TwizAdmin & ClickFix Campaigns: Infostealer & Supply Chain Attacks — OTX Pulse Analysis

---
title: Potential ClickFix Social Engineering Activity
id: 8a1b2c3d-4e5f-6789-0123-456789abcdef
description: Detects suspicious command execution often associated with ClickFix campaigns where browsers spawn shells to download payloads.
status: experimental
date: 2026/04/25
author: Security Arsenal
references:
    - https://otx.alienvault.com/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'copy '
            - 'Invoke-Expression'
            - 'iex'
            - 'curl '
            - 'wget '
    condition: selection
falsepositives:
    - Legitimate web-based tools
level: high
---
title: Suspicious Trivy or KICS Binary Execution
id: b2c3d4e5-6f78-9012-3456-7890abcdef12
description: Detects execution of Trivy or KICS binaries that may be compromised in recent supply chain attacks, focusing on connections to spoofed domains.
status: experimental
date: 2026/04/25
author: Security Arsenal
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        Image|contains:
            - 'trivy'
            - 'kics'
        DestinationHostname|contains:
            - 'aquasecurtiy.org'
            - 'checkmarx.zone'
            - 'raw.icp0.io'
    condition: selection
falsepositives:
    - Legitimate usage of modified scanner targets (unlikely given the domains)
level: critical
---
title: TwizAdmin or Trigona Exfiltration Tool Execution
id: c3d4e5f6-7890-1234-5678-90abcdef1234
description: Detects execution of known custom exfiltration tools or payloads associated with TwizAdmin and Trigona campaigns.
status: experimental
date: 2026/04/25
author: Security Arsenal
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - 'uploader_client.exe'
            - 'crpx0'
            - 'TwizAdmin'
    condition: selection
falsepositives:
    - None expected
level: critical


kql
// Hunt for ClickFix-like browser spawned shells
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
;
// Hunt for Trigona/TwizAdmin C2 or Exfil domains
union DeviceNetworkEvents, IdentityLogonEvents
| where RemoteUrl in~ ("fanonlyatn.xyz", "checkmarx.zone", "aquasecurtiy.org", "103.241.66.238")
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, Action
| order by Timestamp desc


powershell
# IOC Hunt for TwizAdmin and Trigona Artifacts
$iocHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173",
    "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019",
    "d47de3772f2d61a043e7047431ef4cf4"
)

Write-Host "Scanning for malicious file hashes..."

Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
Where-Object { $_.Length -gt 0 } | 
ForEach-Object {
    $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($iocHashes -contains $hash) {
        Write-Host "[ALERT] Malicious file found: $($_.FullName) (SHA256: $hash)" -ForegroundColor Red
    }
}

# Check for suspicious scheduled tasks (Persistence)
Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -or $_.Actions.Execute -like "*cmd*" } | 
Select-Object TaskName, TaskPath, Actions