UTA0560/JungleBamboo 0-day Chain, Djinn Stealer, Gigabud/Vwork & PaperCut AI Exploitation: OTX Enterprise Detection Pack

Threat Summary

The latest OTX pulse cluster shows credential and session theft being operationalized across every major enterprise control plane: browser, identity, cloud, endpoint, mobile banking, and print management infrastructure. The common objective is not simple malware deployment — it is rapid conversion of initial access into reusable secrets: browser cookies, SSH keys, cloud configuration, package registry tokens, AI assistant credentials, crypto wallets, banking sessions, and domain-adjacent service accounts.

Four activity streams stand out. First, UTA0560 and JungleBamboo are chaining Chrome renderer exploitation with a Windows kernel EoP using CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880, reportedly patched in Chromium source but not yet shipped broadly to stable users. Second, TaskWeaver is delivering Djinn Stealer, a cross-platform Node.js-loader-based infostealer with a rules engine for cloud, source control, package, infrastructure, browser, SSH, wallet, and AI-tooling secrets, with SimpleHelp exploitation linked to CVE-2026-48558. Third, criminal distribution is exploiting GTA VI hype through SEO poisoning and malicious ISO files containing njRAT/Njw0rm, DCRAT, Mercurial Grabber, and Chaos ransomware components. Fourth, GoldFactory is extending Gigabud Android banking operations with Vwork, a weaponized fork of Shelter that abuses Android work profiles to isolate and hide malicious banking activity. Separately, an AI-assisted campaign is targeting internet-facing PaperCut servers using CVE-2026-81578 and CVE-2026-82078, automating target filtering, payload staging, reverse shells, and SOCKS proxying.

Collectively, this is a credential supply-chain problem: once any of these paths lands, the attacker obtains tokens that bypass MFA fatigue controls, enable OAuth/session replay, and open routes into SaaS, CI/CD, financial workflows, and internal management planes.

Threat Actor / Malware Profile

UTA0560 / JungleBamboo — GRIMWEDGE, SUPERSTOMP, LONGTALE: Spear-phishing and lure infrastructure such as msbenefit.com drive targets to a chained browser/kernel exploit. Expected behavior is Chrome renderer compromise followed by Windows kernel privilege escalation and staged payloads. Treat any Chrome crash plus unexpected child process, browser-extension side-load, or post-exploit service creation as high severity.
Djinn Stealer / TaskWeaver: Delivered as a second-stage payload through a Node.js loader and linked to SimpleHelp exploitation. Uses a rules-based collection engine to harvest credentials/config data from browsers, SSH, cloud CLIs, Git/source-control platforms, package registries, infrastructure tooling, AI coding assistants, and wallets. Data is archived for exfiltration to infrastructure such as 96.126.130.126. Likely anti-analysis traits include staged loaders, plaintext config rules, archive staging in temp/user profile paths, and quick process exit after collection.
GTA6 lure bundle — njRAT/Njw0rm, LV, Bladabindi, DCRAT, Mercurial Grabber, Chaos: Malicious ISOs distributed by SEO poisoning, torrents, forums, and social media. ISO mounting is a high-risk initial access pattern because it bypasses some email/web download heuristics. Payload mix supports credential theft, RAT access, and possible ransomware follow-on.
GoldFactory — Gigabud + Vwork: Android banking trojan active since 2022 targeting finance users across Brazil, Colombia, Egypt, Indonesia, Mexico, Morocco, Philippines, and Thailand. Vwork weaponizes app cloning/work-profile isolation to hide malicious banking overlays and RAT functions from normal user-profile inspection.
PaperCut AI-driven exploitation: Internet-facing PaperCut servers are probed and exploited at scale. Exposed operator infrastructure suggests AI-assisted vulnerability research, PoC iteration, target sourcing, campaign execution, timestamped state files, reverse shells, credential harvesting, and SOCKS proxying for internal pivoting.

IOC Analysis

This pulse set is dominated by file hashes, with smaller but high-value network IOCs and CVEs.

Network IOCs: Block and retro-hunt msbenefit.com and 96.126.130.126 across DNS, proxy, firewall, EDR network events, TLS SNI, and NetFlow. Prioritize transactions around patch gaps and remote-access tooling.
CVEs: Treat CVE-2026-85046 / CVE-2026-87491 / CVE-2026-85880, CVE-2026-48558, CVE-2026-81578, and CVE-2026-82078 as attack-path context rather than simple scan findings. Map them to asset criticality: browsers, SimpleHelp/remote support, PaperCut, and endpoints with privileged users.
Hashes: Load all MD5/SHA1/SHA256 values into EDR block lists, threat intel platforms, and YARA/hash retro-hunts. MD5-only indicators from commodity bundles can collide and age quickly; use them for historical matching and pair with behavior detections.
Operationalization: SOC teams should pivot from indicator to behavior: ISO mount → child installer → RAT/stealer process → credential-store file access → archive creation → outbound transfer. Tooling that helps decode this activity includes Sysmon/EDR telemetry, Velociraptor or KAPE for triage, YARA/Loki for hash sweeps, Wireshark/Zeek for C2, and sandbox detonation for unknown ISO/Node.js payloads.

