ClickFix Campaign Spoofs India’s Defence Ministry to Target Windows and Linux Users
Summary
Researchers detail a campaign using a cloned Indian Defence Ministry portal and clipboard-based commands to deliver malware on Windows and Linux. The Windows payload uses mshta.exe; the observed Linux script only opens an image.
Key points
- A cloned Ministry of Defence press-release portal directs users to operating-system-specific ClickFix lures.
- The lures copy commands to the clipboard and instruct users to paste and execute them.
- On Windows, mshta.exe runs a remote HTA containing obfuscated JavaScript and a .NET-based loader.
- The Windows loader connects to 185.117.90[.]212; a decoy Ministry-themed PDF is shown during execution.
- The observed Linux script, mapeal.sh, only downloads and opens a JPEG; researchers saw no further malicious activity.
- Researchers assess the campaign as consistent with APT36 activity, but attribution is unconfirmed.
- Indicators include spoofed government-themed domains, staged payload paths, and the SHA-256 for sysinte.hta.
Article Details
- Attack Vectors
- A fake Indian Ministry of Defence press-release portal directed users into operating-system-specific ClickFix flows.
- On Linux, a spoofed CAPTCHA copied a shell command to the clipboard that downloaded and ran mapeal.sh after the user pasted it into a terminal.
- On Windows, a FOUO-themed lure copied a command that used mshta.exe to retrieve and execute a remote HTA payload.
- The Windows payload used obfuscated JavaScript and a .NET-based loader, while displaying a decoy Ministry of Defence press release.
- Defensive Notes
- Monitor for commands copied from browser pages and executed by users, including Linux shell commands using curl, chmod, and bash and Windows commands invoking mshta.exe.
- Review suspicious government-themed subdomains, cloned press-release pages, and HTA files staged in deep or benign-looking URL paths.
- The article reports no observable malicious behavior from the analyzed Linux script beyond downloading and opening a JPEG image.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | avtzyu[.]store | Attacker-controlled parent domain used for the spoofed government subdomain. |
| DOMAIN | drdosurvey[.]info | Attacker-controlled parent domain used for the spoofed government subdomain. |
| DOMAIN | email[.]gov[.]in[.]avtzyu[.]store | Spoofed government subdomain associated with the loader's infrastructure. |
| DOMAIN | email[.]gov[.]in[.]drdosurvey[.]info | Spoofed Ministry of Defence portal used as the campaign's landing page. |
| DOMAIN | trade4wealth[.]in | Likely compromised or abandoned domain repurposed to deliver campaign payloads. |
| IPV4 | 185[.]117[.]90[.]212 | IP address contacted by the Windows loader. |
| IPV4 | 192[.]64[.]118[.]76 | IP address listed for the spoofed portal infrastructure. |
| SHA256 | 7087e5f768acaad83550e6b1b9696477089d2797e8f6e3f9a9d69c77177d030e | SHA-256 hash of sysinte.hta, the Windows ClickFix HTA payload. |
| URL | hxxps[:]//trade4wealth[.]in/admin/assets/css/default/index[.]php | Attacker-used URL invoked by mshta.exe to redirect to the Windows HTA payload. |
| URL | hxxps[:]//trade4wealth[.]in/admin/assets/css/default/sysinte[.]hta | URL of the Windows HTA payload. |
| URL | hxxps[:]//trade4wealth[.]in/admin/assets/js/ | Payload-delivery path from which the Linux flow downloads mapeal.sh. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe sysinte.hta payload uses obfuscated JavaScript with hexadecimal escape sequences.T1059.004 · Unix ShellThe Linux flow instructs users to execute a shell command that downloads and runs mapeal.sh.T1105 · Ingress Tool TransferThe Linux command downloads mapeal.sh, and the Windows flow retrieves an HTA payload from remote infrastructure.T1204.004 · Malicious Copy and PasteThe lures instruct users to paste and execute commands copied to the clipboard.T1218.005 · MshtaThe Windows flow uses mshta.exe to invoke a remote script and retrieve an HTA payload.
Threat Actors
Tools
HTTrackReviewing the cloned portal's source code revealed that the page had been created using HTTrack, a publicly available website copying tool. Metadata embedded within the HTML suggested the cloning occurred in early Marchmshta.execlipboard, instructing the user to paste and execute it in the terminal. The payload is executed via mshta.exe, invoking a remote script hosted on the attacker-controlled infrastructure:
Countries
Industries
Governmentobserved delivering cross-platform malware through a ClickFix-style infection chain. The site mimicked government press releases, staged payloads through a possibly compromised .in domain, and used visual deception toMilitaryLongstanding focus on Indian government, military, and diplomatic targets.