TwizAdmin RaaS & Lazarus Mach-O Man: OTX Pulse Analysis — Multi-Stage Crypto Theft & macOS ClickFix

title: Potential TwizAdmin FastAPI C2 Check-in
description: Detects potential network connection to TwizAdmin C2 infrastructure characterized by specific user-agent or path patterns often seen with FastAPI panels.
references:
  - https://intel.breakglass.tech/post/twizadmin-103-241-66
author: Security Arsenal
date: 2026/05/24
modified: 2026/05/24
tags:
  - attack.c2
  - attack.command_and_control
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains:
      - '/api/v1/'
      - '/license'
    c-uri|contains:
      - 'fanonlyatn.xyz'
  condition: selection
falsepositives:
  - Legitimate API traffic to whitelisted domains
level: high
---
title: Lazarus Group macOS ClickFix Execution Pattern
description: Detects the execution of suspicious commands via Terminal often seen in ClickFix attacks (curl | bash) targeting macOS.
references:
  - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
author: Security Arsenal
date: 2026/05/24
tags:
  - attack.execution
  - attack.user_execution
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    Image|endswith:
      - '/bin/bash'
      - '/bin/sh'
      - '/bin/zsh'
  selection_cli:
    CommandLine|contains:
      - 'curl '
      - 'wget '
    CommandLine|contains:
      - ' | '
      - ' > '
  condition: all of selection_*
falsepositives:
  - Administrative script execution
level: high
---
title: Suspicious Mach-O Binary Creation in User Directory
description: Detects creation of Mach-O binaries in temporary or user download directories, indicative of Mach-O Man malware deployment.
references:
  - https://any.run/cybersecurity-blog/lazarus-macos-malware-mach-o-man/
author: Security Arsenal
date: 2026/05/24
tags:
  - attack.defense_evasion
  - attack.initial_access
logsource:
  category: file_creation
  product: macos
detection:
  selection:
    TargetFilename|contains:
      - '/Downloads/'
      - '/tmp/'
    TargetFilename|endswith:
      - '.app'
      - '.dmg'
  filter:
    Image|contains:
      - '/Installer.app/'
      - '/Software Update'
  condition: selection and not filter
level: medium



kql
// Hunt for TwizAdmin and Lazarus Mach-O Man Network Indicators
// Look for connections to known malicious domains and Middle East C2 IPs
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any (
    "fanonlyatn.xyz",
    "livemicrosft.com"
)
or RemoteIP in (
    "37.32.15.8",
    "197.51.170.131",
    "5.109.182.231",
    "93.113.62.247",
    "94.252.245.193"
)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend ThreatIntel = "OTX Pulse TwizAdmin/Lazarus"



powershell
<#
.SYNOPSIS
    IOC Hunt Script for TwizAdmin and Mach-O Man Hashes
.DESCRIPTION
    Scans the file system for specific SHA256 hashes associated with the active campaigns.
#>

$TargetHashes = @(
    "06299676b43749b8477c4bc977c09512957fc9b66fd5030c1874069632ce6092",
    "3fcd267e811d9b83cafa3d8d6932fa1c56f4fd8dcf46f9ec346e0689439532d4",
    "584796212f99efc7ac765d6048913fe34e46a64b13a8a78fb3a465b8c61f3527",
    "74ab520e94b2f3b8915ec7b47abab7a2d7e9759add5aa195af7edf0ffa5b4150",
    "9d9783f57fd543043e0792d125831883259c823a5eaa69211e5254db4db4eaec",
    "0f41fd82cac71e27c36eb90c0bf305d6006b4f3d59e8ba55faeacbe62aadef90",
    "24af069b8899893cfc7347a4e5b46d717d77994a4b140d58de0be029dba686c9",
    "4b08a9e221a20b8024cf778d113732b3e12d363250231e78bae13b1f1dc1495b",
    "85bed283ba95d40d99e79437e6a3161336c94ec0acbc0cd38599d0fc9b2e393c",
    "871d8f92b008a75607c9f1feb4922b9a02ac7bd2ed61b71ca752a5bed5448bf3",
    "89616a503ffee8fc70f13c82c4a5e4fa4efafa61410971f4327ed38328af2938",
    "a9562ab6bce06e92d4e428088eacc1e990e67ceae6f6940047360261b5599614"
)

Write-Host "Starting IOC Hunt for TwizAdmin/Mach-O Man Hashes..." -ForegroundColor Cyan

$DrivesToScan = Get-PSDrive -PSProvider FileSystem | Select-Object -ExpandProperty Root

foreach ($Hash in $TargetHashes) {
    Write-Host "Scanning for Hash: $Hash" -ForegroundColor Yellow
    foreach ($Drive in $DrivesToScan) {
        try {
            Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
            ForEach-Object {
                $FilePath = $_.FullName
                try {
                    $FileHash = (Get-FileHash -Path $FilePath -Algorithm SHA256 -ErrorAction Stop).Hash
                    if ($FileHash -eq $Hash) {
                        Write-Host "[MATCH] Malicious file found: $FilePath" -ForegroundColor Red
                    }
                } catch {
                    # Ignore errors for locked files or access denied
                }
            }
        } catch {
            # Ignore drive access errors
        }
    }
}
Write-Host "Scan Complete." -ForegroundColor Green