TwizAdmin, Mach-O Man & Void Dokkaebi: Multi-Platform Infostealer Surge & Supply Chain Attacks — OTX Pulse Analysis

title: Potential macOS ClickFix Fake Meeting Invite
id: 7a2c9d1e-8f3b-4c1d-a0e5-9b2c3d4e5f6a
status: experimental
description: Detects potential execution of malicious scripts triggered by fake meeting invites or ClickFix campaigns targeting macOS.
references:
    - https://otx.alienvault.com/pulse/66279a0f1d0d0a5f0c5b1b1b
author: Security Arsenal Research
date: 2026/04/24
modified: 2026/04/24
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith:
            - '/osascript'
            - '/bash'
            - '/sh'
            - '/curl'
        CommandLine|contains:
            - 'meeting'
            - 'teams'
            - 'zoom'
            - 'googlemeet'
    condition: selection
falsepositives:
    - Legitimate user executing meeting scripts (rare)
level: high
tags:
    - attack.execution
    - attack.t1059.004
---
title: Suspicious VS Code Git Repository Execution
id: 8b3d0e2f-9g4c-5d2e-b1f6-0c3d4e5f6g7a
status: experimental
description: Detects potential supply chain attack via malicious VS Code tasks or Git repository execution associated with Void Dokkaebi.
references:
    - https://otx.alienvault.com/pulse/66266e5c1d0d0a5f0c5b1b1a
author: Security Arsenal Research
date: 2026/04/24
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\Code.exe'
            - '\git.exe'
    selection_child:
        Image|endswith:
            - '\node.exe'
            - '\python.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    selection_network:
        DestinationIp|contains:
            - '23.27.'
            - '154.91.'
            - '166.88.'
    condition: all of selection_*
falsepositives:
    - Legitimate developer building projects from known internal repos
level: high
tags:
    - attack.initial_access
    - attack.t1195.002
---
title: TwizAdmin C2 Network Traffic
id: 9c4e1f3g-0h5d-6e3f-c2g7-1d4e5f6g7h8a
status: experimental
description: Detects network connections to known TwizAdmin C2 infrastructure and associated IP ranges.
references:
    - https://otx.alienvault.com/pulse/66263d581d0d0a5f0c5b1b19
author: Security Arsenal Research
date: 2026/04/24
logsource:
    category: network_connection
detection:
    selection:
        DestinationIp:
            - '103.241.66.238'
            - '31.31.198.206'
            - '85.239.62.36'
        DestinationPort:
            - 1337
    condition: selection
falsepositives:
    - None
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001


kql
// Hunt for Void Dokkaebi and TwizAdmin Infrastructure Connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in~ ("fanonlyatn.xyz", "bull-run.fun", "spot-wave.fun", "livemicrosft.com", "moonscan.live", "scanclaw.live") 
   or RemoteIP in ("103.241.66.238", "31.31.198.206", "166.88.4.2", "85.239.62.36", "23.27.20.143", "172.94.9.250")
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc


powershell
# IOC Hunt Script for TwizAdmin and Mach-O Man File Hashes
$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90",
    "24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9",
    "e12285f507c847b986233991b86b22e3", # MD5
    "7fd19c564761e2c8c9b583cf30db810e313417c7d3572f637f8cedf4d2cc1e91"
)

$SearchPaths = @("C:\Users\*\Downloads\", "C:\Temp\", "C:\ProgramData\", "C:\Users\*\AppData\Local\Temp\")

Write-Host "Scanning for malicious file hashes associated with TwizAdmin and Mach-O Man..." -ForegroundColor Yellow

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $FileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $FileHash) {
                Write-Host "[ALERT] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
            
            # Check MD5 for specific indicator
            if ($_.Name -like "*.js" -or $_.Name -like "*.exe" -or $_.Name -like "*.dmg") {
                 $MD5Hash = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
                 if ($TargetHashes -contains $MD5Hash) {
                    Write-Host "[ALERT] Malicious file found (MD5): $($_.FullName)" -ForegroundColor Red
                 }
            }
        }
    }
}

# Check for active network connections to C2 IPs
$C2IPs = @("103.241.66.238", "166.88.4.2", "172.94.9.250")
$Connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue
foreach ($Conn in $Connections) {
    $RemoteIP = ($Conn.RemoteAddress).ToString()
    if ($C2IPs -contains $RemoteIP) {
        $Process = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
        Write-Host "[ALERT] Active C2 connection detected to $RemoteIP by process: $($Process.ProcessName)" -ForegroundColor Red
    }
}