Rapid7 Analyzes ClickFix Campaign Using Fake Claude Installer

Summary

Rapid7 traced a ClickFix campaign impersonating Claude: an MSIX-like archive delivered an HTA that launched staged PowerShell, bypassed AMSI and injected shellcode. Rapid7 detected activity via RunMRU and recommends monitoring it and containing hosts.

Key points

Rapid7 reported a small cluster of ClickFix events across customers in the EU and US, including mshta launched through the Windows Run utility.
The command referenced a suspicious domain serving a payload named claude.msixbundle, which impersonated a Claude installer; Rapid7 obtained a copy from VirusTotal after the host was taken down.
The MSIX-like ZIP archive contained an HTA with obfuscated VBScript that launched encoded PowerShell through cmd.exe and the SysWOW64 PowerShell path.
Staged PowerShell generated an MD5-based identifier to retrieve a larger script and overwrote amsiContext, bypassing AMSI.
Later stages used obfuscated PowerShell and XOR-decoded shellcode with Windows NT API calls to perform process injection.
Rapid7’s RunMRU detection alerted on the activity; the company says its teams contained it, conducted retroactive hunts and developed additional detections.
Recommended actions include monitoring RunMRU, containing unexpected activity, reviewing browsing history and resetting credentials if a host is infected.

Article Details

Attack Vectors: A ClickFix phishing lure impersonated a Claude installer and led the user to execute mshta through the Windows Run utility.
The mshta command retrieved an MSIX-like ZIP archive containing an HTA with obfuscated VBScript, which launched encoded PowerShell through cmd.exe.
Staged PowerShell generated an MD5-based identifier from the COMPUTERNAME and USERNAME environment variables to construct a URL for another script.
PowerShell overwrote amsiContext to bypass AMSI, then decoded and executed additional obfuscated scripts.
The final stage XOR-decoded shellcode and used Windows NT API calls to perform process injection.
Defensive Notes: Monitor RunMRU for suspicious commands, including mshta execution, and alert on unexpected remote payload execution via the Windows Run utility.
Contain unexpected activity and review the affected user's browsing history to identify the source of the command.
If infection is successful, reset credentials stored on the affected system; the report says an information stealer is often executed as the final payload.
Use campaign indicators and behavioral detections for retroactive threat hunts and additional detection development.

MITRE ATT&CK

T1027.010 · Command ObfuscationVBScript and PowerShell used obfuscated strings, encoded commands, and deobfuscation routines.T1027.013 · Encrypted/Encoded FileThe MSIX-like ZIP archive contained an HTA with obfuscated VBScript and encoded PowerShell payloads.T1055 · Process InjectionThe final stage used NT API calls to allocate memory, change protections, and create a thread to execute XOR-decoded shellcode.T1059.001 · PowerShellMultiple staged PowerShell scripts were downloaded, deobfuscated, and executed.T1218.005 · Mshtamshta was executed through the Windows Run utility to access a remote payload.

Vendors

Rapid7Rapid7’s MDR detected a ClickFix phishing campaign that used mshta to deliver an HTA embedded in an MSIX-like archive, which executed multi-stage obfuscated PowerShell leading to AMSI bypass and process injection.

Products

Claude#ClickFix #Claude InsightIDRUsing Rapid7 InsightIDR detection rules, our SOC analysts were able to detect and respond to the threat, preventing further compromise.Microsoft WindowsRapid7 detected mshta execution via the Windows Run utility (RunMRU), triggering an alert from the rule “Attacker Technique – Remote Payload Execution via Run Utility (shell32.dll)”.