11 minhigh
Intelligence Insights: June 2026
Red Canary's May 2026 threat intelligence report identifies ClearFake as the top prevalent threat for a second consecutive month, using fake CAPTCHA lures to deliver malware via paste-and-run execution across multiple threat families. Kali365, a phishing-as-a-service platform debuting at #2, automates OAuth device code phishing against Microsoft 365 environments, capturing access tokens through adversary-in-the-middle techniques. TeamPCP conducted a supply chain worm campaign across npm and PyPI ecosystems using a compromised TanStack CI workflow commit as an entry point.
Sens:▲ 24hConf:high
Showing defanged values
- domain35613analytics[.]comC2 server contacted by Scarlet Goldfinch paste-and-run command to download a PDF payload subsequently executed via mshta
- domainamber-22[.]comC2 server contacted by Atomic Stealer paste-and-run command via HTTP POST to /api/metrics/run?event=pasted endpoint
- domainccudmcx[.]xyzC2 server contacted by HijackLoader paste-and-run command via obfuscated PowerShell download cradle targeting /u path
- ip195[.]10[.]205[.]212C2 server hosting NetSupport Manager payload downloaded via msiexec from /Cpcha path
- urlhxxps://amber-22[.]com/api/metrics/run?event=pastedFull C2 URL contacted by Atomic Stealer paste-and-run curl command to retrieve payload
Detection / Hunteropenrouter
What Happened
Attackers are increasingly tricking people into running malicious code by showing fake CAPTCHA verification screens on compromised websites, then asking users to copy and paste a command that downloads malware. A new phishing service called Kali365 targets Microsoft 365 users by abusing a login method meant for devices like printers and smart TVs, stealing login tokens that let attackers read emails and access files without needing a password. A criminal group called TeamPCP spread malicious code through popular software package repositories (npm and PyPI) by compromising a development tool's build process. Organizations using Microsoft 365, Windows, macOS, or open-source software packages are potentially affected. Defenders should review their Microsoft 365 sign-in logs for device code authentication events, block the device code flow where it is not needed, and educate users about fake CAPTCHA prompts that ask them to copy and paste commands.
Key Takeaways
- ClearFake remains the top prevalent threat for a second month, using fake CAPTCHA lures to trick users into executing malicious code via paste-and-run (ClickFix) techniques across at least 7 threats in the top 10.
- Kali365, a phishing-as-a-service platform, debuted at #2 and automates OAuth device code phishing and adversary-in-the-middle session capture against Microsoft 365 environments, with platform access sold via Telegram for cryptocurrency.
- TeamPCP conducted a self-propagating worm campaign across npm and PyPI ecosystems dubbed Mini Shai-Hulud, using a malicious TanStack CI workflow commit as the entry point for ransomware deployment, credential harvesting, and coinmining.
- Kali365 attack chains produce detectable Entra ID sign-in events with AuthenticationProtocol:deviceCode and ExtendedProperties.RequestType:Cmsi:Cmsi, followed by refresh token redemption from a different IP address.
- A pseudo-detection analytic is provided for identifying suspicious email rule creation where the rule name consists only of special characters, a technique used by BEC actors including Kali365 operators.
