cyber.hendryadrian.com
Threat Research · huntress.com

ClickFix Campaign Hides Infostealer Shellcode in PNG Images

· Original article ↗

Summary

Huntress traced ClickFix lures to a multi-stage .NET loader that extracts Donut-packed shellcode hidden in PNG pixel data, then injects infostealers including LummaC2 and Rhadamanthys. Lures mimic verification checks or Windows Update.

Key points

  • Victims are tricked into opening the Windows Run box and pasting a clipboard-copied command that launches mshta.exe.
  • The command leads to PowerShell and reflectively loaded .NET assemblies, with junk code and obfuscation used to complicate analysis.
  • A loader decrypts an embedded PNG and extracts shellcode from its red pixel values using a custom steganography algorithm.
  • The extracted Donut-packed shellcode is injected into a target process; observed final payloads include LummaC2 and Rhadamanthys.
  • A newer lure imitates a full-screen Windows Update process, while earlier lures used fake human-verification prompts.
  • Huntress reported that active lure domains remained as of November 19, after Operation Endgame takedowns were announced, but said the associated Rhadamanthys payload appeared no longer to be hosted.
  • Recommended defenses include blocking the Run prompt, training users not to paste commands from prompts, and monitoring suspicious process lineage and RunMRU registry activity.

Article Details

Attack Vectors
  • ClickFix social engineering lures prompt victims to open the Windows Run dialog and paste and execute a command copied to the clipboard.
  • The command uses mshta.exe to retrieve a JScript payload, which runs PowerShell code that decrypts and reflectively loads .NET assemblies.
  • A .NET loader decrypts a PNG resource and extracts Donut-packed shellcode from pixel data using a custom steganographic algorithm, then injects it into a process.
  • A fake Windows Update lure displays a full-screen update animation before prompting users to run the copied command.
Defensive Notes
  • Disable the Windows Run prompt through Registry changes or Group Policy.
  • Train users that legitimate CAPTCHA or Windows Update processes do not require pasting and running commands.
  • Monitor EDR telemetry for explorer.exe spawning mshta.exe, powershell.exe, or other living-off-the-land binaries with unexpected command lines.
  • Review the RunMRU Registry artifact at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU when investigating potential compromise.

Indicators of compromise

TypeIndicatorContext
DOMAINcmevents[.]liveWindows Update ClickFix lure website listed among campaign indicators.
DOMAINcmevents[.]proWindows Update ClickFix lure website listed among campaign indicators.
DOMAINf6b04000[.]consent-verify[.]pages[.]devMalicious ClickFix lure website that hosted a human-verification prompt.
DOMAINgalaxyswapper[.]proWindows Update ClickFix lure website listed among campaign indicators.
DOMAINhypudyk[.]shopDomain listed as C2 infrastructure in the article's IOC section.
DOMAINvirhtechgmbh[.]comWindows Update ClickFix lure website listed among campaign indicators.
DOMAINxcvcxoipoeww[.]siteWindows Update ClickFix lure website associated with the reported payload chain.
DOMAINxmcniiadpwqw[.]siteWindows Update ClickFix lure website listed among campaign indicators.
DOMAINxoiiasdpsdoasdpojas[.]comReported as both a Windows Update ClickFix lure domain and a stage-two payload host.
DOMAINxpoalswwkjddsljsy[.]comWindows Update ClickFix lure website listed among campaign indicators.
URLhxxp[:]//141[.]98[.]80[.]175/ercx.datStage-one mshta payload URL used in the Windows Update ClickFix campaign.
URLhxxp[:]//141[.]98[.]80[.]175/gpsc.datStage-one mshta payload URL used in the Windows Update ClickFix campaign.
URLhxxp[:]//141[.]98[.]80[.]175/one.datStage-one mshta payload URL reported in the Windows Update ClickFix campaign.
URLhxxp[:]//141[.]98[.]80[.]175/rtdx.datStage-one mshta payload URL used in the Windows Update ClickFix campaign.
URLhxxp[:]//141[.]98[.]80[.]175/tick.oddStage-one mshta payload URL used in the Windows Update ClickFix campaign.
URLhxxp[:]//141[.]98[.]80[.]175/very.datStage-one mshta payload URL copied to the clipboard by the Windows Update lure.
URLhxxp[:]//81[.]90[.]29[.]64/ebc/rps.gzStage-one mshta URL used to retrieve the ClickFix JScript payload.
URLhxxp[:]//corezea[.]com/ebcStage-two URL hosting PowerShell code in the ClickFix execution chain.
URLhxxp[:]//securitysettings[.]liveStage-two PowerShell URL used in the Windows Update ClickFix chain.
URLhxxp[:]//xoiiasdpsdoasdpojas[.]comStage-two PowerShell URL used in the Windows Update ClickFix chain.

MITRE ATT&CK

T1027.003 · SteganographyThe loader conceals shellcode in PNG pixel data using steganography.T1027.013 · Encrypted/Encoded FileThe stage-one lure's JavaScript is encrypted and dynamically loaded to evade string-based detection.T1055.002 · Portable Executable InjectionThe loader uses VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to inject shellcode into a target process.T1055.012 · Process HollowingExtracted shellcode is injected into explorer.exe.T1059.001 · PowerShellThe retrieved PowerShell code runs in memory as part of the loader chain.T1059.007 · JavaScriptThe initial mshta.exe command executes a JScript payload.T1140 · Deobfuscate/Decode Files or InformationThe chain decrypts PowerShell, .NET assembly, configuration, image, and shellcode data before execution.T1204.002 · Malicious FileVictims are tricked into pasting and running a malicious command through the Windows Run prompt.T1620 · Reflective Code LoadingThe loader reflectively loads decrypted .NET assemblies in memory.

People

Anna PhamHuntress analyst who developed an updated configuration extractor for observed LummaC2 samples.Ben FollandNamed author of the Huntress analysis.

Malware

LummaC2chain, originating from a ClickFix lure, that leads to the delivery of infostealing malware, including LummaC2 and Rhadamanthys. A notable discovery during analysis was the campaign's use of steganography to concealRhadamanthysfrom a ClickFix lure, that leads to the delivery of infostealing malware, including LummaC2 and Rhadamanthys. A notable discovery during analysis was the campaign's use of steganography to conceal the final

Vendors

Huntressis a social engineering technique that tricks end-users into pasting and running a malicious command. Huntress has recently observed two distinct ClickFix lures, which have been seen in incidents using the

Tools

dnSpyOpening up the .NET assembly within dnSpy to compile to plaintext C#:DonutStage 5 - Donut Shellcodedonut-decryptorWe can use the donut-decryptor tool to extract the final stage, in this case, a LummaC2 sample.

Related Articles