Fileless AsyncRAT Campaign Uses ClickFix to Target German-Speaking Users

Jun 16, 2025 · Original article ↗

Summary

CloudSek describes a ClickFix campaign targeting German-speaking users that delivers fileless AsyncRAT through obfuscated PowerShell, establishes registry persistence, and provides attackers remote control and data theft capabilities.

Key points

A fake verification prompt tells users in German to press Enter and copies a command that launches hidden PowerShell.
The command retrieves a payload from namoet[.]de, which uses reversed strings and in-memory C# compilation to load the malware.
The loader establishes persistence through HKCU registry keys and connects to a TCP command-and-control server on port 4444.
The report attributes the activity to AsyncRAT and describes capabilities including remote command execution, credential theft, and data exfiltration.
CloudSek identified additional delivery infrastructure and assesses, with medium confidence, that the campaign has operated since at least April 2025.
Recommended defenses include monitoring suspicious PowerShell and registry activity, restricting outbound connections, enabling PowerShell logging, and scanning memory with YARA or EDR.

Article Details

Attack Vectors: A fake verification prompt used the ClickFix technique to persuade users to copy and execute a hidden PowerShell command.
The command used conhost.exe to launch hidden PowerShell, which retrieved a second-stage payload from a remote URL.
The payload decoded reversed, base64-encoded strings and compiled embedded C# in memory with Add-Type, then opened a TCP reverse shell.
The payload established persistence by writing launcher commands to HKCU RunOnce and Windows registry keys.
Defensive Notes: Use EDR or AppLocker to block or detect suspicious conhost.exe launches of PowerShell.
Apply egress filtering for suspicious outbound TCP connections, including port 4444, and block known malicious infrastructure.
Monitor changes to high-risk registry locations, including RunOnce and Windows\win.
Use memory scanning with YARA or EDR to detect obfuscated C# code, Add-Type loaders, and TCP logic.
Enforce PowerShell Constrained Language Mode and enable ScriptBlock Logging and transcription.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`namoet[.]de`	Campaign domain used for ClickFix delivery and identified as the AsyncRAT command-and-control server.
IPV4	`109[.]250[.]108[.]183`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]109[.]205`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]109[.]80`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]110[.]140`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]110[.]142`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]110[.]190`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]110[.]222`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]110[.]228`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]110[.]98`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]111[.]155`	Identified as ClickFix delivery infrastructure.
IPV4	`109[.]250[.]111[.]176`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]111[.]186`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]111[.]219`	Additional attacker-controlled infrastructure used for ClickFix delivery.
IPV4	`109[.]250[.]111[.]75`	Additional attacker-controlled infrastructure used for ClickFix delivery.
URL	`hxxp[:]//namoet[.]de/x`	Defanged version of the payload-retrieval URL listed in the article's IOC section.