TwizAdmin Infostealer, Lazarus Mach-O Man & Void Dokkaebi: Multi-Platform Credential Theft Surge

---
title: Potential TwizAdmin C2 Communication
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
description: Detects network connections to known TwizAdmin C2 infrastructure IP addresses and ports.
status: experimental
author: Security Arsenal
date: 2026/04/23
references:
    - https://otx.alienvault.com/pulse/66666666
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: zeek
    service: conn
detection:
    selection_ip:
        id.resp_h:
            - '31.31.198.206'
            - '103.241.66.238'
    selection_port:
        id.resp_p: 1337
    condition: 1 of selection*
falsepositives:
    - Legitimate traffic to shared hosting IPs
level: high
---
title: Suspicious macOS ClickFix Terminal Execution
id: b2c3d4e5-6789-01bc-def2-2345678901bc
description: Detects potential ClickFix activity where a shell script is downloaded via curl/wget and piped directly to bash/sh.
status: experimental
author: Security Arsenal
date: 2026/04/23
references:
    - https://otx.alienvault.com/pulse/77777777
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    product: macos
    category: process_creation
detection:
    selection_img:
        Image|endswith:
            - '/bin/bash'
            - '/bin/sh'
            - '/bin/zsh'
    selection_cli:
        CommandLine|contains:
            - 'curl '
            - 'wget '
    selection_pipe:
        CommandLine|contains:
            - ' | '
            - ' |sh'
            - ' |bash'
    condition: all of selection_*
falsepositives:
    - Legitimate developer tools or installation scripts
level: medium
---
title: VS Code Task Exploitation via Suspicious Child Process
id: c3d4e5f6-7890-12cd-ef34-3456789012cd
description: Detects exploitation of VS Code tasks where Code.exe spawns a shell or script to execute potential malware payloads.
status: experimental
author: Security Arsenal
date: 2026/04/23
references:
    - https://otx.alienvault.com/pulse/88888888
tags:
    - attack.execution
    - attack.t1204.002
logsource:
    product: windows
    category: process_creation
detection:
    selection_parent:
        ParentImage|endswith: '\Code.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\pwsh.exe'
            - '\node.exe'
            - '\python.exe'
    selection_cli:
        CommandLine|contains:
            - 'npm'
            - 'python'
            - 'node'
            - 'bash'
    condition: all of selection_*
falsepositives:
    - Legitimate developer build tasks
level: low


kql
// Hunt for network connections to known C2 infrastructure and typosquatted domains
DeviceNetworkEvents
| where RemoteIP in ("31.31.198.206", "103.241.66.238", "166.88.4.2", "85.239.62.36", "172.94.9.250") 
   or RemoteUrl has_any ("fanonlyatn.xyz", "livemicrosft.com", "bull-run.fun", "spot-wave.fun", "moonscan.live")
| extend Timestamp = TimeGenerated, DeviceName = DeviceName, AccountName = InitiatingProcessAccountName, RemoteIP = RemoteIP, URL = RemoteUrl
| project Timestamp, DeviceName, AccountName, RemoteIP, URL, RemotePort
| order by Timestamp desc


powershell
# PowerShell IOC Hunt Script for TwizAdmin and ClickFix Indicators
$MaliciousHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90",
    "24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9",
    "e12285f507c847b986233991b86b22e3"
)

Write-Host "Scanning for known malicious file hashes (This may take time)..." -ForegroundColor Cyan

# Scan C drive for matching hashes
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { !$_.PSIsContainer -and $_.Length -gt 0 } |
    ForEach-Object {
        try {
            $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction Stop
            if ($hash.Hash -in $MaliciousHashes) {
                Write-Host "[!] MALICIOUS FILE DETECTED: $($_.FullName)" -ForegroundColor Red
                Write-Host "    Hash: $($hash.Hash)" -ForegroundColor DarkRed
            }
        } catch {
            # Ignore access errors
        }
    }

# Check for active network connections to malicious IPs
$MaliciousIPs = @("31.31.198.206", "103.241.66.238", "166.88.4.2", "172.94.9.250")
Write-Host "Checking for active connections to known C2 IPs..." -ForegroundColor Cyan

Get-NetTCPConnection | Where-Object { $MaliciousIPs -contains $_.RemoteAddress } | 
    Select-Object LocalAddress, RemoteAddress, State, @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}