Follow 
Detection stack
- AIDR
- Alert
- ETL
- Query
Summary
PasteSwitch is a large-scale, coordinated malvertising campaign that abused a verified Reddit account to distribute malicious payloads through ClickFix social engineering. The operation uses deceptive terminal commands to persuade users to execute code that installs macOS stealers, Windows loaders, and cryptocurrency clippers. Its infrastructure is highly resilient, relying on blockchain-based C2 rotation and TLS SNI spoofing to evade detection.
Investigation
Researchers from Hudson Rock and ADAMnetworks identified the campaign after a user reported suspicious HBO Max advertisements on Reddit. The investigation uncovered a complex delivery framework with separate platform-specific branches targeting macOS and Windows. Analysts also identified rotating domains and smart contracts on the Binance Smart Chain used to manage Command and Control infrastructure.
Mitigation
Organizations should enforce strict controls around terminal command execution and monitor for suspicious copy-paste social engineering behavior. Security teams should detect unauthorized scheduled task creation and in-memory shellcode execution. Monitoring for TLS SNI mismatches and unusual outbound connections to direct IP addresses can also improve detection.
Response
If malicious activity is detected, affected endpoints should be isolated immediately and credentials for accounts accessed from the compromised device should be reset. Responders should perform memory forensics to identify injected payloads such as Amatera. Blockchain activity and network telemetry should also be reviewed for connections to known PasteSwitch C2 infrastructure.
Attack Flow
Detections
Suspicious LOLBAS MSHTA Defense Evasion Behavior by Detection of Associated Commands (via process_creation)
Suspicious Command and Control by Unusual Top Level Domain (TLD) DNS Request (via dns)
Possible Base64 Encoded Strings Manipulation [MacOS] (via cmdline)
Suspicious Curl Execution Attempt [MacOS] (via cmdline)
Archive Was Created In MacOS Temporary Folder (via file_event)
IOCs (HashSha256) to detect: Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises Part 3
IOCs (HashSha256) to detect: Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises Part 2
IOCs (HashSha256) to detect: Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises Part 1
IOCs (SourceIP) to detect: Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises
IOCs (DestinationIP) to detect: Largest AI Supply Chain Breach of 2026: LiteLLM Hack Impacts Thousands of Global Enterprises
Detection of Amatera Stealer Shellcode Injection [Windows Sysmon]
Detect Deceptive TLS SNI Spoofing with facebook.com SNI [Windows Network Connection]
Detection of Malicious Activity Using MSHTA and PowerShell Commands [Windows Powershell]
Simulation Execution
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
-
Attack Narrative & Commands: An attacker has gained initial access via a phishing link. To bypass basic signature-based detection, they use
mshta.exeto execute a malicious HTA script hosted on a local temp directory. Once inside, the attacker uses an encoded PowerShell command to download a second-stage payload, attempting to hide the intent of the script. Finally, to ensure they maintain access even after a reboot, they create a scheduled task that executes a PowerShell script every time the system starts. -
Regression Test Script:
# 1. Simulate MSHTA execution (T1218.005) # Creating a dummy HTA file $htaContent = "<html><body><script>alert('Malicious HTA');</script></body></html>" $htaPath = "$env:TEMPmalicious.hta" $htaContent | Out-File -FilePath $htaPath -Encoding ascii # Triggering MSHTA (This should trigger the rule) Start-Process "mshta.exe" -ArgumentList "`"$htaPath`"" # 2. Simulate Encoded PowerShell (T1027.017) # The following is an encoded version of 'Write-Host "Malicious Payload Executed"' $encodedCommand = "V3JpdGUtSG9zdCAiTWFsaWNpb3VzIFBheWxvYWQgRXhlY3V0ZWQi" # Triggering PowerShell with EncodedCommand (This should trigger the rule) powershell.exe -NoProfile -EncodedCommand $encodedCommand # 3. Simulate Scheduled Task Persistence (T1053) # Creating a task that runs a PowerShell command $taskName = "WindowsUpdateCheck" $action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-ExecutionPolicy Bypass -WindowStyle Hidden -Command 'Write-Host Malicious Task'" Register-ScheduledTask -Action $action -Trigger (New-ScheduledTaskTrigger -AtLogOn) -TaskName $taskName -Description "Simulated Persistence" -
Cleanup Commands:
# Remove the dummy HTA file Remove-Item -Path "$env:TEMPmalicious.hta" -Force # Remove the scheduled task Unregister-ScheduledTask -TaskName "WindowsUpdateCheck" -Confirm:$false
