title: Potential TwizAdmin Crypto Clipper Activity
id: 5d9f8a2b-1c3e-4f7a-9b1d-8e6f5a4b3c2d
description: Detects potential clipboard hijacking behavior associated with TwizAdmin malware via PowerShell interaction or suspicious process access.
status: experimental
date: 2026/05/26
author: Security Arsenal
tags:
    - attack.credential_access
    - attack.collection
logsource:
    product: windows
    category: process_creation
detection:
    selection_clipboard:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
        CommandLine|contains:
            - 'Get-Clipboard'
            - 'Set-Clipboard'
    selection_context:
        CommandLine|contains:
            - 'bitcoin'
            - 'ethereum'
            - 'seed'
            - 'phrase'
            - 'wallet'
    condition: selection_clipboard and selection_context
falsepositives:
    - Legitimate administrator scripts managing crypto data
level: high
---
title: Lazarus Mach-O Man macOS ClickFix Pattern
id: 6e0f9b3c-2d4e-5g8h-1i2j-3k4l5m6n7o8p
description: Detects suspicious terminal commands often executed during ClickFix attacks on macOS leading to Mach-O binary downloads.
status: experimental
date: 2026/05/26
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.execution
logsource:
    product: macos
    category: process_creation
detection:
    selection_curl:
        Image|endswith:
            - '/curl'
            - '/wget'
    selection_params:
        CommandLine|contains:
            - 'http://'
            - 'https://'
        CommandLine|endswith:
            - '.sh'
            - '.dmg'
            - '.zip'
            - '.osascript'
    selection_suspicious_tld:
        CommandLine|contains:
            - '.xyz'
            - '.top'
            - '.info'
    condition: selection_curl and selection_params and selection_suspicious_tld
falsepositives:
    - Legitimate software installation scripts
level: critical
---
title: Compromised Laravel Lang Backdoor Execution
id: 7a1g8h4i-3j5k-6l7m-8n9o-0p1q2r3s4t5u
description: Detects execution of the backdoored helpers.php or unusual network connections from PHP processes associated with the Laravel compromise.
status: experimental
date: 2026/05/26
author: Security Arsenal
tags:
    - attack.initial_access
    - attack.supply_chain
logsource:
    product: linux
    category: process_creation
detection:
    selection_php:
        Image|endswith:
            - '/php'
            - '/php-fpm'
    selection_args:
        CommandLine|contains:
            - 'helpers.php'
            - 'eval('
            - 'base64_decode'
    selection_net:
        CommandLine|contains:
            - 'flipboxstudio.info'
            - 'curl'
            - 'fopen'
    condition: selection_php and selection_args and selection_net
falsepositives:
    - Legitimate application debugging or encoded operations
level: high



kql
// Hunt for network connections to known TwizAdmin and Cloud Atlas infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("fanonlyatn.xyz", "flipboxstudio.info", "livemicrosft.com", "istochnik.org") 
   or RemoteIP in ("46.17.44.125", "185.22.154.73", "195.58.49.9", "93.125.114.193", "194.102.104.207")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort

// Hunt for file hashes associated with Mach-O Man and TwizAdmin
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in ("06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092", 
                       "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
                       "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName



powershell
# IOC Hunt Script for TwizAdmin and Mach-O Man (Windows Enviroment)
# Checks for the presence of specific file hashes and suspicious domains in host file

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527"
)

$SuspiciousDomains = @(
    "fanonlyatn.xyz",
    "flipboxstudio.info"
)

function Get-FileHashRecursive {
    param ($Path)
    Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
        if (-not $_.PSIsContainer) {
            $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue
            if ($hash.Hash -in $TargetHashes) {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

function Check-HostsFile {
    $hostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
    if (Test-Path $hostsPath) {
        $content = Get-Content $hostsPath
        foreach ($domain in $SuspiciousDomains) {
            if ($content -match $domain) {
                Write-Host "[!] SUSPICIOUS ENTRY IN HOSTS FILE: $domain" -ForegroundColor Yellow
            }
        }
    }
}

Write-Host "Starting IOC Hunt..." -ForegroundColor Cyan

# Scan common user directories
Get-FileHashRecursive -Path "$env:USERPROFILE\Downloads"
Get-FileHashRecursive -Path "$env:APPDATA"
Get-FileHashRecursive -Path "$env:TEMP"

# Check Hosts file
Check-HostsFile

Write-Host "Hunt Complete." -ForegroundColor Cyan


# Response Priorities

**Immediate (0-24h):**
*   Block all listed domains and IP addresses at the perimeter and proxy level.
*   Initiate a hunt for the specific SHA256 file hashes across all endpoints using EDR.
*   Isolate any systems identified with communication to `fanonlyatn.xyz` or `flipboxstudio.info`.

**24-48h:**
*   **Credential Reset:** Mandate password resets and MFA re-enrollment for developer accounts, specifically those with access to Laravel repositories or Docker Hub.
*   **Audit:** Audit all Laravel Lang package versions; revert to versions prior to May 22, 2026, or migrate to official forks.
*   **Container Hygiene:** Scan all Docker images locally; do not pull `kics` tags `v2.1.20`, `v2.1.21`, or `alpine`.

**1 Week:**
*   **Architecture Hardening:** Implement strict allow-listing for outbound traffic from build servers and developer workstations.
*   **Supply Chain Verification:** Enable SBOM (Software Bill of Materials) generation and verification for all third-party dependencies.
*   **User Awareness:** Conduct specific security awareness training regarding "ClickFix" social engineering targeting macOS users.