ThreatFox: ClearFake IOCs

Hunt Hypothesis

This hypothesis targets the presence of ClearFake indicators, a malware family known for leveraging browser extensions to steal credentials and session tokens from web applications. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints or identities before adversaries can leverage stolen sessions to escalate privileges or exfiltrate sensitive data.

IOC Summary

Malware Family: ClearFake Total IOCs: 42 IOC Types: url, domain

Type	Value	Threat Type	First Seen	Confidence
domain	3xoi10iy.usen-glucotrust-bites.com	payload_delivery	2026-09-04	100%
url	hxxps://cloudyrobots.online	payload_delivery	2026-09-04	90%
url	hxxps://benotrobot.online	payload_delivery	2026-09-04	90%
domain	benotrobot.online	payload_delivery	2026-09-04	90%
domain	angkasa138gas.space	payload_delivery	2026-09-04	90%
domain	9c1qnwgg.usen-synadentix.com	payload_delivery	2026-09-04	100%
domain	usen-synadentix.com	payload_delivery	2026-09-04	100%
domain	avantgroup.az	payload_delivery	2026-09-04	90%
domain	hesenhuseyindeniz.ch	payload_delivery	2026-09-04	90%
domain	bws6mgq6.usen-flashburn.com	payload_delivery	2026-09-04	100%
domain	mrlimousine.net	payload_delivery	2026-09-04	90%
url	hxxps://cdn.jsdelivr.net/gh/frantario/a3744/1-2784	payload_delivery	2026-09-04	100%
domain	n0mxdac6.enus-us-glycomute.com	payload_delivery	2026-09-04	100%
domain	qpf49lup.shop-gutlite.us	payload_delivery	2026-09-04	100%
domain	p2ta95ng.usen--puraboost.com	payload_delivery	2026-09-04	100%
domain	europeshallbesaved.org	payload_delivery	2026-09-04	90%
domain	usen--puraboost.com	payload_delivery	2026-09-04	100%
domain	authwic.com	payload_delivery	2026-09-04	90%
domain	proreno.ch	payload_delivery	2026-09-04	90%
domain	traforma.com	payload_delivery	2026-09-04	90%
domain	awilli-india.com	payload_delivery	2026-09-04	90%
domain	fatboysdeli.com	payload_delivery	2026-09-04	90%
domain	corpindianews.com	payload_delivery	2026-09-04	90%
domain	aubergedelatour.ch	payload_delivery	2026-09-04	90%
domain	www.plb-consulting.com	payload_delivery	2026-09-04	90%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - ClearFake
let malicious_domains = dynamic(["3xoi10iy.usen-glucotrust-bites.com", "benotrobot.online", "angkasa138gas.space", "9c1qnwgg.usen-synadentix.com", "usen-synadentix.com", "avantgroup.az", "hesenhuseyindeniz.ch", "bws6mgq6.usen-flashburn.com", "mrlimousine.net", "n0mxdac6.enus-us-glycomute.com", "qpf49lup.shop-gutlite.us", "p2ta95ng.usen--puraboost.com", "europeshallbesaved.org", "usen--puraboost.com", "authwic.com", "proreno.ch", "traforma.com", "awilli-india.com", "fatboysdeli.com", "corpindianews.com", "aubergedelatour.ch", "www.plb-consulting.com", "dj-hakuei.com", "donghomovado.vn", "emberger-dc.com", "forgechurch.com", "empathydisability.com.au", "ar.govaresh-zanan.ir", "ntu.social", "apropos-text.ch", "papillon-schmuck.de", "1trvapwl.usen-neurovera.com", "usen-neurovera.com", "ay8go7sf.usen-enerflow.com", "usen-enerflow.com", "u4llv3k5.usen-neurosharp.com", "usen-neurosharp.com", "k4h6pwge.shop-heroup.com", "k4gwqp86.go-flashburn.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ClearFake
let malicious_urls = dynamic(["https://cloudyrobots.online", "https://benotrobot.online", "https://cdn.jsdelivr.net/gh/frantario/a3744/1-2784"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — ClearFake

False Positive Guidance

• Scenario: A security engineer or DevOps team deploys a new version of the ClearFake browser extension or its companion desktop agent for testing, causing the host to download the specific binary or script associated with the IOC.
  • Filter/Exclusion: Exclude processes or files located in known application directories (e.g., C:\Program Files\ClearFake\, /opt/clearfake/) or exclude events where the parent process is a known installer (e.g., msiexec.exe, winget.exe, dnf, apt-get).
• Scenario: An automated CI/CD pipeline or scheduled backup job archives and transfers the ClearFake configuration files or logs to a central log server, triggering a network connection or file hash match to the IOC.
  • Filter/Exclusion: Exclude network connections where the destination IP is an internal log aggregation server (e.g., Splunk, Elastic, Datadog) or exclude file events where the parent process is a known backup agent (e.g., VeeamBackup.exe, rsync, tar).
• Scenario: A penetration tester or red team member intentionally installs the ClearFake tool on a test endpoint to simulate a threat, or a developer uses it as a reference implementation for a new feature, leading to the presence of the IOC on a non-production host.
  • Filter/Exclusion: Exclude hosts tagged with environment: dev, environment: test, or role: pentest in your CMDB or asset inventory. Additionally, exclude events where the user account belongs to a dev-team or red-team security group.
• Scenario: A third-party security scanner (e.g., Tenable, Qualys, Rapid7) performs a vulnerability scan or integrity check that downloads or inspects the ClearFake IOCs to verify their presence or state, creating temporary file artifacts