ClickFix Campaign Uses HijackLoader to Deploy SectopRAT In Memory
Malware Intelligence · 5 sources · Updated 2mo ago · First seen Nov 15, 2019
An active malware campaign is using ClickFix fake CAPTCHA pages to trick users into pasting and running malicious PowerShell commands. The infection chain deploys GHOSTPULSE—also known as HijackLoader or IDATLOADER—using DLL sideloading, followed by a .NET intermediary that decrypts and reflectively loads the ARECHCLIENT2/SectopRAT remote-access trojan directly into memory. The deceptive CAPTCHA pages were hosted on client subdomains of dealeronlinemarketing.com and contology.com, which researchers assess were likely enabled by the compromise of server 50.57.243[.]90.
ARECHCLIENT2 bypasses AMSI, profiles infected systems, steals credentials, browser data, and cryptocurrency-wallet information, and receives commands from rotating command-and-control infrastructure. SectopRAT is a .NET-based RAT with a history of anti-analysis protections, including ConfuserEx control-flow obfuscation and anti-tamper measures; its deployment through reflective loading further reduces disk-based detection opportunities. Organizations should prioritize user awareness of fake CAPTCHA copy-and-paste prompts and detect anomalous PowerShell execution, DLL sideloading, and in-memory .NET loading behavior.