Detection Engineering

YAML

---
title: Suspicious Chrome Child Process After Browser Exploit or Spear-Phish
id: 8e2f3d8a-6d53-4d5c-9b1c-ota-chrome-exploit-childproc
status: experimental
description: Detects Chrome spawning script shells, LOLBins, or installers consistent with UTA0560/JungleBamboo Chrome-to-Windows exploit chains and post-exploitation staging.
author: Security Arsenal
references:
  - https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
date: 2026/09/10
modified: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\msiexec.exe'
  filter_known:
    CommandLine|contains:
      - '--type='
      - 'utility'
  condition: selection_parent and selection_child and not filter_known
falsepositives:
  - Enterprise browser extensions using update helpers
  - Software distribution platforms launching browser-based installers
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
---
title: Node.js Loader Accessing Browser SSH Cloud or Wallet Credential Stores
id: 77ed5d95-e6a2-40ef-9f6b-djinn-taskweaver-credential-access
status: experimental
description: Detects TaskWeaver/Djinn-style Node.js processes reading browser login data, SSH keys, cloud CLI configs, Git credentials, package tokens, AI assistant settings, or cryptocurrency wallet files.
author: Security Arsenal
references:
  - https://blackpointcyber.com/blog/threat-snapshot-djinn-stealer/
date: 2026/09/10
modified: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\node.exe'
      - '\nodejs.exe'
      - '\npm.exe'
      - '\npx.exe'
  selection_cli:
    CommandLine|contains:
      - 'Login Data'
      - 'Cookies'
      - 'Local State'
      - '\\.ssh\\'
      - 'id_rsa'
      - 'id_ed25519'
      - '\\.aws\\credentials'
      - '\\.azure\\'
      - '\\.config\\gcloud'
      - 'git-credentials'
      - '.npmrc'
      - '.pypirc'
      - 'kube\\config'
      - 'wallet.dat'
      - 'Electrum'
      - 'Exodus'
      - 'Ledger'
      - 'openai'
      - 'anthropic'
      - 'copilot'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate Node.js developer automation
  - Admin scripts inventorying cloud or package configuration
level: high
tags:
  - attack.credential_access
  - attack.t1552
  - attack.t1555
  - attack.collection
  - attack.t1005
  - attack.exfiltration
---
title: PaperCut or Print Service Spawning Shell Proxy or Download Cradle
id: 2b3383b8-5d72-4ac2-a2ea-papercut-ai-exploitation
status: experimental
description: Detects PaperCut server exploitation behavior including web/service process spawning shells, reverse-shell download cradles, SOCKS proxy tooling, or post-exploit credential commands tied to CVE-2026-81578/CVE-2026-82078 campaigns.
author: Security Arsenal
references:
  - https://blackpointcyber.com/blog/death-by-a-thousand-papercuts-ai-driven-exploitation-at-scale/
date: 2026/09/10
modified: 2026/09/10
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'papercut'
      - 'pc-app'
      - 'pc-print'
      - 'spoolsv.exe'
      - 'tomcat'
      - 'java.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
  selection_cli:
    CommandLine|contains:
      - 'IEX'
      - 'Invoke-WebRequest'
      - 'DownloadString'
      - 'SOCKS'
      - 'reverse'
      - 'nc '
      - 'ncat'
      - 'whoami'
      - 'net user'
      - 'vssadmin'
  condition: selection_parent and selection_child and selection_cli
falsepositives:
  - Print server administration
  - Vulnerability scanners validating PaperCut exposure
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
  - attack.command_and_control
  - attack.t1090