Affected Systems
- Microsoft 365 / Microsoft Entra ID tenants
- Windows endpoints (HijackLoader, NetSupport Manager, Scarlet Goldfinch)
- macOS systems (MacSync Stealer, Atomic Stealer)
- npm and PyPI package ecosystems (TeamPCP)
- Compromised websites serving ClearFake JavaScript
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Phishing email impersonating enterprise applications (DocuSign, SharePoint) contains link to adversary-controlled Cloudflare Workers/Pages landing page
- Credential Access: Victim clicks link, views branded landing page with real-time generated device code and link to Microsoft authentication portal; victim enters code and completes authentication
- Token Theft: Kali365 platform collects valid OAuth access token; refresh token later redeemed from a different IP address
- Persistence: Adversary changes victim's password and registers a new device under adversary control
- Defense Evasion: Adversary creates inbox rules with special-character-only names to hide alert emails, redirects messages to unused folders like Conversation History or Deleted Items
- Exfiltration: Adversary accesses Outlook, Teams, and OneDrive using stolen tokens for business email compromise activity
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: Red Canary blog
Article provides a pseudo-detection analytic for identifying email rule creation where the rule name consists only of special characters. Also describes Entra ID sign-in log indicators including AuthenticationProtocol:deviceCode, ExtendedProperties.RequestType:Cmsi:Cmsi, and IncomingTokenType:refreshToken from a different IP address.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Paste-and-run execution chains involving curl, PowerShell, msiexec, and mshta are visible via EDR process telemetry. However, Kali365 operates primarily in the cloud and identity layer where EDR has no visibility. Browser-to-process execution patterns may be partially visible depending on EDR vendor capabilities. |
| Network Visibility | Medium | C2 URLs and IPs for paste-and-run payloads are visible in network logs. Kali365 traffic to Microsoft authentication endpoints appears legitimate and blends with normal Microsoft 365 traffic, making network-based detection difficult without Entra ID log correlation. |
| Detection Difficulty | Moderate | Paste-and-run commands produce process telemetry that is detectable with behavioral analytics. Kali365 device code phishing requires Entra ID log analysis and correlation of token redemption from new IP addresses. Email rule creation with special-character names is a narrow behavioral signal with moderate false positive risk. Multiple attack vectors across endpoint and cloud increase detection complexity. |
Required Log Sources
- Microsoft Entra ID sign-in logs
- Microsoft 365 audit logs (mailbox rule creation events)
- EDR process telemetry with parent-child process relationships
- Web proxy or DNS logs for C2 domain resolution
- Email gateway logs for phishing lure detection
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Entra ID sign-in events where AuthenticationProtocol is deviceCode and ExtendedProperties.RequestType is Cmsi:Cmsi, as these indicate device code authentication flows that may be associated with Kali365 phishing. | Microsoft Entra ID sign-in logs | Credential Access | Medium - legitimate device code authentication occurs for smart TVs, printers, and CLI tools; correlate with refresh token redemption from a different IP to reduce false positives. |
| Consider hunting for refresh token redemption events where the source IP address differs from the IP address used in the original authentication event, as this indicates potential token theft. | Microsoft Entra ID sign-in logs with IncomingTokenType:refreshToken | Credential Access | Low to Medium - legitimate token refresh from a new IP can occur when users change networks; correlate with device code auth events for higher confidence. |
| Consider hunting for email rule creation events where the rule name matches a pattern of only special characters, as adversaries may use overly simple names to avoid drawing suspicion. | Microsoft 365 audit logs (MailItemsAccessed, New-InboxRule operations) | Defense Evasion | Medium - users may legitimately create simply-named rules; correlate with rules that redirect to Deleted Items or Conversation History and target sensitive document types. |
| Consider hunting for process execution where cmd.exe, powershell.exe, curl, or mshta.exe is spawned by a browser process, as this pattern is consistent with paste-and-run execution from compromised websites. | EDR process telemetry with parent-child process relationships | Execution | Medium - some legitimate browser extensions or enterprise tools may spawn command-line processes from browser contexts. |
| Consider hunting for msiexec.exe execution with remote URLs as arguments or mshta.exe execution with local file paths in AppData directories, as these patterns align with Scarlet Goldfinch and NetSupport Manager delivery chains. | EDR process command-line telemetry | Execution | Low - msiexec with remote URLs and mshta with AppData paths are uncommon in normal administrative activity. |
Control Gaps
- Traditional endpoint antivirus will not detect OAuth token theft occurring in the Microsoft 365 cloud layer.
- Device code authentication flow is enabled by default in many Entra ID tenants, allowing Kali365 phishing to succeed without triggering identity-based alerts.
- Network security tools cannot distinguish Kali365 Microsoft 365 authentication traffic from legitimate user authentication traffic without Entra ID log correlation.
- Email security gateways may not flag inbox rule creation as suspicious if the rule name does not contain obvious malicious indicators.
- DLL sideloading used by HijackLoader may bypass application control solutions that trust the legitimate sideloaded binary.
