Vercel-Hosted Phishing Campaign Distributing LogMeIn RAT: OTX Pulse Analysis

title: Suspicious Executable Creation with .bin Extension
id: 8a2b4c1d-5e6f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects creation of executable files with .bin extension often used in phishing to bypass filters and deliver malware like LogMeIn.
references:
  - https://otx.alienvault.com/pulse/6600000000000000
author: Security Arsenal
date: 2026/07/12
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.exe.bin'
  condition: selection
falsepositives:
  - Legitimate software installers utilizing .bin wrappers (rare)
level: high

---
title: LogMeIn Remote Access Software Installation
id: 9b3c5d2e-6f7a-5b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects the installation of LogMeIn remote access software. While legitimate, its sudden presence in an enterprise environment without approval may indicate compromise.
references:
  - https://otx.alienvault.com/pulse/6600000000000000
author: Security Arsenal
date: 2026/07/12
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|contains:
      - 'LogMeIn.exe'
      - 'LMIGuardian.exe'
      - 'LogMeInSystray.exe'
  selection_cli:
    CommandLine|contains:
      - 'install'
      - '/f'
  condition: 1 of selection_*
falsepositives:
  - Authorized remote administration activities
level: medium

---
title: Browser Process Spawning Suspicious Child Process
id: 0c4d6e3f-7a8b-6c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects web browsers spawning child processes like powershell or cmd, often indicative of a phishing download executing malware.
references:
  - https://otx.alienvault.com/pulse/6600000000000000
author: Security Arsenal
date: 2026/07/12
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - 'chrome.exe'
      - 'msedge.exe'
      - 'firefox.exe'
  selection_child:
    Image|endswith:
      - 'powershell.exe'
      - 'cmd.exe'
      - 'wscript.exe'
      - 'cscript.exe'
  condition: all of selection_*
falsepositives:
  - System administration or web-based troubleshooting tools
level: medium


kql
// Hunt for LogMeIn installation and execution
DeviceProcessEvents
| where Timestamp > ago(7d)
| where ProcessCommandLine has "LogMeIn" or FileName has_any_("LogMeIn.exe", "LMIGuardian.exe")
| extend Account = AccountName
| project Timestamp, DeviceName, Account, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

// Hunt for specific IOCs (File Hashes) on endpoints
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 == "0a1a85a026b6d477f59bc3d965b07d0d06e6ff2d34381aff79ea71c38fed802b" 
   or MD5 in ("322a92b443faefe48fce629e8947e4e2", "e230bf859e582fe95df0b203892048df", "f3f8379ce6e0b8f80faf259db2443f13", "f782c936249b9786cc7fac580da3ae0f") 
   or SHA1 == "5fd4bcca28553ebe759ec97fcbc3a2a732268f85"
| project Timestamp, DeviceName, FolderPath, SHA256, MD5, InitiatingProcessAccountName, ActionType


powershell
# IOC Hunt Script for LogMeIn Abuse and Vercel Malware
# Requires Administrator Privileges

# Define Hashes from Pulse
$TargetMD5 = @("322a92b443faefe48fce629e8947e4e2","e230bf859e582fe95df0b203892048df","f3f8379ce6e0b8f80faf259db2443f13","f782c936249b9786cc7fac580da3ae0f")
$TargetSHA256 = "0a1a85a026b6d477f59bc3d965b07d0d06e6ff2d34381aff79ea71c38fed802b"
$TargetSHA1 = "5fd4bcca28553ebe759ec97fcbc3a2a732268f85"

Write-Host "[+] Scanning for malicious file hashes (This may take time)..." -ForegroundColor Cyan

# Search common user directories and temp folders
$PathsToScan = @("C:\Users\", "C:\Windows\Temp\", "C:\ProgramData\")

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | Where-Object { 
            $_.Extension -match '\.(exe|bin|dll)' -and $_.Length -gt 0kb -and $_.Length -lt 100mb
        } | ForEach-Object {
            $hashMD5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            $hashSHA256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            $hashSHA1 = (Get-FileHash -Path $_.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash

            if ($TargetMD5 -contains $hashMD5 -or $TargetSHA256 -eq $hashSHA256 -or $TargetSHA1 -eq $hashSHA1) {
                Write-Host "[CRITICAL] Malicious IOC found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

Write-Host "\n[+] Checking for unauthorized LogMeIn Installation..." -ForegroundColor Cyan
$LogMeInPaths = @("${env:ProgramFiles}\LogMeIn", "${env:ProgramFiles(x86)}\LogMeIn")
foreach ($LMPath in $LogMeInPaths) {
    if (Test-Path $LMPath) {
        Write-Host "[WARNING] LogMeIn detected at $LMPath" -ForegroundColor Yellow
        # Check service status
        Get-Service -Name *LogMeIn* -ErrorAction SilentlyContinue | Select-Object Name, Status, StartType
    }
}

Write-Host "\n[+] Hunt Complete." -ForegroundColor Green