KQL — Microsoft Sentinel / Defender

let OTX_Network = dynamic(["96.126.130.126","msbenefit.com"]);
let OTX_Hashes = dynamic([
"337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d",
"3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f",
"51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc",
"56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951",
"f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc",
"ea991bc9334b36a6b958f564ee716776","0e39e8d7b641bcda4376ebbfeff7b12e","15eca4a3f7350423cf4db0b4c30d1968",
"1ec9eff863dc4418d1498bc3d904899d","2a0834560ed3770fc33d7a42f8229722","2a385fe7bed9899d77d05cb8e302d557",
"57b9c56ef97a7ada98257b23577bf5e3","60a0f58001ea7be538cd42b651924cc7","cf7b54f98eb49463c41e3f7e1690a9aa",
"fd582c3b870e69861bfb36b2d990d93c8538e6a2","4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc",
"b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501","ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae",
"112fefc9348fa4acbb82d54d9688c96dd5671bcb2e6288c1f7f384baa8d2fdcf","9ca27df7938f12794bab0847434482955ca9adea714a34afd315c7a7be522611",
"1f5d99864564c088a3260e54ad1728a3eadc0b509386cae200993b33673b343c",
"08387ff35cc7854ddea1e2106b1150e9fe80646541c95c5a7121b77c9bc0228e","092788c6598784d91b411dde40f274c73448f6c803f57c8d0ca85a22d0516e19",
"243de5404091bcd920041cf2f4dd22e80f2c2922022854991d2b5e0ac78f2fee","4cd2a9d574febb1545966561d598c57194da47b09f9175dd888e6aa5d267f91c",
"5cc0eee4a1d8dbb737838e25f1e9ae37170a54ae757c431b5d6422904538bde3","6106fa15dc10764114d039f26a96d793c559f04b080a27af9f2f27c2eeb391e0"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where RemoteIP in~(OTX_Network) or RemoteUrl contains "msbenefit" or InitiatingProcessFileName in~ dynamic(["chrome.exe","msedge.exe","node.exe","java.exe","spoolsv.exe"])
| project Evidence="Network", TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType),
(DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where SHA256 in~(OTX_Hashes) or SHA1 in~(OTX_Hashes) or MD5 in~(OTX_Hashes)
   or (ProcessCommandLine has_any ("Login Data","Local State",".ssh","id_rsa",".aws\\credentials","git-credentials",".npmrc","wallet.dat","SOCKS","DownloadString","IEX") and FileName in~ dynamic(["node.exe","powershell.exe","cmd.exe","java.exe","chrome.exe","rundll32.exe","certutil.exe"]))
| project Evidence="Process", TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, SHA256, SHA1, MD5, InitiatingProcessFileName, InitiatingProcessCommandLine),
(DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where SHA256 in~(OTX_Hashes) or SHA1 in~(OTX_Hashes) or MD5 in~(OTX_Hashes) or FileName has_any ("Login Data","Local State","id_rsa","credentials",".npmrc","wallet.dat") or FolderPath has "\\AppData\\Local\\Temp"
| project Evidence="File", TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, FileName, FolderPath, SHA256, SHA1, MD5, ActionType)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Artifacts=make_set(Evidence, 10), Devices=make_set(DeviceName, 10) by Evidence
| order by LastSeen desc

