Loading story…
Researchers uncovered CLICKSMOKE, a live malware-as-a-service platform hosted on dakatawebstick[.]com that delivers a Deno-based JavaScript implant through ClickFix social-engineering lures and later through an MSI installer chain. Analysis of the payload found a hardcoded JWT bearer token that exposed internal build metadata, including the operator alias "Smokest", a build note tied to PowerShell delivery, tenant identifiers, and evidence of a shared backend used to generate malware builds. The implant was designed for Windows and supports host fingerprinting, localhost mutexing, persistence through Registry Run keys and scheduled tasks, hidden PowerShell execution, command-and-control session management, and modular payload execution with Deno.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
A follow-up investigation found the CLICKSMOKE platform remained active after earlier exposure and had rotated exposed build IDs rather than shutting down. Researchers identified a second tenant, "aero," plus an MSI-based delivery chain that installed Scoop and Deno before deploying a browser-credential stealer, further confirming a multi-tenant MaaS operation.
Breakglass Intelligence confirmed that dakatawebstick[.]com was hosting a live ClickFix malware delivery and C2 platform using a Deno-based JavaScript implant with zero VirusTotal detections at the time. Analysis documented Windows infection features including persistence, host fingerprinting, mutexing, and modular payload execution.
The dakatawebstick[.]com infrastructure was publicly reported or flagged, prompting deeper researcher investigation into the live malware platform. This marked the first public reporting referenced in the analysis.
A hardcoded JWT embedded in the Deno implant was issued, exposing build metadata for a ClickFix/PowerShell delivery build labeled "BatClickFixPS1NewV1" and linking the platform to operator alias "Smokest." The token indicated a multi-tenant malware-as-a-service backend was already in use.
The domain dakatawebstick[.]com, later identified as the CLICKSMOKE malware delivery and command-and-control platform, was newly registered. Researchers assessed this as the start of infrastructure provisioning for the operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers traced multiple **SmokeLoader** operations to live command-and-control infrastructure that supported credential theft, screenshot capture, clipboard theft, host profiling, and data exfiltration. One March 2026 campaign used a **ClickFix** social-engineering lure, an MSI installer, and a Go-based loader to deploy the **Remus** plugin, with exfiltration sent to `baxe[.]pics:48261`; investigators extracted configuration data including the C2 URL, campaign ID, plugin markers, and a **ChaCha20** key that allowed captured traffic to be decrypted. Cross-sample analysis linked the same builder output to SmokeLoader deliveries via **Amadey**, **Phorpiex**, and the ClickFix/GOLoader chain, pointing to a shared malware-as-a-service or affiliate ecosystem. Separate analysis tied SmokeLoader to a broader dual-family operation involving **Fuery**, likely run by an operator using the alias **"ingermany"**, who used a Flask-based panel disguised as **"InsureFlow Pro"** and a second **"Monkey"** panel for Fuery management. Investigators documented repeated OPSEC failures across the infrastructure, including reused certificates, exposed registration data, same-day domain registrations, and a C2 domain that shared a VPS with a legitimate Arabic-language learning platform, `qimmaedu[.]com`, while malware traffic beaconed to `coox[.]live` and `baxe[.]pics`. The reports also highlighted unusual technical overlaps, including Go 1.20.1 builds, Raft protocol type-name obfuscation, split C2 services on high ports, and hosting links to providers and subnets previously associated with **Phorpiex**, reinforcing the assessment that financially motivated operators were reusing infrastructure across malware families and legitimate services.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
A **ClickFix** campaign used compromised WordPress sites and fake Cloudflare verification pages to trick users into running a clipboard-delivered PowerShell command, leading to installation of the legitimate **Deno** JavaScript runtime as a malicious execution layer. Sophos said the intrusion chain relied on MSI-based staging, including use of `winget.exe` to install `deno.exe`, then fetched obfuscated remote JavaScript that handled reconnaissance, persistence, and command-and-control. Investigators observed more than **500 compromised WordPress sites** serving similar injected JavaScript, indicating a broad website-compromise or traffic-manipulation operation. The malware chain ultimately delivered a **Python-based infostealer** executed via `pythonw.exe`, capable of stealing system details, browser and extension data, cryptocurrency wallet information, and keystrokes. Researchers said the attackers stored downloaded content in a registry key disguised as a Microsoft Edge update after shifting staging to a **TryCloudflare** URL, while related Sophos case studies showed the same broader tradecraft of abusing Deno as a Bring Your Own Runtime to execute in-memory JavaScript, maintain persistence through Run keys and scheduled tasks, and evade detection through less-monitored runtimes and MSI/VBS/PowerShell loaders.
Aug 13, 2026