TwizAdmin, JINX-0164 & GHOST STADIUM: Multi-Vector Infostealer & Supply Chain Assaults — OTX Pulse Analysis

---
title: Potential TwizAdmin Crypto Clipper Activity
id: 0d7f8b1a-5e3c-4f8a-9b2c-1d3e4f5a6b7c
description: Detects potential execution of TwizAdmin clipper behavior via monitoring for suspicious clipboard access patterns or known malicious process arguments often associated with Java-based RAT builders.
status: experimental
date: 2026/05/29
author: Security Arsenal Research
references:
    - https://otx.alienvault.com/pulse/64271f3210715648666b4566
tags:
    - attack.credential_access
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'BIP39'
            - 'seed phrase'
            - 'mnemonic'
            - 'clipper'
    condition: selection
falsepositives:
    - Legitimate cryptocurrency wallet management software
level: high
---
title: Suspicious PHP Backdoor Execution (Laravel Lang Compromise)
id: 1e8g9h2i-6j4k-5l9m-0n3o-4p5q6r7s8t9u
description: Detects the execution of PHP scripts with base64 encoded arguments or common webshell patterns associated with the Laravel Lang helpers.php backdoor.
status: experimental
date: 2026/05/29
author: Security Arsenal Research
references:
    - https://otx.alienvault.com/pulse/64271f3210715648666b4570
tags:
    - attack.persistence
    - attack.web_shell
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\php.exe'
            - '\php-cgi.exe'
    selection_cli:
        CommandLine|contains:
            - 'base64_decode'
            - 'eval(base64'
            - 'helpers.php'
    condition: all of selection_*
falsepositives:
    - Legitimate developer debugging activity
level: critical
---
title: Infostealer PowerShell Payload (Vidar/Lumma/Generic)
id: 2f9g0h3j-7k5l-6m0n-1o4p-5q6r7s8t9u0v
description: Detects PowerShell commands often used by stealers like Vidar and Lumma to download payloads or exfiltrate browser data.
status: experimental
date: 2026/05/29
author: Security Arsenal Research
references:
    - https://otx.alienvault.com/pulse/64271f3210715648666b4568
tags:
    - attack.execution
    - attack.command_and_control
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_suspicious:
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadString'
            - 'http://89.36.224.5' # Specific IOCs from JINX-0164
            - 'fanonlyatn.xyz'
    condition: all of selection_*
falsepositives:
    - System administration scripts
level: medium


kql
// Hunt for network connections to known malicious infrastructure from pulses
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ (
    "fanonlyatn.xyz", 
    "fifa.gold", "fifa.black", "fifa.tax", "fifaweb.com", "fifa.red", "fifa.fund", "fifa-com.shop",
    "driver-updater.net", 
    "live.ong", 
    "flipboxstudio.info",
    "afraid.veloitall.cfd"
    )
    or RemoteIP in ("103.241.66.238", "148.178.22.16", "89.36.224.5")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize count() by RemoteUrl, RemoteIP, DeviceName
| order by count_ desc


powershell
# IOC Hunt Script for TwizAdmin and Laravel Backdoors
$MaliciousHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150",
    "9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec",
    "b6cab0b3aa8e56e2427f486c74588d598ae58bb0cbc0eda6939fe171cb0aed17"
)

$SuspiciousPaths = @(
    "C:\Users\*\AppData\Roaming\Microsoft\Crypto",
    "C:\xampp\htdocs\laravel-lang\lang\helpers.php" 
)

Write-Host "Checking for known malicious file hashes..."
foreach ($hash in $MaliciousHashes) {
    $files = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
             Where-Object { $_.Length -gt 0 } 
             ForEach-Object { 
                $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                if ($fileHash -eq $hash) { $_.FullName }
             }
    if ($files) { Write-Host "[ALERT] Malicious file found: $files" -ForegroundColor Red }
}

Write-Host "Checking for suspicious file paths related to Laravel/TwizAdmin..."
foreach ($pathPattern in $SuspiciousPaths) {
    $resolvedPaths = Resolve-Path $pathPattern -ErrorAction SilentlyContinue
    if ($resolvedPaths) {
        Write-Host "[WARN] Suspicious path detected: $resolvedPaths" -ForegroundColor Yellow
    }
}