Netskope Details ClickFix Campaign Delivering Modular Node.js RAT
Summary
Netskope Threat Labs details a ClickFix campaign using a silently installed Node.js payload on Windows. Dynamic modules, gRPC-over-Tor C2 and leaked protocol files expose RAT capabilities and a multi-operator MaaS backend.
Key points
- A fake CAPTCHA triggers a base64-encoded PowerShell command that downloads and silently installs an MSI from cloud-verificate[.]com; the installer bundles Node.js.
- The malware persists through a Windows Registry Run key and executes server-delivered JavaScript modules in a Node.js VM, rather than storing its stealing modules on disk.
- It uses encrypted configuration and bidirectional gRPC communications tunneled over Tor for command and control.
- The malware profiles infected systems, including installed security products, before operators send modules.
- Leaked support.proto definitions describe capabilities including shell commands, file transfer, system information collection and module execution.
- Leaked admin.proto definitions reveal a MaaS backend with operator management, module deployment, wallet tracking, Telegram notifications and automation rules.
Article Details
- Attack Vectors
- A fake CAPTCHA prompts Windows users to trigger a base64-encoded PowerShell command that downloads and silently installs a malicious MSI from cloud-verificate[.]com.
- The MSI installs a Node.js runtime and launches the malware, which establishes persistence through a Registry Run key.
- The malware uses gRPC communications tunneled over Tor to receive JavaScript modules and return data or execution results.
- The malware collects system information and checks for installed security products before receiving modules from its C2 server.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloud-verificate[.]com | Malicious hosting domain used to deliver the NodeServer-Setup-Full.msi installer. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware returns stolen data and module execution results through the gRPC C2 channel.T1059.001 · PowerShellA base64-encoded PowerShell command downloads the MSI and invokes msiexec for a quiet installation.T1059.007 · JavaScriptThe C2 server delivers JavaScript modules that the malware executes in a Node.js VM sandbox.T1071.001 · Web ProtocolsThe malware uses bidirectional gRPC streaming for C2 communications routed over Tor.T1090 · ProxyThe malware launches Tor to provide a local SOCKS5 proxy for connections to its .onion C2 server.T1105 · Ingress Tool TransferThe malware downloads the MSI from attacker-controlled infrastructure and retrieves the Tor Expert Bundle for its C2 setup.T1204.002 · Malicious FileThe campaign uses a fake CAPTCHA interaction to prompt users to trigger the malware-installation sequence.T1518.001 · Security Software DiscoveryThe malware scans running processes for antivirus and security products to assess the victim's security posture.T1547.001 · Registry Run Keys / Startup FolderThe malware creates a LogicOptimizer value under the current user's Registry Run key to launch at logon.T1573 · Encrypted ChannelThe malware encrypts its configuration using AES-256-CBC or XOR and uses encrypted, Tor-proxied C2 communications.
Products
Microsoft WindowsNetskope Threat Labs uncovered a ClickFix campaign that delivers a modular Node.js-based infostealer to Windows users via malicious MSI installers that install silently, persist via a Registry Run key, and executeNode.jsNetskope Threat Labs uncovered a ClickFix campaign that delivers a modular Node.js-based infostealer to Windows users via malicious MSI installers that install silently, persist via a Registry Run key, and execute
Tools
PowerShellAttackers used ClickFix social engineering to trick users into executing a base64-encoded PowerShell command that downloads and silently installs NodeServer-Setup-Full.msi from cloud-verificate[.]com.Tor Expert BundleC2 uses gRPC bidirectional streaming tunneled over Tor (malware downloads Tor Expert Bundle, launches tor.exe and connects via SOCKS5), enabling server-delivered JavaScript modules executed in a Node VM sandbox.