Loading story…
Researchers detailed how Windows ClickOnce applications can be abused through the normal deployment chain that begins when a user opens a .application file. In the documented flow, rundll32.exe invokes dfshim.dll through the ShOpenVerbApplication API, which identifies the deployment resources and redirects execution to the appropriate ClickOnce components inside the .NET Framework.
The analysis shows dfshim.dll locating and loading dfdll.dll with GetRequestedRuntimeInfo, then dynamically resolving dfdll!ActivateDeploymentW() to continue execution. That function validates parameters and initializes a COM server through InvokeServer(), using CoInitialize and CoCreateInstance with CLSID {20FD4E26-8E0F-4F73-A0E0-F27B8C57BE6F}; if COM server creation fails, the chain falls back to launching dfsvc.exe with CreateProcessW() to complete the ClickOnce deployment, highlighting multiple legitimate Windows components that could be leveraged to mask malicious activity.
Pull IOCs and campaign context straight into your stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple threat reports describe **ClickFix-style social engineering** and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in **memory-resident malware**. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into `powershell.exe`, and launches a **Donut 0.9.3** shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to **HijackLoader**-based stealer delivery and to a campaign abusing signed **Mozilla Firefox** binaries for **DLL sideloading** of **KongTuke**, with Rust-based DLL variants handling loading, persistence, and command-and-control. Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to `HDVz.exe`, staged files under `C:\ProgramData\IntelDriver`, and created a scheduled task for logon persistence before injecting Donut shellcode into `explorer.exe`. That malware tampered with **AMSI** and **ETW**, used a custom memory marker `DE AD BE CA FE BA EF` to avoid duplicate injection, and sent execution notifications through the **Telegram Bot API** while attempting outbound communication to `167.88.167.9:8356`. Across the reporting, the common pattern is the use of **trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft** to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Aug 15, 2026
A newly documented **ClickFix** campaign is tricking Windows users into running fake fix commands that abuse the legitimately signed IBM SPSS WinWrap Basic IDE executable, `WinWrapIDE.exe`, to sideload malicious DLLs and deploy a previously undocumented remote access trojan named **CNCMachineRMS**. Researchers said the intrusion chain uses four decoy DLLs, invokes shellcode through the Windows `EnumTimeFormatsEx` API, and relies on an external configuration file, `HelperStandardizationApplication.bin`, that contains both script logic and the embedded final payload. The staged, memory-heavy design is intended to make intermediate samples appear benign and reduce detection during automated analysis. CNCMachineRMS is described as a hands-on-keyboard access tool with broad post-compromise capabilities, including an interactive shell, file management, screenshot capture, local account creation, staged payload retrieval, and multiple persistence options such as Run keys and scheduled tasks masquerading as IBM SPSS components. The 64-bit implant reportedly builds strings at runtime, uses a custom binary container and scripting language, profiles hosts for domain and privilege context, beacons every 600 seconds, and may use **DNS over HTTPS** to hide resolution activity. Defenders are being urged to isolate affected hosts, preserve volatile evidence, investigate local account and privilege changes, reset exposed credentials, and hunt for lateral movement or second-stage compromise on neighboring systems.
Aug 24, 2026
Security researchers reported multiple **ClickFix** campaigns that compromise endpoints by tricking users into manually executing attacker-provided commands rather than exploiting a software vulnerability. CERT Polska documented an incident response at a large Polish organization where a **fake CAPTCHA** prompt led a user to run a malicious snippet via *Win+R*, resulting in malware execution and suspected **DLL side-loading** from `%APPDATA%\Intel` (legitimate `igfxSDK.exe`/`version.dll` alongside a suspicious `wtsapi32.dll`). Investigators also identified additional suspicious DLLs in the user’s local AppData and recovered an execution trail consistent with a one-liner that fetched remote content and piped it into PowerShell (e.g., `cmd /c curl ... | powershell`). Separately, threat hunting research described a macOS-focused ClickFix operation using **typosquatted Homebrew** lookalike sites to present a “copy/paste” install command that runs in Terminal. The first-stage script repeatedly prompted for a password and validated it using `dscl authonly` to harvest working credentials before deploying a second-stage infostealer dubbed **Cuckoo Stealer**, which was reported to establish **LaunchAgent** persistence, remove quarantine attributes, and communicate over encrypted HTTPS C2 while targeting browser credentials/session tokens, Keychain data, notes/messaging artifacts, VPN/FTP configs, and cryptocurrency wallets. Both reports highlight ClickFix as an increasingly common, opportunistic initial access technique that scales by abusing trusted user workflows on Windows and macOS.
Jun 29, 2026