Fake $TEMU Airdrop Uses ClickFix to Deploy In-Memory Python Backdoor
Summary
Researchers describe a fake $TEMU airdrop using ClickFix to trick users into running a command, then deploy a victim-specific Python backdoor that retrieves and executes code in memory.
Key points
- A fake $TEMU airdrop site uses a counterfeit verification prompt and step-by-step instructions to persuade visitors to paste and run a malicious command.
- The loader profiles the host, and the server returns a payload containing a unique machine identifier.
- The backdoor uses a bundled, windowless Python runtime, including pythonw.exe, and reportedly requires no administrator permissions.
- The backdoor checks in with its server and executes Python code delivered dynamically in memory rather than saving persistent scripts to disk.
- The article says similar backdoors have been observed stealing browser credentials and cookies, keylogging, taking screenshots, and enabling lateral movement; it does not establish that all these actions occurred in this campaign.
- The article identifies Python3133, a temp_settings marker, and pythonw.exe running from an AppData or Program Files location as possible detection clues.
Article Details
- Attack Vectors
- A fake $TEMU airdrop page uses a counterfeit “I’m not a robot” check and video instructions to persuade visitors to paste a clipboard command into the Windows Run prompt and execute it.
- The command launches a decoded PowerShell stage. The server returns a payload containing a victim-specific machine identifier and delivers a bundled Python runtime.
- The backdoor checks in with a command server and executes Python code received from the server directly in memory rather than saving persistent scripts to disk.
- Defensive Notes
- Do not paste or run commands supplied by untrusted webpages; verify technical instructions independently.
- Check for an unexpected Python3133 folder under %LOCALAPPDATA%ProgramsPython, a temp_settings file in %TEMP%, and pythonw.exe running from an AppData or Program FilesPython3133 location.
- Use behavior-based monitoring for suspicious Python processes and outbound activity; the article notes that file-signature detection may be less effective against changing, in-memory code.
- If affected, change important-account passwords from a clean device and revoke active sessions where possible.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | temucoin[.]lat | Domain hosting the fake $TEMU airdrop lure used to persuade victims to execute a malicious command. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes a decoded PowerShell stage and server-generated payloads that vary by victim through embedded machine identifiers.T1059.001 · PowerShellThe infection chain includes a decoded PowerShell stage containing the victim-specific machine identifier.T1071.001 · Web ProtocolsThe backdoor checks in with its operators and receives instructions streamed from the internet; the article describes this as web-based C2 communication.T1102.001 · Dead Drop ResolverThe article reports infrastructure intended to notify attackers via Telegram when a victim checked in, while noting that a decoded-payload debug flag was disabled.T1105 · Ingress Tool TransferThe command server returns the payload, which deploys a bundled Python runtime to the victim's host.T1204 · User ExecutionThe fake airdrop page instructs victims to paste a command into the Windows Run prompt and execute it themselves.T1620 · Reflective Code LoadingThe backdoor retrieves Python code from the server and executes it in memory instead of saving it as a persistent script.