Supply Chain Wallet Drainers, SEO-Poisoned RATs, and ClipBanker Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

Three active threat intelligence pulses published on AlienVault OTX on 2026-10-30 reveal a coordinated uptick in financially motivated cybercrime operations targeting cryptocurrency assets and enterprise environments. These campaigns demonstrate the continued evolution of social engineering, supply chain compromise, and clipboard hijacking techniques designed to exfiltrate digital assets and establish persistent access to victim systems.

Campaign 1 — Polymarket Supply Chain Compromise: Threat actors have compromised DebugBear, a legitimate third-party performance monitoring service integrated into the Polymarket cryptocurrency prediction market platform. Malicious JavaScript hosted on DebugBear's CDN (content delivery network) was designed to intercept authenticated trading sessions, enumerate user portfolios, and initiate unauthorized cryptocurrency transfers to attacker-controlled wallet addresses. This represents a sophisticated supply chain attack exploiting trusted third-party integrations to bypass traditional security controls.

Campaign 2 — Kong RAT Distribution via SEO Poisoning: A Chinese-language threat actor is operating an extensive search engine optimization (SEO) poisoning campaign targeting users searching for DeepSeek AI tools. The attack chain begins with weaponized MSI installer files disguised as legitimate DeepSeek software, delivered through malicious lookalike domains positioned on first-page search results. The multi-stage infection employs shellcode execution, DLL side-loading via legitimate Cygwin utilities, and scheduled task persistence to deploy Kong RAT (Remote Access Trojan), a full-featured backdoor capable of keylogging, screen capture, file exfiltration, and remote command execution.

Campaign 3 — ClipBanker Malware Infrastructure: Multiple ClipBanker malware families — including AnimateClipper, ZigClipper, Efimer, and CryptoBandit — are actively targeting cryptocurrency users through clipboard hijacking. These malware variants monitor Windows clipboard activity for cryptocurrency wallet address patterns (Bitcoin, Ethereum, Monero, etc.) and silently replace legitimate addresses with attacker-controlled wallets before transactions are signed. The campaigns leverage ClickFix social engineering tactics and phishing pages to distribute initial payloads, with command-and-control (C2) infrastructure hosted on both clearnet domains and Tor hidden services.

Collectively, these campaigns demonstrate threat actors' continued focus on cryptocurrency theft through diverse attack vectors: supply chain compromise of trusted web services, search engine manipulation to distribute RATs, and clipboard monitoring to intercept financial transactions. Organizations in the finance, technology, and cryptocurrency sectors face elevated risk from these threats.

Threat Actor / Malware Profile

Kong RAT (Campaign 2)

Distribution Method: SEO poisoning campaign leveraging malicious domains optimized to rank highly in search results for DeepSeek AI-related queries. Users are directed to weaponized MSI installer packages masquerading as legitimate DeepSeek software.

Payload Behavior: Multi-stage infection chain:

Stage 1: Malicious MSI installer drops loader components
Stage 2: Shellcode execution via process injection
Stage 3: DLL side-loading using legitimate Cygwin utilities (likely cygwin1.dll abuse)
Stage 4: Kong RAT payload deployment with full remote access capabilities

C2 Communication: While specific C2 protocols were not detailed in the pulse metadata, Kong RAT typically communicates over TCP/HTTP(S) to attacker-controlled servers for command receipt and data exfiltration.

Persistence Mechanism: Scheduled task creation for automatic execution at system startup or user logon.

Anti-Analysis Techniques: DLL side-loading leverages legitimate, signed binaries to evade application whitelisting and behavioral detection. Multi-stage execution complicates static analysis and sandbox detonation.

Targeted Functionality: Keylogging, screen capture, file system access, remote shell, credential harvesting.

ClipBanker Families — AnimateClipper, ZigClipper, Efimer, CryptoBandit (Campaign 3)

Distribution Method: ClickFix social engineering campaigns (fake browser update prompts, counterfeit CAPTCHA verification pages) and phishing emails with malicious attachments.

