Supply Chain & AI-Driven Infostealers: AMOS, Lumma, and GlassWorm Campaigns — OTX Pulse Analysis

---
title: Potential ClickFix PowerShell Execution Pattern
id: 9c2e4d5f-1a3b-4c5d-9e6f-7a8b9c0d1e2f
description: Detects PowerShell commands often used in ClickFix campaigns to copy binaries or execute encoded scripts mimicking browser updates.
status: experimental
date: 2026/04/27
author: Security Arsenal
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'Copy-Item'
      - 'FromBase64String'
      - 'iex'
    CommandLine|contains:
      - 'chrome_update'
      - 'edge_update'
      - 'browser_fix'
  condition: selection
falsepositives:
  - Legitimate system administration scripts
level: high
tags:
  - attack.execution
  - attack.t1059.001
---
title: Malicious Python Package Import (Xinference Supply Chain)
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects the execution of specific Python versions or scripts associated with the malicious Xinference packages containing base64-encoded payloads.
status: experimental
date: 2026/04/27
author: Security Arsenal
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: '/python3'
    CommandLine|contains:
      - 'xinference'
      - '__init__.py'
    CommandLine|contains:
      - 'base64'
      - 'exec('
  condition: selection
falsepositives:
  - Legitimate usage of xinference library (verify versions)
level: critical
tags:
  - attack.initial_access
  - attack.t1195.002
---
title: Suspicious AppleScript Execution via Cursor AI
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
description: Detects macOS processes spawning osascript or AppleScript execution from Cursor AI related directories, indicative of AMOS Stealer delivery.
status: experimental
date: 2026/04/27
author: Security Arsenal
logsource:
  product: macos
  category: process_creation
detection:
  selection_parent:
    Image|contains: 'Cursor'
  selection_child:
    Image|endswith:
      - '/osascript'
      - '/AppleScript'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate automation scripts run by developers
level: high
tags:
  - attack.execution
  - attack.t1059.002

// Hunt for network connections to known malicious IPs and domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIP in ("94.154.172.43", "45.94.47.204", "92.246.136.14") 
   or RemoteUrl has_any ("arkypc.com", "mpasvw.com", "ustazazharidrus.com", "account-help.info")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteIP, RemoteUrl, RemotePort
| extend FullUrl = strcat("scheme://", RemoteUrl, ":", RemotePort)
| sort by Timestamp desc

// Hunt for suspicious PowerShell execution patterns related to ClickFix
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName == "powershell.exe"
| where ProcessCommandLine has "Copy-Item" and ProcessCommandLine has_any ("FromBase64String", "iex")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

# IOC Hunt Script for AMOS Stealer and TeamPCP C2 Infrastructure
# Checks for active network connections and suspicious processes

$MaliciousIPs = @(
    "94.154.172.43",
    "45.94.47.204",
    "92.246.136.14"
)

$MaliciousDomains = @(
    "arkypc.com",
    "mpasvw.com",
    "ustazazharidrus.com",
    "account-help.info",
    "elive123go.com"
)

Write-Host "[+] Checking for active network connections to known C2 IPs..." -ForegroundColor Cyan
$ActiveConnections = Get-NetTCPConnection -State Established | Select-Object -Property LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess

foreach ($IP in $MaliciousIPs) {
    $Found = $ActiveConnections | Where-Object { $_.RemoteAddress -eq $IP }
    if ($Found) {
        Write-Host "[!] WARNING: Connection to malicious IP $IP detected (PID: $($Found.OwningProcess))" -ForegroundColor Red
        try {
            $Process = Get-Process -Id $Found.OwningProcess -ErrorAction Stop
            Write-Host "    Process Name: $($Process.ProcessName)" -ForegroundColor Yellow
            Write-Host "    Path: $($Process.Path)" -ForegroundColor Yellow
        } catch {
            Write-Host "    Could not retrieve process details." -ForegroundColor Gray
        }
    }
}

Write-Host "[+] Checking for suspicious processes (osascript, python specific paths)..." -ForegroundColor Cyan
$SuspiciousProcesses = @("osascript", "python", "node")

foreach ($Proc in Get-Process) {
    if ($Proc.ProcessName -in $SuspiciousProcesses) {
        # Check if process is connecting to non-standard ports or known bad IPs (simplified logic)
        $Connections = $ActiveConnections | Where-Object { $_.OwningProcess -eq $Proc.Id }
        if ($Connections) {
            Write-Host "[*] Suspicious process found: $($Proc.ProcessName) (PID: $($Proc.Id))" -ForegroundColor DarkYellow
        }
    }
}