkey registration events following risky sign-ins (persistence)
let PasskeyReg = AuditLogs
| where TimeGenerated > ago(30d)
| where OperationName has_any ("Register security info","Add FIDO2 security key")
| extend Actor = tostring(InitiatedBy.user.userPrincipalName)
| project RegTime=TimeGenerated, Actor, CorrelationId, Result;
let DeviceCodeSignins = SigninLogs
| where TimeGenerated > ago(30d)
| where AuthenticationProtocol =~ "deviceCode" or AuthenticationRequirement == "singleFactorAuthentication"
| where ResultType == 0
| project SigninTime=TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName, AuthenticationProtocol, Location;
// Part 3: PaperCut processes spawning shells/proxies (CVE-2026-81578/82078 post-exploit)
let PaperCutExploit = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName has_any ("pc-app.exe","pc-server.exe") or InitiatingProcessCommandLine has "PaperCut"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","rundll32.exe","curl.exe","nc.exe","ncat.exe","socat.exe","wscript.exe")
| project ExploitTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName;
PhishHits
| union PasskeyReg, DeviceCodeSignins, PaperCutExploit
| sort by TimeGenerated desc

# Security Arsenal - IOC & Persistence Hunt: Passkey AiTM phishing + PaperCut exploitation implants
# Run elevated. Checks: phishing domain DNS cache, PaperCut child-process services/tasks, suspicious proxy listeners, and IOC file hashes.

$PhishDomains = @("setupmypasskey.com","validationsetupac.com","portalsetuphub.com","myconnectkey.com","oskeysync.com","keysyncos.com","oskeyregister.com","passkeyhelpdesk.com")
$IoCHashes = @(
  "08387ff35cc7854ddea1e2106b1150e9fe80646541c95c5a7121b77c9bc0228e",
  "092788c6598784d91b411dde40f274c73448f6c803f57c8d0ca85a22d0516e19",
  "243de5404091bcd920041cf2f4dd22e80f2c2922022854991d2b5e0ac78f2fee",
  "4cd2a9d574febb1545966561d598c57194da47b09f9175dd888e6aa5d267f91c",
  "5cc0eee4a1d8dbb737838e25f1e9ae37170a54ae757c431b5d6422904538bde3",
  "6106fa15dc10764114d039f26a96d793c559f04b080a27af9f2f27c2eeb391e0"
)

Write-Host "=== [1] DNS cache hits for passkey phishing domains ==="
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $PhishDomains) {
    $hit = $dns | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { Write-Host "[!] DNS CACHE HIT: $d" -ForegroundColor Red; $hit | Format-Table Entry, Data }
}

Write-Host "=== [2] Suspicious services/tasks rooted in PaperCut paths (implant persistence) ==="
Get-CimInstance Win32_Service -ErrorAction SilentlyContinue |
  Where-Object { $_.PathName -match 'PaperCut' -and $_.PathName -match 'cmd|powershell|pwsh|rundll32|nc\.exe|ncat|socat|temp|AppData' } |
  Select-Object Name, DisplayName, PathName, State | Format-List
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute -match 'powershell|cmd|wscript') -and
    ($_.TaskName -match 'print|papercut|sync|key|update|service')
} | Select-Object TaskName, TaskPath, State | Format-Table -AutoSize

Write-Host "=== [3] Listening SOCKS/proxy-style ports (1080, 1081, 8080, 9050) on non-standard processes ==="
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
  Where-Object { $_.LocalPort -in @(1080,1081,1085,8080,8888,9050,9051) } |
  ForEach-Object {
      $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
      [PSCustomObject]@{ Port=$_.LocalPort; Process=$p.ProcessName; Path=$p.Path; PID=$_.OwningProcess }
  } | Sort-Object Port -Unique | Format-Table -AutoSize

Write-Host "=== [4] Outbound connections to phishing IOC IPs/domains (live sessions) ==="
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -notmatch '^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)' } |
  ForEach-Object {
      try { $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName } catch { $rdns = "" }
      if ($PhishDomains | Where-Object { $rdns -like "*$_*" }) {
          Write-Host "[!] ACTIVE CONNECTION to phishing infra: $($_.RemoteAddress) ($rdns) PID $($_.OwningProcess)" -ForegroundColor Red
      }
  }

Write-Host "=== [5] Sweep common implant staging dirs for OTX SHA256 hashes ==="
$paths = @("$env:TEMP","$env:ProgramData","C:\Windows\Temp","$env:APPDATA","C:\Program Files\PaperCut MF")
foreach ($p in $paths) {
    if (Test-Path $p) {
        Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue |
          Where-Object { $_.Length -lt 50MB } | ForEach-Object {
              $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
              if ($IoCHashes -contains $h.ToLower()) {
                  Write-Host "[!] IOC HASH MATCH: $($_.FullName)  $h" -ForegroundColor Red
              }
          }
    }
}

Write-Host "=== [6] Recent passkey / device-code related auth artifacts in Windows Event Log (web signs proxied via browser) ==="
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-WebAuthN/Operational'; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'passkey|credential|register' } |
  Select-Object -First 25 TimeCreated, Id, Message | Format-List

Write-Host "=== Hunt complete. Escalate any [!] findings to IR. ==="