PowerShell

[CmdletBinding()] param([switch]$RemediateBlockOnly)
$ErrorActionPreference = 'SilentlyContinue'
$networkIocs = @('96.126.130.126','msbenefit.com')
$hashIocs = @(
'337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d','3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f',
'51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc','56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951',
'f4a72600a3735c2a4d843875ea61bbb6f935a1af51a81f2fbc992ce11ba94afc','08387ff35cc7854ddea1e2106b1150e9fe80646541c95c5a7121b77c9bc0228e',
'092788c6598784d91b411dde40f274c73448f6c803f57c8d0ca85a22d0516e19','243de5404091bcd920041cf2f4dd22e80f2c2922022854991d2b5e0ac78f2fee',
'4cd2a9d574febb1545966561d598c57194da47b09f9175dd888e6aa5d267f91c','5cc0eee4a1d8dbb737838e25f1e9ae37170a54ae757c431b5d6422904538bde3',
'6106fa15dc10764114d039f26a96d793c559f04b080a27af9f2f27c2eeb391e0','4fff28eecc0ab6303e4948df77671009dda5b93ed3d1cead527b02d1317426bc',
'b769721621aed0418b193e4a00e51bc772c8383a4149d23a5425b13475e2d501','ae6f6eeba2bd4cc948d24610d9447986e52f913f4b5ff960ddea26075ff621ae')
$findings = New-Object System.Collections.Generic.List[object]
function Add-Hit([string]$Type,[string]$Path,[string]$Detail){ $findings.Add([pscustomobject]@{Host=$env:COMPUTERNAME; Type=$Type; Path=$Path; Detail=$Detail; Time=(Get-Date).ToString('s')}) }
Get-NetTCPConnection -State Established | Where-Object { $networkIocs -contains $_.RemoteAddress } | ForEach-Object { Add-Hit 'NetworkIOC' ('PID=' + $_.OwningProcess) ($_.LocalAddress + ':' + $_.LocalPort + ' -> ' + $_.RemoteAddress + ':' + $_.RemotePort) }
Get-DnsClientCache | Where-Object { $_.Entry -match 'msbenefit\.com' } | ForEach-Object { Add-Hit 'DnsCache' $_.Entry ($_.Data) }
$runKeys = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run','HKCU:\Software\Microsoft\Windows\CurrentVersion\Run','HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
foreach($k in $runKeys){ Get-ItemProperty $k | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'node|powershell|mshta|rundll32|temp|AppData|\.iso|papercut|vwork|gigabud|taskweaver|djinn' } | ForEach-Object { Add-Hit 'PersistenceRunKey' $k ($_.Name + '=' + $_.Value) } } }
Get-ScheduledTask | Where-Object { ($_.Actions.Execute -match 'powershell|node|mshta|rundll32|certutil|curl|java') -or ($_.TaskName -match 'update|sync|print|gta|vwork|gigabud') } | ForEach-Object { Add-Hit 'ScheduledTask' $_.TaskPath (($_.TaskName) + ' -> ' + ($_.Actions.Execute -join ';')) }
$suspectRoots = @($env:TEMP, $env:LOCALAPPDATA, $env:APPDATA, "$env:PUBLIC\Downloads", 'C:\ProgramData', 'C:\Windows\Temp')
foreach($root in $suspectRoots){ if(Test-Path $root){ Get-ChildItem $root -Recurse -Depth 4 -Force -Include *.exe,*.dll,*.js,*.msi,*.iso,*.ps1,*.jar -ErrorAction SilentlyContinue | Select-Object -First 2500 | ForEach-Object { $h=(Get-FileHash $_.FullName -Algorithm SHA256).Hash; if($hashIocs -contains $h){ Add-Hit 'HashIOC' $_.FullName $h } } } }
Get-Process node,powershell,cmd,java,spoolsv,chrome,msedge -ErrorAction SilentlyContinue | ForEach-Object { $cmd=(Get-CimInstance Win32_Process -Filter ("ProcessId=" + $_.Id)).CommandLine; if($cmd -match 'Login Data|Local State|\.ssh|id_rsa|\.aws\credentials|git-credentials|\.npmrc|wallet\.dat|SOCKS|DownloadString|IEX|papercut|msbenefit'){ Add-Hit 'SuspiciousProcess' ($_.ProcessName + ':' + $_.Id) $cmd } }
Get-Service | Where-Object { $_.Name -match 'papercut|simplehelp|pc-app|pc-print' -or $_.DisplayName -match 'PaperCut|SimpleHelp' } | ForEach-Object { Add-Hit 'RemoteMgmtOrPrintSvc' $_.Name ($_.Status + ' ' + $_.DisplayName) }
$findings | Sort-Object Type, Path | Format-List
if($findings.Count -gt 0){ $out = Join-Path $env:TEMP ('otx_infostealer_hunt_' + (Get-Date -Format yyyyMMddHHmmss) + '.json'); $findings | ConvertTo-Json -Depth 5 | Set-Content $out; Write-Host "Findings exported: $out" } else { Write-Host 'No OTX pulse indicators or suspicious credential-access artifacts found.' }

Response Priorities

Immediate

Block msbenefit.com, 96.126.130.126, all listed hashes, and related GTA6 ISO distribution lures at DNS, proxy, email, EDR, and CASB layers.
Isolate any host with Chrome/Edge spawning script interpreters, Node.js accessing credential stores, or PaperCut/SimpleHelp child processes.
Hunt for ISO mounts, archive creation in temp/profile folders, unexpected work-profile/mobile device enrollment, and outbound SOCKS/reverse-shell behavior.
Patch or mitigate Chrome/Chromium, Windows kernel, SimpleHelp, and PaperCut exposure; if patches are unavailable, disable exposed services, restrict egress, and add virtual patching/WAF rules.

24h

Force identity verification for users on affected endpoints: revoke refresh tokens, reset passwords, invalidate browser sessions, rotate SSH keys, cloud CLI credentials, Git/package tokens, AI assistant API keys, and wallet secrets where applicable.
Review IdP, SaaS, VPN, and CI/CD logs for impossible travel, OAuth consent grants, token replay, MFA changes, and new device enrollments after potential stealer execution.
For mobile finance exposure, validate device integrity, remove cloned/work-profile apps, re-issue banking sessions, and monitor for fraudulent transactions in the targeted regions.

1 week

Reduce browser exploit blast radius with enforced stable-channel rapid updates, extension allowlisting, child-process restrictions, and hardware-backed isolation for high-risk users.
Segment PaperCut/SimpleHelp and other management planes from general user egress; require admin jump hosts, mTLS, and egress deny-by-default.
Harden CI/CD and developer endpoints against Node.js loader execution, credential-file access, and untrusted ISO/torrent content; deploy attack surface reduction rules and application control.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub