Loading story…
Attackers turned a single ClickFix social-engineering lure into a multi-stage Windows intrusion that abused pcalua.exe to launch mshta.exe, retrieve an HTA payload, and install malware that progressed through loaders and remote-access tooling. Reporting describes a chain involving EtherHiding infrastructure and GULoader, while Huntress documented a related intrusion in which an MSI dropped Potemkin, a custom x64 loader that used a deterministic 10,000-domain DGA to find command-and-control servers and reflectively load a follow-on DLL called RMMProject entirely in memory. RMMProject provided browser credential and cookie theft, a Chrome App-Bound Encryption bypass via helper DLL injection, hidden-desktop remote control, process injection, screenshot capture, and runtime module loading.
The operators then established persistence with Run keys, scheduled tasks, and a renamed Cloudflare Tunnel, and deployed EtherRAT, a Node.js backdoor that resolved its C2 from an Ethereum smart contract. Huntress said the attackers conducted hands-on-keyboard activity, repeatedly battled Microsoft Defender, attempted to deploy Chisel reverse SOCKS tunnels, and used WinRM, WMIExec, and SMBExec for lateral movement, spreading EtherRAT to more than 11 hosts including the domain controller. The intrusion showed how an unmonitored initial endpoint allowed hours of attacker activity before defenders had telemetry, enabling a single user action to escalate into a network-wide compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-06-23, Gurucul published additional technical details for the ClickFix/Potemkin/RMMProject/EtherRAT intrusion, including domains, IPs, hashes, file paths, an Ethereum contract and storage key, an EtherRAT build ID, and detection queries for hunting and incident response.
After gaining access, the attackers carried out hands-on-keyboard activity, battled Windows Defender, attempted Chisel reverse SOCKS tunnels, and used WinRM, WMIExec, and SMBExec for lateral movement. Huntress said EtherRAT spread to more than 11 hosts, including the domain controller, turning the initial compromise into a network-wide incident.
During the intrusion, the operators deployed EtherRAT, a Node.js backdoor whose C2 was resolved from an Ethereum smart contract, and set up persistence using a renamed Cloudflare tunnel along with Run key and scheduled task mechanisms.
The fetched HTA silently installed an MSI that dropped Potemkin, a custom x64 loader using a deterministic 10,000-domain DGA for C2 discovery, which then reflectively loaded the RMMProject DLL entirely in memory.
Huntress documented that in May 2026 a user on an unmonitored endpoint executed a malicious Run dialog command that abused pcalua.exe to launch mshta.exe and retrieve an HTA payload, initiating the intrusion.
On 2024-10-21, Ahmed Farouk documented a fake CAPTCHA campaign redirecting users from Arabic pirated movie sites to verification pages that instructed them to paste a PowerShell command into the Windows Run dialog. The chain fetched a second-stage script, downloaded a ZIP from BunnyCDN, executed Adobe-signed AcroBroker.exe with a malicious sqlite.dll to side-load Lumma Stealer, and established persistence via a Run registry key.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcecybersecuritynews.com
Open sourceblog.sicuranext.com
Open sourcehuntress.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Researchers reported multiple **ClickFix** campaigns using fake CAPTCHA or reCAPTCHA prompts to trick users into manually running malicious commands, with payloads tailored by platform and victim profile. On Windows, one campaign delivered a modular NodeJS-based RAT and infostealer through a malicious MSI installer, loading key capabilities only in memory after command-and-control was established and using `gRPC` over Tor for persistent communications. An operational security failure exposed the malware’s backend protocol definitions and admin panel API, revealing a malware-as-a-service operation with multi-operator support, Telegram alerts, automation rules, and cryptocurrency wallet tracking. The malware also fingerprinted victims extensively and established persistence through the Windows Run registry key as **LogicOptimizer**. A separate ClickFix chain attributed with high confidence to **Grandoreiro** targeted users of eight Brazilian banks by luring victims through a fake reCAPTCHA page and launching a malicious PowerShell sequence that sideloaded a Delphi banking trojan with legitimate GoToMeeting and Nero binaries. The malware deployed banking overlays, intercepted **PIX** QR-code payments, added Microsoft Defender exclusions, and stole credentials, device information, signatures, and payment confirmation codes. Netskope also documented a macOS variant that used AppleScript and a persistent fake password dialog to harvest Keychain data, browser cookies, saved credentials, extension storage, and cryptocurrency wallet data; the theft of live session cookies can enable attackers to bypass MFA by hijacking authenticated sessions.
Jun 29, 2026
Researchers reported renewed **SERPENTINE#CLOUD** activity using Cloudflare Tunnel-hosted **WebDAV** delivery chains, with campaigns targeting both a previously compromised organization and German-speaking small businesses. In one intrusion attempt, Huntress said the actor returned just weeks after remediation of a six-month breach and used a **ClickFix** lure to trigger `rundll32.exe` loading `davclnt.dll` and fetching content from an ephemeral Cloudflare tunnel; defenders stopped the attack before payloads reached disk. Breakglass separately observed German-language lures disguised as legal documents, where a malicious `.lnk` file opened a legitimate invoice PDF as a decoy while staging scripts and downloading a clean Python runtime from `python.org`. Across both investigations, the operator reused a stable toolchain built around Python loaders and **Donut** shellcode while varying payloads and delivery details to evade detection. Huntress linked the latest attempt to prior activity through reused GUIDs, encryption material, loader templates, staging paths, DuckDNS infrastructure, and command-and-control consolidation to two AT&T residential IPs in Chicago; the payload set included **VenomRAT**, **AsyncRAT**, **XWorm/Violet**, **PureHVNC**, and a **Brute Ratel C4** wrapper. Breakglass found a custom Donut variant using a non-standard big-endian **Chaskey-CTR** counter and dual deployment of **dcRAT** and **XenoRAT v1.8.7** into separate `explorer.exe` processes via Early Bird APC injection, with a live XenoRAT server at `176.96.136[.]182`; researchers said the actor continues to rotate infrastructure quickly while preserving recognizable patterns such as WsgiDAV behind Cloudflare Quick Tunnels and a WebDAV share named **Music**.
Jun 29, 2026