ClickFix Attacks Evolve Into Persistence, Lateral Movement and Steganographic Delivery

Nov 10, 2026 · Original article ↗

Summary

Huntress documents ClickFix campaigns using fake verification pages, browser-cache and PNG-steganography delivery, RATs, persistence and lateral movement—including activity reaching domain controllers—and outlines user, endpoint and behavioral defenses.

Key points

ClickFix lures arrived through malvertising, typosquatted and SEO-poisoned pages, and compromised websites; fake verification screens instructed users to paste commands.
Some PowerShell commands displayed convincing verification progress while silently downloading and executing payloads.
Huntress observed the DuskDesk Node.js-based RAT establishing persistence through a user Run key; investigators also observed a connection to a remote IP, described as potentially enabling command and control.
In separate investigations, attackers used RATs or native Windows tools for reconnaissance and lateral movement, including activity reaching domain controllers and establishing reverse SSH tunnels.
One delivery chain extracted executable payloads hidden in PNG pixel data, then established persistence with a scheduled task and registry Run key.
A compromised-site chain searched browser caches for a specific 17,635-byte file, copied it as a batch script and executed it to trigger additional payloads.
Recommended defenses include training users not to paste commands from web pages, restricting execution from user-writable locations, and monitoring for suspicious shells, persistence and SSH connections.

Article Details

Attack Vectors: Malvertising and sponsored search results direct users to malicious landing pages, including typosquatted sites and spoofed service pages.
Fake CAPTCHA, Cloudflare verification, Windows update, and technical-support prompts instruct users to paste commands into Run, PowerShell, or a terminal.
A compromised dental practice website used a consent dialog and fake verification page to trigger ClickFix instructions.
A Custom GPT lure was used in one campaign to persuade users to download a Windows MSI installer containing a custom RAT.
Some commands search Firefox, Chrome, or Brave browser caches for a seeded file, copy it to a temporary directory, and execute it.
A multi-stage delivery chain hid executable payloads in PNG image data, which PowerShell extracted and reconstructed.
ClickFix commands delivered staged archives and scripts that led to RATs, persistence, reconnaissance, credential theft, and lateral movement.
Defensive Notes: Train users not to paste webpage-provided commands into Run, terminals, or PowerShell; legitimate CAPTCHA or verification workflows do not require shell commands.
Encourage users to close suspicious pages and report them through normal IT or security channels.
Monitor endpoints for browser- or user-launched processes spawning cmd.exe, PowerShell, or Windows Terminal; encoded PowerShell; execution-policy bypasses; and archives or executables appearing in user-writable locations.
Monitor for unexpected scheduled tasks, registry Run keys, and SSH connections, and investigate sequences of activity rather than relying only on static indicators.
Use application control or allowlisting for untrusted executables, restrict execution from user-writable locations such as Temp, and control unsigned binaries and suspicious archive extraction.
Limit local administrator privileges and restrict access to the Run dialog or command prompt where they are not needed.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`apirequestaccess[.]com`	Attacker-controlled domain used to deliver an MSI package that installed the DuskDesk RAT.
IPV4	`151[.]240[.]151[.]76`	IP address associated in the article with the attacker-controlled MSI delivery domain.
IPV4	`167[.]148[.]201[.]104`	Remote TCP destination contacted by node.exe; the article identifies it as a potential command-and-control endpoint.
IPV4	`23[.]227[.]199[.]41`	Attacker-controlled host used for a reverse SSH tunnel.
SHA256	`4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb`	Hash of a malicious 1.bat file used as a multi-stage PowerShell stager.
SHA256	`e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9`	Hash of the malicious Node.js runtime executable installed with the DuskDesk RAT.
SHA256	`ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52`	Hash of dui70.dll, identified as a malicious DLL used in a DLL-sideloading chain.
URL	`hxxp[:]//apirequestaccess[.]com/cfirm.php?token=QsKjQ1pEd43R33hJ1xV4LQwIVE8`	Malicious MSI download URL used in the DuskDesk RAT delivery chain.
URL	`hxxps[:]//moziw[.]com/vvestalw/`	Additional redirector in the ClickFix delivery chain.
URL	`hxxps[:]//vvestalw[.]ghost[.]io/`	Typosquatted redirector presented after a Bing search as part of a ClickFix delivery chain.
URL	`hxxps[:]//westlaw-signon[.]com/`	Fake Westlaw landing page used to present a ClickFix verification workflow.