Key Behavioral Indicators
- Browser process as parent of cmd.exe, powershell.exe, curl, or mshta.exe indicating paste-and-run execution
- Entra ID sign-in events with AuthenticationProtocol:deviceCode and ExtendedProperties.RequestType:Cmsi:Cmsi
- Refresh token redemption (IncomingTokenType:refreshToken) from an IP address different than the original authentication event
- Email inbox rules with names consisting only of special characters that redirect to Deleted Items or Conversation History
- msiexec.exe execution with remote URL arguments rather than local MSI file paths
- mshta.exe execution with file paths in AppData\Local directory
- curl execution with custom HTTP headers (user and BuildID) indicating payload retrieval from C2 infrastructure
- PowerShell execution with string concatenation obfuscation in IEX/IRM download cradle patterns
False Positive Assessment
Medium
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing Entra ID sign-in logs for device code authentication events (AuthenticationProtocol:deviceCode) and investigating any refresh token redemptions from unfamiliar IP addresses.
- If your identity platform supports it, consider implementing Conditional Access policies to block the device code authentication flow for all users except a documented exception group containing service accounts and devices with legitimate business requirements.
- Consider evaluating whether enforcing periodic user reauthentication and token protection policies would limit the usefulness of stolen tokens to adversaries.
- If you use npm or PyPI packages, consider auditing dependencies for indicators of the Mini Shai-Hulud worm campaign and reviewing TanStack package integrity.
Infrastructure Hardening
- Consider implementing Conditional Access policies requiring token protection to ensure stolen tokens cannot be used from another device.
- Evaluate whether restricting Microsoft Office client ID (d3590ed6-52b3-4102-aeff-aad2292ab01c) authentication to compliant devices would reduce Kali365 attack surface.
- Consider implementing network-level blocking for identified C2 domains and IPs if your web proxy or firewall supports domain and IP-based filtering.
- If applicable, evaluate whether your CI/CD pipeline has controls to detect malicious workflow commits before they propagate to package registries.
User Protection
- Consider deploying endpoint detection capabilities that flag browser-spawned command-line execution, particularly paste-and-run patterns involving curl, PowerShell, msiexec, and mshta.
- If your EDR supports behavioral detection rules, consider enabling or creating detections for mshta.exe executing files from AppData directories.
- Evaluate whether your email security platform can detect and alert on inbox rule creation with special-character-only rule names.
Security Awareness
- Consider adding fake CAPTCHA and paste-and-run lures to existing security awareness training programs, emphasizing that legitimate websites do not ask users to copy and paste commands into terminals to verify they are human.
- If applicable, consider training users to report emails impersonating DocuSign or SharePoint that request device code entry on external websites.
- Consider educating developers on supply chain risks associated with CI/CD workflow commits and the importance of verifying package integrity after dependency updates.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping17 techniques
Tactic
Initial Access
Tactic
Persistence
Tactic
Credential Access
Tactic
Collection
Tactic
Impact
Additional IOCs
- Urls:
hxxps://amber-22[.]com/api/metrics/run?event=pasted- Full C2 URL contacted by Atomic Stealer paste-and-run curl command to retrieve payloadccudmcx.xyz/u- Full C2 URL path contacted by HijackLoader PowerShell download cradle, reconstructed from obfuscated string concatenation35613analytics.com/uuu- Full C2 URL path contacted by Scarlet Goldfinch curl command to download Voter.pdf payload
- File Paths:
C:\Users\<user>\AppData\Local\Voter.pdf- File downloaded by Scarlet Goldfinch curl command to AppData\Local directory, subsequently executed via mshta
- Command Lines:
- Purpose: Download and execute payload via HTTP POST using curl with custom headers | Tools:
curl| Stage: Execution |curl -fsS -4 --connect-timeout 5 --max-time 10 -X POST - Purpose: Execute obfuscated PowerShell download cradle using IEX and IRM to fetch and run remote payload | Tools:
PowerShell.exe| Stage: Execution |PowerShell.exe - Purpose: Install remote MSI package silently via msiexec with obfuscated package flag | Tools:
msiexec.exe| Stage: Execution |msIeXec.exe -PAcKᵃGE - Purpose: Download file via curl and execute via mshta, using cmd caret obfuscation to evade detection | Tools:
cmd.exe,curl,mshta.exe| Stage: Execution |cmd.exe /c start "" /min
- Purpose: Download and execute payload via HTTP POST using curl with custom headers | Tools: