TwizAdmin, Mach-O Man & Void Dokkaebi: Multi-Platform Infostealer & Supply Chain Attacks

---
title: Potential macOS ClickFix Terminal Command Execution
id: 8c7b3d1a-5e2f-4a1c-9b0e-1f2a3b4c5d6e
description: Detects suspicious execution patterns often associated with macOS ClickFix attacks where a curl command pipes into bash or osascript, commonly seen in Mach-O Man and Fake Capcha campaigns.
status: experimental
date: 2026/04/22
author: Security Arsenal
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/osascript'
      - '/zsh'
    CommandLine|contains:
      - 'curl '
      - 'wget '
  condition: selection | count(CommandLine) > 3
falsepositives:
  - Legitimate software installation scripts
level: high
tags:
  - attack.execution
  - attack.t1059.004
  - osx.clickfix
---
title: VS Code Task Executing Suspicious Processes
id: 9d8c4e2b-6f3a-5b2d-0c1f-2a3b4c5d6e7f
description: Detects exploitation of VS Code tasks as used by Void Dokkaebi. Identifies code.exe or electron spawning shell processes like powershell or cmd in the context of a project directory.
status: experimental
date: 2026/04/22
author: Security Arsenal
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\Code.exe'
      - '\Applications\Visual Studio Code.app\Contents\MacOS\Electron'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '/bin/bash'
      - '/bin/sh'
    CommandLine|contains:
      - 'npm'
      - 'node'
      - 'python'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate developer build tasks
level: medium
tags:
  - attack.execution
  - attack.t1204
  - supply.chain.attack
---
title: TwizAdmin C2 Network Connection
id: 0e1f2a3b-4c5d-6e7f-8a9b-0c1d2e3f4a5b
description: Detects outbound connections to non-standard HTTP ports associated with TwizAdmin FastAPI C2 panels (Port 1337) or known specific IPs from the pulse.
status: experimental
date: 2026/04/22
author: Security Arsenal
logsource:
  category: network_connection
detection:
  selection_port:
    DestinationPort: 1337
  selection_ip:
    DestinationIp|contains:
      - '103.241.66'
      - '31.31.198'
  condition: 1 of selection*
falsepositives:
  - Legitimate use of port 1337 for local development (rare externally)
level: critical
tags:
  - attack.command_and_control
  - attack.c2
  - malware.twizadmin


kql
// Hunt for network connections to known C2 infrastructure and malicious domains
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 1337 
   or RemoteUrl has "fanonlyatn.xyz" 
   or RemoteUrl has "livemicrosft.com"
   or RemoteUrl has "bull-run.fun"
   or RemoteUrl has "spot-wave.fun"
   or RemoteUrl has "scanclaw.live"
   or RemoteUrl has "moonscan.live"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IOCMatch = "TwizAdmin / Lazarus / ClickFix"


powershell
# IOC Hunt Script for Windows Environments
# Checks for presence of malicious file hashes and specific network connections

$maliciousHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "e12285f507c847b986233991b86b22e3" # MD5 from macOS pulse, checking Windows just in case
)

$maliciousDomains = @(
    "fanonlyatn.xyz",
    "livemicrosft.com",
    "bull-run.fun",
    "spot-wave.fun"
)

Write-Host "[+] Scanning for TwizAdmin and Lazarus related IOCs..." -ForegroundColor Cyan

# Check Active Connections
$activeConnections = Get-NetTCPConnection -State Established | Select-Object LocalPort, RemoteAddress, OwningProcess
foreach ($conn in $activeConnections) {
    try {
        $process = Get-Process -Id $conn.OwningProcess -ErrorAction Stop
        $remoteIP = $conn.RemoteAddress
        
        # Check against specific IP ranges mentioned in intel
        if ($remoteIP -like "103.241.66.*" -or $remoteIP -like "31.31.198.*" -or $remoteIP -like "172.94.9.*") {
            Write-Host "[!] Suspicious Connection Found: $remoteIP (Port $($conn.LocalPort)) owned by $($process.ProcessName) (PID: $($conn.OwningProcess))" -ForegroundColor Red
        }
    } catch {
        # Ignore access errors for system processes
    }
}

# Check DNS Cache (requires admin)
try {
    $dnsCache = Get-DnsClientCache | Where-Object { $maliciousDomains -contains $_.Entry }
    if ($dnsCache) {
        Write-Host "[!] Malicious Domain found in DNS Cache:" -ForegroundColor Red
        $dnsCache | Format-Table Entry, Data, TimeToLive
    } else {
        Write-Host "[-] No malicious domains found in local DNS cache." -ForegroundColor Green
    }
} catch {
    Write-Host "[-] Could not access DNS cache. Run as Administrator." -ForegroundColor Yellow
}

Write-Host "[+] Hunt Complete."