TroyDen AI Lures & ClickFix RAT: OTX Analysis of Multi-Vector Malware Distribution

---
title: Potential ClickFix CastleLoader Execution via Finger Protocol
id: a6b3c4d5-2026-6080-1eaf-000000000001
description: Detects the use of finger.exe or cmd.exe spawning python.exe, indicative of the ClickFix campaign delivering portable Python runtimes for CastleLoader.
status: experimental
date: 2026/06/08
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6663e6f8b5a0d0f7c0e8f5c6
tags:
    - attack.initial_access
    - attack.t1189
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\finger.exe'
            - '\cmd.exe'
        Image|endswith:
            - '\python.exe'
            - '\pythonw.exe'
            - '\ipy.exe'
            - '\ipy64.exe'
    condition: selection
falsepositives:
    - Legitimate developer usage of python via cmd
level: high
---
title: TroyDen LuaJIT Infostealer Execution
id: a6b3c4d5-2026-6080-1eaf-000000000002
description: Detects the execution of luajit.exe or luajit-64.exe, a common loader for TroyDen's LummaStealer and Redline campaigns often distributed via fake GitHub repos.
status: experimental
date: 2026/06/08
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6663e6f8b5a0d0f7c0e8f5c5
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|contains:
            - 'luajit.exe'
            - 'luajit-64.exe'
    selection_cli:
        CommandLine|contains:
            - '-e'
            - '-O'
    condition: 1 of selection*
falsepositives:
    - Legitimate software using LuaJIT (e.g., specific games, dev tools)
level: medium
---
title: TDS Traffic Distribution System Suspicious File Download
id: a6b3c4d5-2026-6080-1eaf-000000000003
description: Detects patterns consistent with the TDS campaign impersonating tools like Ghidra/dnSpy. Looks for PowerShell or Curl downloading archives from non-standard domains.
status: experimental
date: 2026/06/08
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6663e6f8b5a0d0f7c0e8f5c4
tags:
    - attack.command_and_control
    - attack.t1102
logsource:
    category: process_creation
    product: windows
detection:
    selection_tool:
        Image|endswith:
            - '\powershell.exe'
            - '\curl.exe'
    selection_keywords:
        CommandLine|contains:
            - 'ghidra'
            - 'dnSpy'
            - 'spiderfoot'
            - '.zip'
            - '.rar'
    filter_legit:
        ParentImage|contains:
            - '\Visual Studio\'
            - '\JetBrains\'
    condition: selection_tool and selection_keywords and not filter_legit
falsepositives:
    - Developers actually downloading these tools
level: medium


kql
// Hunt for ClickFix and TDS related domains and IPs
let IOCs = dynamic([
    "teamsvoicehub.com", "dapala.net", "staruxaproruha.com", "ai-like.net", "mtg-life.net",
    "novayastaruxa.com", "kevinnotanother.com", "guiformat.com", "forestoaker.com",
    "194.150.220.218", "217.156.122.75", "baxe.pics"
]);
DeviceNetworkEvents
| where RemoteUrl in (IOCs) or RemoteIP in ("194.150.220.218", "217.156.122.75")
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| extend Timestamp = format_datetime(Timestamp, 'yyyy-MM-dd HH:mm:ss')
| order by Timestamp desc


powershell
# IOC Hunt Script for SessionGate and CastleLoader
# Check for presence of file hashes and suspicious scheduled tasks

$TargetHashes = @(
    "08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4",
    "87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886"
)

$SearchPaths = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

Write-Host "[+] Scanning for malware file hashes..." -ForegroundColor Cyan

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FilePath = $_.FullName
            $FileHash = (Get-FileHash -Path $FilePath -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            
            if ($TargetHashes -contains $FileHash) {
                Write-Host "[!] MALWARE FOUND: $FilePath (Hash: $FileHash)" -ForegroundColor Red
            }
        }
    }
}

# Check for suspicious Python runtimes often used in ClickFix
Write-Host "[+] Checking for portable Python runtimes in temp dirs..." -ForegroundColor Cyan
Get-ChildItem -Path "$env:TEMP" -Filter "python*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "[!] Suspicious Python Runtime Found: $($_.FullName)" -ForegroundColor Yellow
}