Payload Behavior: Continuous monitoring of Windows clipboard (OpenClipboard, GetClipboardData API calls) for cryptocurrency wallet address patterns matching regex signatures for Bitcoin (bc1, 1, 3 prefixes), Ethereum (0x), Monero, and other blockchain address formats. Upon detection, the malware replaces the legitimate address with an attacker-controlled wallet from a hardcoded or C2-retrieved address pool.

C2 Communication: Pulse indicators reveal C2 infrastructure hosted on:

Clearnet domains (e.g., wantsellonline.com, muaklekcoop.com, tuasesoriadigital.es)
Tor hidden services (e.g., gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion)
Malicious executable downloads (e.g., https://microlsireqjn.com/nvd_driver_dll.exe)

Persistence Mechanism: Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) and scheduled tasks.

Anti-Analysis Techniques: Packing/obfuscation, delayed execution, environment checks for virtual machines and sandboxes.

Polymarket Supply Chain Attack (Campaign 1)

Attack Vector: Compromise of DebugBear CDN infrastructure hosting JavaScript performance monitoring code integrated into Polymarket's web application.

Payload Behavior: Malicious JavaScript designed to:

Access authenticated Polymarket trading sessions (likely via session token theft or DOM manipulation)
Enumerate user cryptocurrency portfolio balances
Initiate unauthorized asset transfers to attacker-controlled wallet addresses
Search for active trading clients and Web3 wallet signers within the user's browser session

Delivery Mechanism: Supply chain compromise — legitimate third-party JavaScript loaded by Polymarket was modified to include malicious wallet-draining functionality.

Attribution: Unknown threat actor. TLP:WHITE classification indicates public disclosure for defensive purposes.

IOC Analysis

The OTX pulses contain 179 total indicators across multiple types:

Indicator Breakdown

File Hashes (SHA256, SHA1, MD5): 11+ file hashes representing malicious MSI installers, Kong RAT payloads, ClipBanker executables, and the malicious JavaScript payload from the Polymarket breach.

Domains: 4 clearnet domains associated with ClipBanker C2 infrastructure and payload hosting:

wantsellonline.com
muaklekcoop.com
tuasesoriadigital.es
microlsireqjn.com
peniclean.com

URLs: Specific malicious URLs for payload delivery:

https://tuasesoriadigital.es/default.dat (likely second-stage payload)
https://microlsireqjn.com/nvd_driver_dll.exe (disguised as NVIDIA driver)
https://peniclean.com/nvd_driver_dll.exe

Tor Hidden Services: 1 onion address indicating darknet C2 infrastructure:

gfoqsewps57xcyxoedle2gd53o6jne6y5nq5eh25muksqwzutzq7b3ad.onion

Operationalization Guidance

File Hash IOCs:

Ingest into EDR/XDR platforms (Microsoft Defender for Endpoint, CrowdStrike, SentinelOne) for retroactive hunting and real-time blocking
Add to threat intelligence platform (TIP) watchlists (MISP, ThreatConnect, Anomali)
Deploy via custom indicators in Microsoft Sentinel, Splunk Enterprise Security
Tools: Get-FileHash (PowerShell), VirusTotal Enterprise, Hybrid Analysis for hash lookups

Domain/URL IOCs:

Block at DNS layer (Cisco Umbrella, Infoblox, Pi-hole)
Add to web proxy blocklists (Zscaler, Palo Alto URL Filtering)
Monitor DNS query logs for historical lookups
Sinkhole if infrastructure is seized
Tools: nslookup, dig, passive DNS (SecurityTrails, PassiveTotal)

Onion Addresses:

Monitor for Tor network usage in corporate environments (unexpected Tor traffic is often malicious)
Deploy Tor exit node blocklists at network perimeter
Hunt for Tor browser installations on endpoints

Retroactive Hunting: Query SIEM/EDR for file hash matches, DNS queries to listed domains, and network connections to suspicious infrastructure over the past 30-90 days.

