TroyDen & ClickFix Campaigns: AI-Generated Lures, Python RATs, and Multi-Vector Stealer Ecosystems

title: Suspicious Portable Python Execution via LOLBIN Chain
description: Detects execution of portable Python (IronPython/CPython) spawned by cmd.exe or powershell following suspicious activity, indicative of ClickFix campaign.
author: Security Arsenal
date: 2026/06/08
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\\python.exe'
      - '\\ipy.exe'
      - '\\pythonw.exe'
    ParentImage|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
  filter_legit:
    CommandLine|contains:
      - 'C:\\Python\'
      - 'C:\\Program Files\'
  condition: selection and not filter_legit
falsepositives:
  - Developer testing scripts
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - clickfix
  - castleloader
---
title: LuaJIT Execution from User Profile Directory
description: Detects execution of LuaJIT interpreters from User directories, typical of TroyDen Lure Factory malware delivery.
author: Security Arsenal
date: 2026/06/08
status: stable
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|contains: '\\luajit.exe'
    Image|contains: '\\Users\'
  condition: selection
falsepositives:
  - Legitimate software using LuaJIT locally
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - troyden
  - lummastealer
---
title: Traffic Distribution System (TDS) Gateway Connection
description: Detects network connections to known TDS infrastructure IPs or specific ports used in malware distribution campaigns.
author: Security Arsenal
date: 2026/06/08
status: stable
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - '194.150.220.218'
      - '217.156.122.75'
  selection_port:
    DestinationPort: 48261
  condition: 1 of selection*
falsepositives:
  - Rare (Known bad infrastructure)
level: critical
tags:
  - attack.command_and_control
  - attack.c2
  - sessiongate
  - remusstealer

// Hunt for ClickFix Python Execution and Domain Connections
let IOCs = dynamic([\"teamsvoicehub.com\", \"dapala.net\", \"staruxaproruha.com\", \"ai-like.net\", \"mtg-life.net\", \"novayastaruxa.com\", \"kevinnotanother.com\"]);
let MaliciousHashes = dynamic([\"08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4\", \"87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886\"]);
// Network Connections to Typosquatted Domains
DeviceNetworkEvents
| where RemoteUrl in IOCs
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| union (
    DeviceProcessEvents
    | where SHA256 in MaliciousHashes
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256
)
| union (
    // Hunt for Python execution from User Profile paths (ClickFix)
    DeviceProcessEvents
    | where FileName in~ (\"python.exe\", \"ipy.exe\", \"pythonw.exe\")
    | where FolderPath contains \"Users\"
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
);

<#
.SYNOPSIS
    IOC Hunt Script for TroyDen, ClickFix, and TDS Malware Campaigns
#>

$MaliciousHashes = @(
    \"08a474368a2f94f347ad9e1a0a08d4258fcf49c6b9373214f7901bb770bacca4\",
    \"87361ba2bb412dcf49f8738f3b8b9b7dccb557ad2e76ea8d98ffa5b098ae3886\"
)

$IOC_Domains = @(
    \"teamsvoicehub.com\", \"dapala.net\", \"staruxaproruha.com\", \"ai-like.net\", 
    \"mtg-life.net\", \"novayastaruxa.com\", \"kevinnotanother.com\", \"guiformat.com\"
)

Write-Host \"[+] Hunting for Malicious File Hashes...\"
Get-ChildItem -Path C:\Users -Recurse -ErrorAction SilentlyContinue | 
Where-Object { $_.Length -gt 0kb } | 
ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($hash -in $MaliciousHashes) {
        Write-Host \"[!] MALICIOUS FILE FOUND: $($_.FullName) | Hash: $hash\" -ForegroundColor Red
    }
}

Write-Host \"[+] Checking Hosts File for Domain Sinkholing...\"
$HostsPath = \"$env:SystemRoot\\System32\\drivers\\etc\\hosts\"
if (Test-Path $HostsPath) {
    $content = Get-Content $HostsPath
    foreach ($domain in $IOC_Domains) {
        if ($content -match $domain) {
            Write-Host \"[!] IOC FOUND IN HOSTS FILE: $domain\" -ForegroundColor Yellow
        }
    }
}

Write-Host \"[+] Checking for Suspicious Portable Python Directories...\"
$UserProfile = [System.Environment]::GetFolderPath(\"UserProfile\")
$PythonDirs = Get-ChildItem -Path \"$UserProfile\\*\" -Directory -ErrorAction SilentlyContinue | Where-Object { $_.Name -match \"python|ironpython\" }
if ($PythonDirs) {
    Write-Host \"[!] Suspicious Python directories found in User Profile:\" -ForegroundColor Yellow
    $PythonDirs | ForEach-Object { Write-Host \"    - $($_.FullName)\" }
}