TIKTOUK Credential Harvesting Toolkit + MadApe Device-Code Phishing: OTX Pulse Analysis — Enterprise Detection Pack | Security Arsenal

This week's OTX pulse cluster paints a coherent picture of an ecosystem-wide credential harvesting surge spanning web applications, network edge appliances, collaboration platforms, and identity infrastructure. While the pulses track distinct toolkits and intrusion sets, the common denominator is credential and secret material acquisition at scale — the raw currency that fuels dark web access-broker markets.

Five concurrent threat streams demand attention:

TIKTOUK — a multi-component WordPress credential collection toolkit that automates the full secret-harvesting pipeline: Python-based probing for WordPress fingerprints and exposed configuration, a collection module that extracts wp-config.php, database credentials, SMTP plugin secrets (with decryption capability), and AWS keys, plus a Go-based JavaScript crawler that scrapes client-side code for hardcoded API tokens. This is industrialized secret harvesting designed to feed credential dumps into underground markets.
CVE-2026-88771 (Citrix NetScaler ADC/Gateway) — critical pre-authentication command injection under active exploitation. LevelBlue THOR observed attacker-controlled usernames embedding pitboss and NSPPE strings, webshell deployment (update_c08937.pl), reverse shells, and full configuration exfiltration (update_result_3567cs.tgz). NetScaler compromise yields plaintext AD credentials from LDAP bind configs — a direct pipeline to domain dominance.
CVE-2026-73570 (Zimbra Collaboration Suite) — unauthenticated OS command injection in the SNMP notification path, exploited in the wild between patch release (July 20) and public disclosure (August 13). Microsoft attributed delivery of China Chopper (S0020) and Godzilla JSP webshells, plus Looptik and NeedyMantis tooling. Mail server compromise equals mailbox credential theft and internal phishing staging.
MadApe — a previously undocumented Microsoft 365 device-code phishing kit abusing the legitimate OAuth Device Authorization Grant flow. Multi-stage business-themed PDF lures route victims through configurable redirect chains to fake document-sharing pages; victims authenticate against real Microsoft endpoints, handing attackers valid access and refresh tokens without ever typing a password into a phishing page. 565 infrastructure indicators were published, and activity is concentrated against Israeli targets — with strong likelihood of expansion.
Unauthorized AI relays — a service installing genuine OpenAI Codex and Anthropic Claude Code CLIs on enterprise systems, then silently reconfiguring them to route prompts, source code, and embedded API keys through third-party infrastructure (aiok.me, nuoda.vip, mirbuds.com, sorryios.io). Active since early 2026 against manufacturing, semiconductor, healthcare, energy, and technology firms in China, Taiwan, Malaysia, and South Korea. This is intellectual-property and API-credential exfiltration masquerading as developer tooling.

Collective assessment: Access brokers and initial access operations are harvesting secrets from every layer — CMS configs, edge appliance configs, mail stores, OAuth tokens, and developer AI sessions. Expect the extracted credentials to surface on dark web markets within days of collection.

Threat Actor / Malware Profile

TIKTOUK (WordPress Credential Collection Toolkit)

Distribution: Operator-driven scanning against internet-facing WordPress estates; exploits CVE-2026-63030 and CVE-2026-60137 (plugin/theme flaws) and probes REST API endpoints for exposed secrets.
Payload behavior: Three-stage pipeline — (1) Python prober fingerprints WordPress and scans for exposed .env, wp-config.php backups, and debug artifacts; (2) Python collector extracts DB creds and decrypts SMTP plugin stored passwords; (3) Go-based headless JS crawler renders pages and harvests secrets embedded in client-side JavaScript (AWS keys, Stripe tokens, third-party API keys).
C2 / exfiltration: Collected secrets are staged and exfiltrated to operator infrastructure; harvested AWS credentials are validated and repurposed for SES spam and further infrastructure.
Anti-analysis: Modular design allows components to run independently from arbitrary hosts; Go crawler binary is static-compiled, frustrating signature-based detection.

