Smokest

Smokest is an alias associated with operation of a ClickFix-style malware delivery campaign using a Deno-based JavaScript implant on Windows. Available evidence links the alias to a live command-and-control and malware delivery setup that appears to be part of a broader multi-tenant malware-as-a-service ecosystem, with Smokest assessed more likely to be a customer or operator of that platform than its developer. The operation used social-engineering-driven initial access consistent with ClickFix lures, followed by execution of an obfuscated implant through the Deno runtime. The malware supported a full post-compromise workflow including host fingerprinting, anti-duplicate execution through localhost mutexing, command-and-control session establishment, persistence, and modular payload execution. Collected host data included basic system and user identifiers used to generate a hardware-based victim identifier. Persistence mechanisms included user-level autorun and scheduled-task techniques. The implant also downloaded additional modules from the command-and-control server and executed them as separate commands, indicating a modular post-exploitation design. Infrastructure and builder metadata indicate a structured operator environment. Embedded token data exposed build metadata, operator identifiers, and access-token material consistent with a managed builder panel and multi-tenant service architecture. The campaign was active in late March and early April 2026 and used infrastructure fronted by Cloudflare with backend hosting on a provider frequently associated with abuse-tolerant services. No confirmed victim set is publicly established from the available facts. High-confidence evidence supports characterization of Smokest as a malware operator involved in Windows-focused initial access, persistence, command-and-control, and modular payload delivery rather than as a ransomware or extortion actor.