Intelligence Insights: August 2026
Red Canary's July 2026 threat intelligence highlights ClearFake maintaining its top position and the debut of four new threats: GraphSpy, Phexia, CastleRAT, and EtherRAT. A notable trend is the increasing use of dead drop resolution and EtherHiding, where malware queries public blockchain smart contracts or abused legitimate platforms like Steam and Telegram to dynamically resolve C2 URLs. This technique complicates static analysis and indicator-based blocking.
Detection / Hunteropenrouter
What Happened
Red Canary published its monthly report on the most common cyber threats for July 2026. A threat known as ClearFake remained the most prevalent, tricking users into downloading malware through fake website prompts. The report also introduced four new threats: GraphSpy targets Microsoft cloud accounts, while Phexia, CastleRAT, and EtherRAT are remote access tools that can steal data and take over computers. These new threats use a technique where they hide their command-and-control addresses on public blockchains or legitimate platforms like Steam, making them harder to block. Organizations should restrict access to public blockchain services if they are not needed and monitor for unusual outbound network connections.
Key Takeaways
- ClearFake remains the top threat for the fourth consecutive month, using fake CAPTCHA lures for malicious copy-and-paste execution.
- Four new threats debuted: GraphSpy (Entra ID phishing), Phexia (macOS stealer/RAT), CastleRAT (Python/C RAT), and EtherRAT (Node.js RAT).
- Phexia, CastleRAT, and EtherRAT use dead drop resolution via blockchain smart contracts, Steam, or Telegram to dynamically resolve C2 infrastructure.
- EtherHiding, a subset of dead drop resolution using public blockchain RPC endpoints, is increasingly used to obscure C2 locations and complicate static analysis.
Affected Systems
- macOS
- Windows workstations
- Linux servers
- Microsoft 365
- Entra ID
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: ClearFake or malicious copy-and-paste lures trick users into executing malicious curl commands.
- Execution: Malware like Phexia or EtherRAT is downloaded and executed via osascript or msiexec.
- Persistence: Phexia creates a LaunchAgent plist to run base64-encoded AppleScript payloads on boot.
- C2 Resolution: Implants query public blockchain RPC endpoints or legitimate platforms to retrieve dynamic C2 URLs.
- C2 and Exfiltration: Implant connects to resolved C2 server for data exfiltration and further commands.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but offers mitigation strategies and behavioral descriptions.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can detect process executions (curl, osascript, msiexec) and persistence mechanisms (LaunchAgents), but blockchain C2 resolution may blend with legitimate traffic. |
| Network Visibility | Low | Network visibility is low because C2 resolution uses legitimate public blockchain RPC endpoints and platforms like Steam. |
| Detection Difficulty | Hard | Dead drop resolution and EtherHiding make static analysis and indicator-based detection difficult due to dynamic C2 resolution. |
Required Log Sources
- Process execution logs
- Network connection logs
- LaunchAgent creation events
- DNS logs
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for curl or osascript processes executing from user contexts with network connections to low-prevalent domains. | Process and network connection logs | Execution | Medium |
| Consider hunting for LaunchAgent plist files configured with KeepAlive and RunAtLoad set to true that execute base64-encoded payloads via osascript. | File creation and process execution logs | Persistence | Low |
| If you have visibility into network traffic, consider hunting for outbound HTTPS connections to known public blockchain RPC endpoints from standard user workstations. | Network firewall or proxy logs | C2 Resolution | High |
| Consider hunting for msiexec.exe installing MSI files from local user AppData directories. | Process execution and file operation logs | Execution | Low |
Control Gaps
- Static IP/domain blocking is ineffective due to dynamic C2 resolution.
- Traditional AV may miss fileless or memory-executed payloads.
Key Behavioral Indicators
- curl downloading files and piping to osascript
- LaunchAgent persistence executing base64 AppleScript
- msiexec installing from AppData\Local
- eth_call RPC requests to public blockchain nodes
False Positive Assessment
Medium
Recommendations
Immediate Mitigation
- Verify against your organization's incident response runbook and team escalation paths before acting.
- Consider revoking refresh tokens and active sessions for users targeted by GraphSpy.
- If applicable, unload and remove malicious LaunchAgent plist files from macOS endpoints.
Infrastructure Hardening
- Evaluate restricting direct access to public blockchain RPC endpoints if there is no legitimate business need.
- Consider implementing network signatures for specific dead drop resolution traffic.
- If supported by your proxy, enforce external network communication policies to block unauthorized external services.
User Protection
- Consider restricting or blocking device code authentication flow via Conditional Access policies for users and locations that do not require it.
- Evaluate whether QuickAssist use is common in your organization and scrutinize its use accordingly.
Security Awareness
- Consider rolling training on malicious copy-and-paste (ClickFix) lures into existing awareness programs.
- Educate users on the risks of executing commands from untrusted websites, especially those prompting fake CAPTCHAs.
MITRE ATT&CK Mapping
Initial Access
Execution
Persistence
Command and Control
Additional IOCs
- Command Lines:
- Purpose: Download and execute Phexia payload via malicious copy and paste | Tools:
curl,osascript| Stage: Execution |curl -A "Mac OS X 10_15_7" -fsSL <url> - Purpose: Query Polygon blockchain smart contract for C2 URL resolution | Tools:
curl| Stage: C2 Resolution |curl -s --max-time 15 <url> -X POST -H 'Content-Type: application/' --data '<>' - Purpose: Download and silently install EtherRAT MSI payload | Tools:
cmd.exe,curl,msiexec| Stage: Execution
- Purpose: Download and execute Phexia payload via malicious copy and paste | Tools:
- urlhxxps://ethereum-rpc[.]publicnode[.]comPublic Ethereum RPC endpoint used for C2 resolution via smart contract queries.
- urlhxxps://polygon[.]drpc[.]orgPublic Polygon RPC endpoint used by Phexia to query smart contracts for C2 URLs.