MIMICRAT ClickFix Campaign Uses Compromised Sites to Deploy Custom RAT
Malware Intelligence · 2 sources · Updated 2mo ago · First seen Feb 11, 2026
Elastic Security Labs identified an active ClickFix campaign that compromises legitimate websites, including bincheck.io and investonline.in, to display multilingual fake Cloudflare verification prompts. The lure copies an obfuscated PowerShell command to a visitor’s clipboard and relies on the victim manually executing it, initiating a five-stage infection chain that delivers the custom native C++ remote-access trojan MIMICRAT.
The PowerShell stages use runtime obfuscation and attempt to disable Windows Event Tracing for Windows (ETW) logging and AMSI scanning before a Lua-based loader decrypts and runs shellcode in memory. MIMICRAT uses malleable HTTPS command-and-control and enables file and process operations, token theft and impersonation, shellcode injection, interactive shells, and SOCKS5 tunneling; the campaign remained active when reported.