Detection Engineering

YAML

---
title: Kong RAT DLL Side-Loading via Cygwin
description: Detects potential DLL side-loading activity involving Cygwin utilities, consistent with Kong RAT deployment tactics observed in SEO poisoning campaigns
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_cygwin:
    Image|endswith:
      - '\cygwin1.dll'
      - '\cygcheck.exe'
      - '\bash.exe'
    CommandLine|contains:
      - '.msi'
      - 'deepseek'
  filter_legitimate:
    ParentImage|endswith:
      - '\cygwin64\\bin\\mintty.exe'
      - '\cygwin\\bin\\mintty.exe'
  condition: selection_cygwin and not filter_legitimate
falsepositives:
  - Legitimate Cygwin installations for development purposes
level: high
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.execution
  - kong_rat
  - seo_poisoning
date: 2026/11/01

---
title: ClipBanker Clipboard Monitoring and Replacement
description: Detects suspicious process access to Windows clipboard APIs, potentially indicating ClipBanker malware attempting to hijack cryptocurrency addresses
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_clipboard:
    CommandLine|contains:
      - 'GetClipboardData'
      - 'OpenClipboard'
      - 'SetClipboardData'
  selection_wallet_pattern:
    CommandLine|contains:
      - 'bc1'
      - '0x'
      - 'regex'
      - 'bitcoin'
      - 'ethereum'
      - 'wallet'
  condition: selection_clipboard and selection_wallet_pattern
falsepositives:
  - Legitimate password managers
  - Cryptocurrency wallet applications
level: medium
tags:
  - attack.collection
  - attack.t1115
  - clipbanker
  - cryptocurrency_theft
date: 2026/11/01

---
title: Scheduled Task Persistence via Malicious MSI Execution
description: Detects creation of scheduled tasks immediately following MSI installer execution, a common persistence mechanism used by Kong RAT and other malware families
status: experimental
logsource:
  category: process_creation
  product: windows
detection:
  selection_msiexec:
    ParentImage|endswith: '\msiexec.exe'
  selection_schtasks:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains:
      - '/create'
      - '/sc'
      - 'ONLOGON'
      - 'ONSTART'
  filter_system:
    User|contains: 'SYSTEM'
  condition: selection_msiexec and selection_schtasks and not filter_system
falsepositives:
  - Legitimate software installations creating scheduled tasks for updates
level: medium
tags:
  - attack.persistence
  - attack.t1053.005
  - attack.privilege_escalation
  - kong_rat
date: 2026/11/01

KQL — Microsoft Sentinel / Defender

// Kong RAT and ClipBanker Infrastructure Hunt — Microsoft Sentinel
// Hunts for network connections to known malicious domains and file hash indicators

let MaliciousDomains = dynamic([
    "wantsellonline.com",
    "muaklekcoop.com",
    "tuasesoriadigital.es",
    "microlsireqjn.com",
    "peniclean.com"
]);

let MaliciousHashes = dynamic([
    "01c5bc78c4118115bd849ad34e3c42d7ff39479a0feb5b216b1e1ffdc02f853d",
    "0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5",
    "fbc07658954f87579d615e72f76335f6fae5cec34a283535a37f72d6a4abce15",
    "9c0364a0759ec18a9b9ec1e3a78b07df5e2b378221cce8d69191354f7bde07e8",
    "b8c268e22cd5bcb5f082b14354d3210aa6679f87c7dfc8255df00e57576474a9"
]);

union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any (MaliciousDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType),
    (DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 has_any (MaliciousHashes) or MD5 has_any (MaliciousHashes)
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256, MD5, FolderPath),
    (DeviceEvents
    | where TimeGenerated > ago(30d)
    | where ActionType == "ScheduledTaskCreated"
    | where InitiatingProcessCommandLine has_any ("deepseek", ".msi")
    | project TimeGenerated, DeviceName, ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields)
| summarize count() by DeviceName, tostring(RemoteUrl), tostring(SHA256)
| order by count_ desc

PowerShell

# ClipBanker and Kong RAT IOC Hunt Script
# Run with administrative privileges on Windows endpoints
# Checks for scheduled tasks, registry persistence, file hashes, and network connections

$ErrorActionPreference = "SilentlyContinue"
Write-Host "[+] Security Arsenal Threat Hunt — Kong RAT & ClipBanker IOCs" -ForegroundColor Cyan
Write-Host "[+] Timestamp: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan

# Known malicious file hashes from OTX pulses
$MaliciousHashes = @(
    "01c5bc78c4118115bd849ad34e3c42d7ff39479a0feb5b216b1e1ffdc02f853d",
    "0755e767504d8103f6c27b9e765a1026507a17c04513242adb503df7777879e5",
    "fbc07658954f87579d615e72f76335f6fae5cec34a283535a37f72d6a4abce15",
    "9c0364a0759ec18a9b9ec1e3a78b07df5e2b378221cce8d69191354f7bde07e8",
    "b8c268e22cd5bcb5f082b14354d3210aa6679f87c7dfc8255df00e57576474a9"
)

# Suspicious scheduled tasks created recently
Write-Host "`n[*] Checking for suspicious scheduled tasks..." -ForegroundColor Yellow
$RecentTasks = Get-ScheduledTask | Where-Object {
    $_.Date -gt (Get-Date).AddDays(-30) -and
    ($_.TaskName -like "*deepseek*" -or $_.TaskName -like "*update*" -or $_.TaskName -like "*nvidia*")
}

if ($RecentTasks) {
    Write-Host "[!] SUSPICIOUS: Found $($RecentTasks.Count) recently created scheduled tasks" -ForegroundColor Red
    $RecentTasks | Format-Table TaskName, TaskPath, State, Date -AutoSize
} else {
    Write-Host "[+] No suspicious scheduled tasks detected" -ForegroundColor Green
}

# Check registry Run keys for persistence
Write-Host "`n[*] Checking registry Run keys for persistence mechanisms..." -ForegroundColor Yellow
$RunKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"
)

foreach ($Key in $RunKeys) {
    $Entries = Get-ItemProperty -Path $Key -ErrorAction SilentlyContinue
    if ($Entries) {
        $Entries.PSObject.Properties | ForEach-Object {
            if ($_.Value -like "*deepseek*" -or $_.Value -like "*nvd_driver*" -or $_.Value -like "*update*.exe*") {
                Write-Host "[!] SUSPICIOUS: Registry Run key entry detected" -ForegroundColor Red
                Write-Host "    Key: $Key" -ForegroundColor Red
                Write-Host "    Name: $($_.Name)" -ForegroundColor Red
                Write-Host "    Value: $($_.Value)" -ForegroundColor Red
            }
        }
    }
}

# Check for Cygwin DLL side-loading artifacts
Write-Host "`n[*] Checking for Cygwin DLL side-loading artifacts..." -ForegroundColor Yellow
$CygwinPaths = @(
    "$env:TEMP\cygwin1.dll",
    "$env:APPDATA\cygwin1.dll",
    "$env:LOCALAPPDATA\cygwin1.dll"
)

foreach ($Path in $CygwinPaths) {
    if (Test-Path $Path) {
        Write-Host "[!] SUSPICIOUS: Cygwin DLL found in unexpected location: $Path" -ForegroundColor Red
        $FileHash = (Get-FileHash -Path $Path -Algorithm SHA256).Hash
        Write-Host "    SHA256: $FileHash" -ForegroundColor Red
    }
}

# Check network connections to malicious domains
Write-Host "`n[*] Checking active network connections to known malicious domains..." -ForegroundColor Yellow
$MaliciousDomains = @("wantsellonline.com", "muaklekcoop.com", "tuasesoriadigital.es", "microlsireqjn.com", "peniclean.com")

foreach ($Domain in $MaliciousDomains) {
    $Connections = Get-NetTCPConnection | Where-Object {
        (Resolve-DnsName -Name $Domain -ErrorAction SilentlyContinue).IPAddress -contains $_.RemoteAddress
    }
    if ($Connections) {
        Write-Host "[!] SUSPICIOUS: Active connection to $Domain detected" -ForegroundColor Red
        $Connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess -AutoSize
    }
}

# Scan common malware staging directories for known hashes
Write-Host "`n[*] Scanning common malware staging directories for known malicious file hashes..." -ForegroundColor Yellow
$StagingDirs = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\Users\Public")

foreach ($Dir in $StagingDirs) {
    Get-ChildItem -Path $Dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($MaliciousHashes -contains $FileHash) {
            Write-Host "[!] MALICIOUS FILE DETECTED: $($_.FullName)" -ForegroundColor Red
            Write-Host "    SHA256: $FileHash" -ForegroundColor Red
        }
    }
}

