Loading story…
An active malware campaign is using ClickFix fake CAPTCHA pages to trick users into pasting and running malicious PowerShell commands. The infection chain deploys GHOSTPULSE—also known as HijackLoader or IDATLOADER—using DLL sideloading, followed by a .NET intermediary that decrypts and reflectively loads the ARECHCLIENT2/SectopRAT remote-access trojan directly into memory. The deceptive CAPTCHA pages were hosted on client subdomains of dealeronlinemarketing.com and contology.com, which researchers assess were likely enabled by the compromise of server 50.57.243[.]90.
ARECHCLIENT2 bypasses AMSI, profiles infected systems, steals credentials, browser data, and cryptocurrency-wallet information, and receives commands from rotating command-and-control infrastructure. SectopRAT is a .NET-based RAT with a history of anti-analysis protections, including ConfuserEx control-flow obfuscation and anti-tamper measures; its deployment through reflective loading further reduces disk-based detection opportunities. Organizations should prioritize user awareness of fake CAPTCHA copy-and-paste prompts and detect anomalous PowerShell execution, DLL sideloading, and in-memory .NET loading behavior.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
Activity involving ARECHCLIENT2, also known as SectopRAT, increased notably during 2025.
Elastic telemetry recorded elevated ClickFix-related alerts during the first quarter of 2025, primarily tied to mass-distributed RATs and information stealers.
ClickFix, a technique that uses deceptive verification prompts to induce users to execute malicious commands, was first observed.
MalwareHunterTeam publicly noted the first known SectopRAT sample. The second referenced sample was submitted to VirusTotal one day after its compilation.
A second SectopRAT sample, later identified using a G DATA YARA rule, was compiled.
The first referenced SectopRAT .NET remote-access trojan sample was compiled.
An active campaign used fraudulent Cloudflare CAPTCHA pages on dealeronlinemarketing.com and contology.com client subdomains to induce PowerShell execution, leading through GHOSTPULSE and a .NET loader to in-memory ARECHCLIENT2 deployment. Elastic assessed that the domains' shared server, 50.57.243[.]90, was likely compromised and abused to host the malicious CAPTCHA content.
Elastic Security created the Windows_Trojan_GhostPulse_a1311f49 YARA rule for Windows file and memory scanning, with severity 100 and a reference GhostPulse sample hash.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 69 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
5 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcezscaler.com
Open sourcegithub.com
Open sourcegdatasoftware.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs identified an active ClickFix campaign that compromises legitimate websites, including `bincheck.io` and `investonline.in`, to display multilingual fake Cloudflare verification prompts. The lure copies an obfuscated PowerShell command to a visitor’s clipboard and relies on the victim manually executing it, initiating a five-stage infection chain that delivers the custom native C++ remote-access trojan **MIMICRAT**. The PowerShell stages use runtime obfuscation and attempt to disable Windows Event Tracing for Windows (ETW) logging and AMSI scanning before a Lua-based loader decrypts and runs shellcode in memory. MIMICRAT uses malleable HTTPS command-and-control and enables file and process operations, token theft and impersonation, shellcode injection, interactive shells, and SOCKS5 tunneling; the campaign remained active when reported.
Sep 9, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
A **ClickFix**-style malware campaign has been observed using **fake CAPTCHA** pages on compromised websites to trick users into **manually executing** malicious commands, enabling initial access while evading controls that focus on downloaded files. In the reported activity, victims are prompted to copy a **PowerShell** command and run it themselves; the script then downloads additional stages from attacker infrastructure (including `91.92.240.219`), verifies user interaction by checking clipboard activity, and proceeds through a multi-stage infection chain. The payload is an **information stealer** targeting data from **25+ web browsers**, cryptocurrency wallets (e.g., *MetaMask*), and enterprise VPN configurations, with checks for virtualized environments and security tooling prior to exfiltration. Separately reported threat activity in the same time window includes **UnsolicitedBooker** targeting Central Asian telecoms with phishing-delivered backdoors (**LuciDoor** and **MarsSnake**) and **APT28** running *Operation MacroMaze*, which uses weaponized Office documents and `INCLUDEPICTURE` fields pointing to `webhook[.]site` URLs as a tracking mechanism and to support follow-on macro-based payload delivery. A video-style weekly briefing also mentions an evolution of ClickFix where an initial command uses `nslookup` and parses the response for execution, but it is a multi-topic roundup rather than a primary source on the fake-CAPTCHA infostealer campaign; a malware newsletter roundup is likewise a link collection and does not add specific, corroborating details about the ClickFix CAPTCHA infostealer operation.
Jun 29, 2026