TwizAdmin, Lazarus & Cloud Atlas: OTX Pulse Analysis — Multi-Platform Credential Theft

title: Potential TwizAdmin Clipper Process Creation
id: 6678d9a1-8b12-4c5d-9e0f-1a2b3c4d5e6f
description: Detects potential execution of TwizAdmin or related clippers based on command line arguments and file hash patterns observed in OTX Pulse.
status: experimental
date: 2026/05/25
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\java.exe'
      - '\cmd.exe'
      - '\powershell.exe'
    CommandLine|contains:
      - 'clipper'
      - 'fanonlyatn'
      - 'BIP-39'
  condition: selection
falsepositives:
  - Legitimate developer tools referencing clipboard
level: high
---
title: Laravel Lang Supply Chain Backdoor Execution
id: 7778d9a1-8b12-4c5d-9e0f-1a2b3c4d5e6f
description: Detects execution of malicious helpers.php or DebugChromium.exe associated with the Laravel Lang compromise.
status: experimental
date: 2026/05/25
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\php.exe'
      - '\DebugChromium.exe'
  selection_cli:
    CommandLine|contains:
      - 'helpers.php'
      - 'flipboxstudio.info'
  condition: 1 of selection_*
falsepositives:
  - Legitimate Laravel development
level: critical
---
title: Lazarus ClickFix macOS Terminal Execution
id: 8888d9a1-8b12-4c5d-9e0f-1a2b3c4d5e6f
description: Detects suspicious terminal commands often used in ClickFix attacks targeting macOS users.
status: experimental
date: 2026/05/25
author: Security Arsenal
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/bin/bash'
      - '/bin/zsh'
      - '/usr/bin/osascript'
    CommandLine|contains:
      - 'curl'
      - 'livemicrosft.com'
      - 'meeting'
  condition: selection
falsepositives:
  - Administrative scripting
level: high


kql
// Hunt for TwizAdmin and Lazarus C2 Domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("fanonlyatn.xyz", "flipboxstudio.info", "livemicrosft.com", "allgoodsdirect.com.au", "istochnik.org")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP

// Hunt for Malicious File Hashes (Sample of TwizAdmin and Mach-O Man)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in ("06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FolderPath, SHA256

// Check for PowerShell script execution related to supply chain
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName == "powershell.exe" 
| where ProcessCommandLine contains "DebugChromium" or ProcessCommandLine contains "mcpAddon"
| project Timestamp, DeviceName, ProcessCommandLine


powershell
# IOC Hunt Script for TwizAdmin and Supply Chain Malware
$MaliciousHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90",
    "222e6bfed0f3bb1937bf5e719a2342871ccd683ff1c0cb967c8e31ea58beaf7b"
)

Write-Host "[+] Scanning for malicious file hashes..."

# Scan common download and temp directories
$PathsToScan = @("C:\Users\", "C:\Windows\Temp", "C:\ProgramData")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | Where-Object {
            $MaliciousHashes -contains $_.Hash
        } | ForEach-Object {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
        }
    }
}

# Check Hosts File for Typosquatting
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
$BadDomains = @("livemicrosft.com", "fanonlyatn.xyz", "flipboxstudio.info")
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($Domain in $BadDomains) {
        if ($HostsContent -match $Domain) {
            Write-Host "[!] Suspicious entry found in hosts file for: $Domain" -ForegroundColor Yellow
        }
    }
}

Write-Host "[+] Scan complete."