Write-Host "`n[+] Hunt complete. Review findings above for potential compromises." -ForegroundColor Cyan
Write-Host "[+] For assistance, contact Security Arsenal Incident Response: https://securityarsenal.com/services/incident-response" -ForegroundColor Cyan

Response Priorities

Immediate Actions (0-4 Hours)

Block IOCs at Network Perimeter:
- Add domains wantsellonline.com, muaklekcoop.com, tuasesoriadigital.es, microlsireqjn.com, peniclean.com to DNS sinkhole/blocklist
- Block URLs https://tuasesoriadigital.es/default.dat, https://microlsireqjn.com/nvd_driver_dll.exe, https://peniclean.com/nvd_driver_dll.exe at web proxy
- Deploy file hash IOCs to EDR/XDR platforms for real-time blocking
Hunt for Execution Artifacts:
- Query SIEM for MSI installer execution in past 30 days, especially those with "deepseek" in filename or path
- Hunt for scheduled task creation events following MSI execution
- Search for Cygwin DLL files in non-standard locations (%TEMP%, %APPDATA%)
- Run provided PowerShell hunt script on all Windows endpoints
Crypto Wallet Security Review:
- If Polymarket platform is used: audit third-party JavaScript integrations for unauthorized modifications
- Implement Content Security Policy (CSP) with Subresource Integrity (SRI) checks for all third-party scripts
- Force re-authentication for all active Polymarket sessions
- Review transaction logs for unauthorized cryptocurrency transfers

24-Hour Actions

Identity Verification (Credential-Theft Risk):
- Kong RAT includes keylogging capability — force password resets for users who may have executed malicious DeepSeek installers
- Review authentication logs for anomalous login patterns following potential compromise windows
- Enable MFA for all user accounts if not already deployed (phishing-resistant MFA preferred: FIDO2, hardware tokens)
Endpoint Isolation and Forensics:
- Isolate any endpoints with positive IOC matches (file hashes, network connections)
- Acquire memory dumps and disk images for forensic analysis
- Extract browser history, download cache, and email artifacts to identify initial infection vector
Clipboard Monitoring for ClipBanker Detection:
- Deploy clipboard monitoring tools (e.g., ClipboardFusion, Ditto) on high-risk systems to detect anomalous clipboard access patterns
- Educate users to manually verify cryptocurrency wallet addresses before confirming transactions (check first 6 and last 6 characters)

1-Week Actions

Architecture Hardening — Supply Chain Attack Vector:
- Implement strict Content Security Policy (CSP) headers for all web applications
- Deploy Subresource Integrity (SRI) checks for all third-party JavaScript libraries
- Establish vendor risk assessment process for third-party web service integrations
- Consider self-hosting critical third-party scripts to reduce external dependencies
Application Whitelisting:
- Deploy application whitelisting (AppLocker, Windows Defender Application Control) to block unauthorized MSI installers
- Restrict Cygwin and other legitimate development tools to authorized user groups only
- Implement script execution policies to prevent unsigned PowerShell, JavaScript, VBScript execution
SEO Poisoning Mitigation:
- Deploy browser isolation technology (Menlo Security, Authentic8) for high-risk users accessing untrusted websites
- Configure SafeSearch and content filtering to reduce exposure to malicious search results
- Educate users to download software only from official vendor websites (verify HTTPS certificates, check domain spelling)
Threat Intelligence Integration:
- Subscribe to AlienVault OTX API for automated IOC ingestion into SIEM/EDR
- Establish intelligence-sharing relationships with FS-ISAC, CERT/CC for financial sector threats
- Monitor dark web forums (via DarkOwl, Flashpoint) for chatter about Polymarket, DeepSeek, ClipBanker campaigns

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

Supply Chain Wallet Drainers, SEO-Poisoned RATs, and ClipBanker Infrastructure: OTX Pulse Analysis — Enterprise Detection Pack