Loading story…
A ClickFix-style social engineering chain tricked a Windows user into running a PowerShell one-liner from the Run dialog, launching a multi-stage malware infection that deployed two Python-based payloads. The first stage downloaded a fake Intel Software Updater Inno Setup package, unpacked a bundled CPython 3.11 runtime, and launched a Python RAT that established persistence, profiled the host, and resolved follow-on command-and-control through the Ethereum blockchain using EtherHiding. A second PowerShell stage was then delivered over STDIN, downloading another Python runtime and payload into ProgramData, where mod.pyc decrypted its next stage with an inline RC4 routine before moving toward process injection into winver.exe and a UAC elevation attempt involving AppInfo and consent.exe.
The activity aligns with a broader malware-delivery ecosystem previously linked to UNC5142, which used EtherHiding-backed infrastructure and rapidly changing hosting on Cloudflare Pages (pages.dev), Backblaze B2, and domains such as bluetroniq.vip and bytevista.cloud. Observed lures frequently impersonated verification and security workflows, including fake reCAPTCHA, human verification, DNS resolver, IP provider, and macOS browser update pages, with staging paths such as /support, /win, and /start indicating payload delivery and redirection infrastructure designed to support social engineering and malware distribution at scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
ShroudCloud published an analysis of a multi-stage infection chain in which a ClickFix-style PowerShell command led to deployment of Python-based payloads, persistence, host reconnaissance, and Ethereum-based C2 resolution via EtherHiding. The writeup also described a second-stage loader that decrypted additional payloads and moved toward process injection and UAC elevation.
Mandiant documented CLEARSHORT-related hosting URLs observed from 2024-12-14 through 2025-05-30, showing frequent churn across Cloudflare Pages, Backblaze B2, and other domains used for themed verification and update lures.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
Researchers and Microsoft documented multiple **ClickFix** intrusion chains that trick users into pasting malicious commands after fake browser errors or security prompts, then abuse native tools and staged scripting environments to deliver malware. In one Windows chain, a caret-obfuscated command entered through the Run dialog used the **finger** protocol over TCP/79 to fetch a batch stage, killed `explorer.exe`, copied and renamed the native `curl.exe`, downloaded the legitimate **IronPython 3.4.2** release from GitHub disguised as a PDF, extracted it with `tar.exe`, and launched an encoded Python payload. That payload decoded layered content, disabled TLS certificate verification, contacted `artides[.]net` for in-memory execution, beaconed to `claudeam[.]com`, and ended with **RemoteLibraryInjection** into `explorer.exe` plus installation of a global low-level keylogger. Microsoft separately described the **CrashFix** variant, which used a fake Chrome extension impersonating **uBlock Origin Lite** to establish foothold, intentionally crashed the browser, and then prompted victims to run commands that renamed `finger.exe` and fetched obfuscated PowerShell. On domain-joined systems, the activity dropped a portable **WinPython** environment and the **ModeloRAT** Python remote access trojan, established persistence through a Run key, and in related cases created a scheduled task named **`SoftwareProtection`** for repeated execution. Additional reporting showed the same broader ClickFix ecosystem targeting **Windows, macOS, and Linux**, including a Perl-based **Pearl Stealer** that harvested browser, wallet, document, and Apple Notes data, stole macOS passwords, and exfiltrated files after OS-specific clipboard-delivered commands downloaded payloads from attacker infrastructure.
Aug 14, 2026