NetScaler Exploitation Cluster (CVE-2026-88771)

Distribution: Direct internet exploitation of pre-auth command injection on ADC/Gateway management interfaces.
Payload behavior: Perl webshell update_c08937.pl retrieved from 64.94.85.67, attacker account creation (usernames containing pitboss / NSPPE), reverse shells, and tarball exfiltration of the full appliance configuration (update_result_3567cs.tgz) — which contains LDAP bind credentials, session keys, and network topology.
Persistence: Webshell drop plus rogue local accounts on the appliance; config exfil enables offline credential cracking for follow-on internal access.

Zimbra Exploitation Cluster (CVE-2026-73570)

Distribution: Unauthenticated command injection via the SNMP notification path; exploited in the July 20–August 13 disclosure gap.
Payload behavior: JSP webshells (China Chopper S0020, GodzillaWebShell) for persistent access, reverse shells, and privilege escalation via Looptik; NeedyMantis tooling observed in post-exploitation.
Persistence: Webshells in web-root directories, cron-based re-infection, and mailbox rule manipulation for credential phishing from trusted internal accounts.

MadApe (M365 Device Code Phishing Kit)

Distribution: Business-themed PDF lures (invoices, shared documents) linking to configurable redirect chains terminating at fake document-sharing portals.
Payload behavior: Abuses Microsoft's legitimate Device Authorization Grant — the victim is shown a real Microsoft device-code prompt and enters the attacker-supplied code, granting the attacker's session OAuth tokens. No credential capture occurs on attacker infrastructure, defeating traditional phishing-page detection and most MFA fatigue controls.
Anti-analysis: 565+ rotating domains (sucdens.com, cepoffices.com, zakosta.info, nsboards.com, adastraerrans.com, travestiilan.com, nysndigital.com, powerlivings.com) with redirect-chain configuration that geofences and filters security scanners.

Rogue AI Relay Service

Distribution: Genuine OpenAI Codex / Claude Code CLI installers repackaged or post-install reconfigured via PowerShell; sandboxes flipped to Danger-Full-Access.
Payload behavior: CLI config files are rewritten so all model traffic routes through attacker relays (vibe.aiok.me, chat.nuoda.vip) — intercepting proprietary source code, prompts, and any API keys embedded in developer workflows.
Persistence: Modified CLI configuration persists across updates; relay endpoints use TLS to blend with legitimate AI traffic.

IOC Analysis

The indicator set spans five operational layers, and each demands a different enforcement point:

CVEs (CVE-2026-63030, CVE-2026-60137, CVE-2026-88771, CVE-2026-73570): Feed directly into vulnerability management. Cross-reference against internet-facing asset inventory — NetScaler and Zimbra exposure is the highest-priority attack surface this cycle. These are not hypothetical: exploitation artifacts exist in the wild.
File hashes (SHA256/SHA1): Block in EDR and email gateway. Note the TIKTOUK SHA256 set (3 hashes) covers the Python modules and Go crawler; the NetScaler pair covers the Perl webshell and follow-on tooling; the Zimbra 5-hash set covers Chopper/Godzilla JSP payloads. Hashes rotate quickly — treat them as retro-hunt material, not durable prevention.
Domains/hostnames: The MadApe set (565 domains) should be blocked at DNS and secure web gateway; the AI relay set (aiok.me, sorryios.io, nuoda.vip, mirbuds.com) should be alerted on with high severity — any internal host resolving these is an active data leak, not a potential one.
URLs: http://64.94.85.67:443/update_c08937.pl and the .tgz exfil URL indicate NetScaler compromise if seen in proxy or appliance logs. HTTP on port 443 to a bare IP is itself a high-fidelity anomaly.
Tooling: Load indicators into your TIP (MISP/OpenCTI), push domains to DNS sinkhole/Pi-hole/RPZ, hashes to EDR blocklists, and CVEs to your scanner. For NetScaler and Zimbra, IOC matching alone is insufficient — configuration and webshell artifact hunting is mandatory.

