Vidar, Lumma, and SilabRAT: Multi-Vector Credential Theft Campaigns via AI Lures & Supply Chains

---
title: Potential Vidar/Lumma Stealer via PowerShell Social Media Lure
id: 8e2f4a91-1b2c-3d4e-5f6a-7b8c9d0e1f2a
description: Detects PowerShell commands downloading payloads from suspicious TLDs often used in TikTok or AI-themed malvertising campaigns for Vidar/Lumma stealers.
status: experimental
date: 2026/06/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/ai-brands-as-bait/
    - https://otx.alienvault.com/pulse/fake-software-tutorials-tiktok/
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: \powershell.exe
        CommandLine|contains:
            - 'Invoke-WebRequest'
            - 'IEX'
            - 'DownloadString'
    selection_url:
        CommandLine|contains:
            - '.run'
            - '.xyz'
            - 'msget.run'
            - 'd4ug.site'
    condition: selection and selection_url
falsepositives:
    - Legitimate administration scripts downloading from rare TLDs
level: high
---
title: Malicious PyPI Wheel Execution via .pth Hooks
id: 3c1d2e3f-4a5b-6c7d-8e9f-0a1b2c3d4e5f
description: Detects the creation of .pth files in Python site-packages, a technique used by Miasma and Hades worms to achieve persistence via import hooks.
status: experimental
date: 2026/06/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/mini-shai-hulud-miasma/
tags:
    - attack.persistence
    - attack.t1547.001
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: '\Lib\site-packages\'
        TargetFilename|endswith: '.pth'
    condition: selection
falsepositives:
    - Legitimate Python package installations (verify package reputation)
level: medium
---
title: Cisco SD-WAN Manager Authentication Bypass Exploit Attempt
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects exploitation attempts against Cisco Catalyst SD-WAN Manager utilizing authentication bypass vulnerabilities.
status: experimental
date: 2026/06/13
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/cisco-sd-wan-exploitation/
tags:
    - attack.initial_access
    - attack.t1190
logsource:
    product: cisco
    service: sd-wan
detection:
    selection_uri:
        c-uri|contains:
            - '/appmgr/maintenance/'
            - '/das/query'
    selection_method:
        c-method: 'POST'
    selection_status:
        sc-status: 200
    condition: all of selection_*
falsepositives:
    - Unknown
level: critical


kql
// Hunt for Vidar/Lumma C2 Domains and IP connections
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("brokeapt.com", "msget.run", "d4ug.site", "pan.rongtv.xyz") 
   or RemoteIP == "91.199.163.124"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend ThreatContext = "OTX Pulse: AI Lures / TikTok / SilabRAT"

// Hunt for file hashes associated with identified malware families
DeviceProcessEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b"
)
| project Timestamp, DeviceName, FolderPath, ProcessCommandLine, SHA256


powershell
# IOC Hunter: Scans for Vidar/Lumma/Payload Artifacts on Disk
# Requires Administrator Privileges

$TargetHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b"
)

Write-Host "[+] Starting IOC Scan for Vidar/Lumma/SilabRAT Artifacts..." -ForegroundColor Cyan

# Scan C: drive
$DrivesToScan = @("C:\")

foreach ($Drive in $DrivesToScan) {
    Write-Host "[+] Scanning $Drive..." -ForegroundColor Yellow
    
    Get-ChildItem -Path $Drive -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { 
        $_.Length -gt 0kb -and 
        $_.Extension -match "(exe|dll|ps1|zip|rat)" -and
        ($TargetHashes -contains (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash)
    } | 
    Select-Object FullName, @{Name="SHA256";Expression={(Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash}}, LastWriteTime | 
    Export-Csv -Path "C:\Temp\IOC_Match.csv" -NoTypeInformation -Append
}

if (Test-Path "C:\Temp\IOC_Match.csv") {
    Write-Host "[!] Scan Complete. Matches found at C:\Temp\IOC_Match.csv" -ForegroundColor Red
} else {
    Write-Host "[+] Scan Complete. No matching files found." -ForegroundColor Green
}