Detection Engineering

YAML

---
title: NetScaler CVE-2026-88771 Webshell and Rogue Account Artifacts
id: 7a1c4d2e-9f3b-4e6a-b2d1-cve202688771
status: experimental
description: Detects exploitation artifacts of Citrix NetScaler CVE-2026-88771 including pitboss/NSPPE authentication events, Perl webshell staging, and configuration tarball exfiltration observed by LevelBlue THOR.
author: Security Arsenal Threat Intelligence
references:
  - https://www.levelblue.com/blogs/spiderlabs-blog/citrix-netscaler-cve-2026-88771-observed-exploitation-artifacts-and-hunt-indicators
date: 2026/10/31
logsource:
  category: webserver
  product: citrix
detection:
  selection_url:
    cs-uri-query|contains:
      - 'update_c08937.pl'
      - 'update_result_3567cs.tgz'
  selection_user:
    cs-username|contains:
      - 'pitboss'
      - 'NSPPE'
  condition: 1 of selection_*
falsepositives:
  - None expected; strings are attacker-specific artifacts
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.persistence
  - attack.t1505.003
---
title: MadApe Device Code Phishing OAuth Token Grant
id: 3f8e2b1a-5c7d-4a9e-b6f2-madape2026
status: experimental
description: Detects OAuth device-code flow authentication events associated with the MadApe Microsoft 365 phishing kit, including sign-ins to device code endpoints and token issuance from MadApe redirect infrastructure.
author: Security Arsenal Threat Intelligence
references:
  - https://www.group-ib.com/blog/madape-microsoft-device-code-phishing-kit/
date: 2026/10/31
logsource:
  product: azure
  service: signinlogs
detection:
  selection_flow:
    authentication_protocol|contains: 'deviceCode'
  selection_risk:
    - risk_state: 'none'
  filter_known_devices:
    device_detail.trust_type: 'Azure AD joined'
  condition: selection_flow and not filter_known_devices
falsepositives:
  - Legitimate device-code auth on unmanaged devices (rare in managed estates)
  - CLI tooling (Azure CLI, Graph PowerShell) from personal devices
level: high
tags:
  - attack.initial_access
  - attack.t1566.002
  - attack.credential_access
  - attack.t1528
---
title: Rogue AI Relay CLI Configuration Tampering
id: 9b2d5e7c-1a4f-4d8c-a3e9-airelay2026
status: experimental
description: Detects modification of AI CLI (Codex/Claude Code) configuration files redirecting traffic to unauthorized relay domains, based on observed PowerShell-driven reconfiguration to aiok.me, nuoda.vip, mirbuds.com, and sorryios.io infrastructure.
author: Security Arsenal Threat Intelligence
date: 2026/10/31
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_content:
    CommandLine|contains:
      - 'aiok.me'
      - 'nuoda.vip'
      - 'mirbuds.com'
      - 'sorryios.io'
      - 'Danger-Full-Access'
  condition: all of selection_*
falsepositives:
  - None expected; relay domains are attacker infrastructure
level: critical
tags:
  - attack.collection
  - attack.t1552.001
  - attack.command_and_control
  - attack.t1071.001

KQL — Microsoft Sentinel / Defender

// Multi-pulse hunt: MadApe phishing domains + AI relay exfil + NetScaler C2 callback
// Microsoft Sentinel — run over last 14 days, any hit warrants immediate triage
let MadApeDomains = dynamic(["sucdens.com","cepoffices.com","zakosta.info","nsboards.com","adastraerrans.com","travestiilan.com","nysndigital.com","powerlivings.com"]);
let AIRelayDomains = dynamic(["aiok.me","vibe.aiok.me","sorryios.io","nuoda.vip","chat.nuoda.vip","mirbuds.com"]);
let NetScalerC2 = dynamic(["64.94.85.67"]);
let ZimbraC2 = dynamic(["psk1zim.abrdns.com","tls.psk1zim.abrdns.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (MadApeDomains)
       or RemoteUrl has_any (AIRelayDomains)
       or RemoteUrl has_any (ZimbraC2)
       or RemoteIP in (NetScalerC2)
    | extend IntelMatch = case(
        RemoteUrl has_any (MadApeDomains), "MadApe-Phishing",
        RemoteUrl has_any (AIRelayDomains), "AI-Relay-Exfil",
        RemoteUrl has_any (ZimbraC2), "Zimbra-C2",
        "NetScaler-C2")
    | project TimeGenerated, DeviceName, InitiatingProcessAccountName,
              InitiatingProcessFileName, InitiatingProcessCommandLine,
              RemoteIP, RemoteUrl, RemotePort, IntelMatch),
    (SigninLogs
    | where TimeGenerated > ago(14d)
    | where AuthenticationProtocol == "deviceCode"
    | where DeviceDetail has "browser" or isempty(DeviceDetail)
    | extend IntelMatch = "MadApe-DeviceCode-Flow"
    | project TimeGenerated, UserPrincipalName, IPAddress, AppDisplayName,
              AuthenticationProtocol, ResultType, IntelMatch)
| order by TimeGenerated desc

PowerShell

# Security Arsenal — Multi-Pulse IOC Hunt (TIKTOUK / NetScaler / Zimbra / AI Relay / MadApe)
# Run on endpoints and mail/web servers; outputs findings to console + CSV
$Report = @()

# --- 1. File hash hunt (EDR-independent) for pulse malware samples ---
$TargetHashes = @(
  'c6b8d0cdb53da98a5d15e79b7bb9e9f4c272c4f9592acdc291089f126f892f45',
  '0d8ea89a63070f68286249aa437aece0e040c1609b8c5c0950ebbc90e6f70f02',
  '1e22fde68d3277ed0fe7a8a7b554f0ae118260a2fa143f8e1bdc84c994ebbe90',
  'e9fe43968c6c0955300e3bc4d7fb0b05a18570b4733aaf4f5c6f7f09be5a242c',
  '974b69782fdf5d67b97cfd508465939e44ee10798dbcc1e82b92d78776bad938',
  'dee5af1c0f76b45d28bafd6e60c07bb8e391d98addf81ef8f13d073acdb3c48a',
  'aea991f694911e321b0ab97534f2ad0291c392c0a43dabff664c563618bd036d',
  '2a76a28639d896bb41576d0e32d155b78f38b034e052dfe3a7b7e1a478fc0e24',
  '4bfe5ca73a4b0988586a46f789aeedba5db575257b58291934cddb9faa606fdb'
)
$SearchPaths = @('C:\inetpub','C:\Program Files\Zimbra','C:\netscaler','C:\Temp','C:\Windows\Temp','C:\Users\Public')
foreach ($p in $SearchPaths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
      try {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction Stop).Hash.ToLower()
        if ($TargetHashes -contains $h) {
          $Report += [PSCustomObject]@{Type='HashMatch'; Finding=$_.FullName; Hash=$h}
        }
      } catch {}
    }
  }
}

# --- 2. Webshell artifacts: JSP shells (Chopper/Godzilla) + Perl update shell ---
$ShellPaths = @('C:\inetpub\wwwroot','C:\Program Files\Zimbra\jetty\webapps','C:\netscaler\ns_gui')
$ShellNames = @('update_c08937.pl','main.py','cmd.jsp','shell.jsp','chopper.jsp')
foreach ($sp in $ShellPaths) {
  if (Test-Path $sp) {
    Get-ChildItem -Path $sp -Recurse -Include $ShellNames -ErrorAction SilentlyContinue | ForEach-Object {
      $Report += [PSCustomObject]@{Type='WebshellArtifact'; Finding=$_.FullName; Hash=((Get-FileHash $_.FullName).Hash.ToLower())}
    }
    # Recently modified JSP/PL files in web roots (last 30 days)
    Get-ChildItem -Path $sp -Recurse -Include *.jsp,*.pl -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } | ForEach-Object {
        $Report += [PSCustomObject]@{Type='RecentWebFile'; Finding=$_.FullName; Hash='N/A'}
      }
  }
}

# --- 3. AI CLI relay tampering: check Codex/Claude configs for rogue endpoints ---
$CliConfigs = @("$env:USERPROFILE\.codex\config.json","$env:USERPROFILE\.claude\settings.json","$env:APPDATA\codex\config.json")
$RelayDomains = @('aiok.me','nuoda.vip','mirbuds.com','sorryios.io')
foreach ($cfg in $CliConfigs) {
  if (Test-Path $cfg) {
    $content = Get-Content $cfg -Raw -ErrorAction SilentlyContinue
    foreach ($d in $RelayDomains) {
      if ($content -match [regex]::Escape($d)) {
        $Report += [PSCustomObject]@{Type='AIRelayConfig'; Finding="$cfg references $d"; Hash='N/A'}
      }
    }
    if ($content -match 'Danger-Full-Access') {
      $Report += [PSCustomObject]@{Type='SandboxBypass'; Finding="$cfg set to Danger-Full-Access"; Hash='N/A'}
    }
  }
}

# --- 4. DNS cache check for MadApe / relay / Zimbra C2 resolution ---
$AllBad = $RelayDomains + @('sucdens.com','cepoffices.com','zakosta.info','nsboards.com','adastraerrans.com','travestiilan.com','nysndigital.com','powerlivings.com','psk1zim.abrdns.com')
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
  $e = $_.Entry; ($AllBad | Where-Object { $e -like "*$_*" }).Count -gt 0
} | ForEach-Object {
  $Report += [PSCustomObject]@{Type='DNSCacheHit'; Finding=$_.Entry; Hash=$_.Data}
}

$Report | Format-Table -AutoSize
if ($Report) { $Report | Export-Csv -Path ".\otx_hunt_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation; Write-Host "[!] FINDINGS PRESENT - escalate to IR" -ForegroundColor Red }
else { Write-Host "[+] No IOC matches on this host" -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours):

Block all MadApe domains (full 565-domain OTX list), AI relay domains, Zimbra C2 hostnames, and NetScaler C2 IP 64.94.85.67 at DNS, SWG, and egress firewall.
Push all published SHA256/SHA1 hashes to EDR blocklists and retro-hunt across 90 days of telemetry.
Emergency-patch or isolate internet-facing Citrix NetScaler ADC/Gateway (CVE-2026-88771) and Zimbra Collaboration Suite (CVE-2026-73570). If patching is not possible today, pull the management interface off the internet and enable WAF virtual patching.
Run the NetScaler hunt for pitboss/NSPPE authentication strings and update_c08937.pl artifacts on every appliance — assume breach until cleared.

24 hours:

Treat all credentials stored on or transiting exposed NetScaler and Zimbra assets as compromised: rotate LDAP bind accounts, local appliance accounts, and any service accounts in ns.conf or Zimbra LDAP.
Audit M365 sign-in logs for device-code flow authentications; revoke refresh tokens for any session matching the MadApe pattern and enforce a Conditional Access policy restricting device-code grant to compliant devices.
Force credential rotation for any WordPress site in scope: database users, SMTP plugin passwords, and — critically — any AWS IAM keys ever present in site configuration or client-side JavaScript (TIKTOUK's primary target).
Sweep developer workstations for AI CLI configuration tampering; any host referencing relay domains requires IR scoping for source code and API key exposure.

1 week:

Segment edge appliances and mail servers onto monitored VLANs with egress allow-listing — NetScaler and Zimbra should never initiate arbitrary outbound connections.
Deploy canary credentials (fake AWS keys, fake SMTP creds) in WordPress configs and JavaScript to provide early warning of TIKTOUK-style harvesting.
Move WordPress secrets out of wp-config.php into environment variables or a secrets manager; disable REST API user enumeration and remove sensitive keys from client-side code entirely.
Establish policy and technical enforcement for AI tooling: approved CLI versions, configuration integrity monitoring, and egress filtering for AI API endpoints so relay redirection generates an alert.
Subscribe to OTX pulse feeds for these CVEs and families; enable automated IOC-to-blocklist pipelines so dwell time on future indicator drops is measured in minutes.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

TIKTOUK Credential Harvesting Toolkit + MadApe Device-Code Phishing: OTX Pulse Analysis — Enterprise Detection Pack