Loading story…
A ClickFix malware campaign tricks victims into pasting a PowerShell command into the Windows Run dialog, launching an in-memory stager from allianurkoa[.]com. The stager installs an unsigned Inno Setup executable posing as Intel Software Updater, sideloads a Python 3.11 runtime, creates scheduled-task persistence, and performs host reconnaissance. A subsequent PowerShell stage obtains a separate Python 3.13 environment and payload from whitecarkiario[.]com; its mod.pyc component RC4-decrypts and executes the final malware in memory.
The operators resolve configuration and C2 data through Ethereum-compatible RPC infrastructure on Ethereum, Polygon, and Ethereum Sepolia, using PublicNode and dRPC in an EtherHiding design that complicates takedown efforts. The final payload is assessed as likely ACR Stealer from the Amatera lineage, with reported injection into winver.exe and use of an AppInfo/UAC path involving consent.exe. The activity overlaps with the ClickFix/EtherHiding ecosystem tracked as CLEARFAKE, CLEARSHORT, and UNC5142, although no single actor has been conclusively attributed.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A ClickFix chain induced victims to paste a PowerShell command into the Windows Run dialog, installing a fake Intel Software Updater, sideloaded Python runtimes, and scheduled-task persistence. The malware retrieved configuration through Ethereum-compatible RPC services and ultimately executed an in-memory payload assessed as likely ACR Stealer.
A high-severity phishing campaign targeted Microsoft Windows organizations with customer-request lures, malicious HTML/search-ms attachments, remote LNK files, and staged Python loaders. The campaign deployed XWorm, VenomRAT, AsyncRAT, and PureHVNC, using RC4-decrypted shellcode and Early Bird APC injection into notepad.exe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 15 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourcepicussecurity.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A ClickFix-style social engineering chain tricked a Windows user into running a PowerShell one-liner from the Run dialog, launching a multi-stage malware infection that deployed two Python-based payloads. The first stage downloaded a fake **Intel Software Updater** Inno Setup package, unpacked a bundled **CPython 3.11** runtime, and launched a Python RAT that established persistence, profiled the host, and resolved follow-on command-and-control through the Ethereum blockchain using **EtherHiding**. A second PowerShell stage was then delivered over STDIN, downloading another Python runtime and payload into `ProgramData`, where `mod.pyc` decrypted its next stage with an inline **RC4** routine before moving toward process injection into `winver.exe` and a UAC elevation attempt involving **AppInfo** and `consent.exe`. The activity aligns with a broader malware-delivery ecosystem previously linked to **UNC5142**, which used EtherHiding-backed infrastructure and rapidly changing hosting on **Cloudflare Pages** (`pages.dev`), **Backblaze B2**, and domains such as `bluetroniq.vip` and `bytevista.cloud`. Observed lures frequently impersonated verification and security workflows, including fake **reCAPTCHA**, human verification, DNS resolver, IP provider, and macOS browser update pages, with staging paths such as `/support`, `/win`, and `/start` indicating payload delivery and redirection infrastructure designed to support social engineering and malware distribution at scale.
Jul 21, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Microsoft reported a rise in **ACR Stealer** intrusions across customer environments, tracing two prominent infection chains that relied on **ClickFix** social engineering to trick users into launching malicious commands. In one chain, attackers delivered DLLs over **WebDAV**, then used obfuscated PowerShell, Python-based loaders, and scheduled tasks for persistence; some infections also resolved command-and-control infrastructure through blockchain-based dead-drop techniques such as **EtherHiding**. A second chain used **`mshta.exe`**, VBScript, and obfuscated PowerShell before retrieving payloads hidden inside a hosted JPEG and executing them filelessly in memory. The campaigns were designed to steal **browser credentials, cookies, authentication tokens, and sensitive enterprise documents**, including PDFs and Microsoft 365-related files. Microsoft said the malware abuses **DPAPI** to decrypt browser data and stages the collected information for exfiltration. The company published indicators of compromise, MITRE ATT&CK mappings, hunting queries, and mitigation guidance focused on detecting ClickFix lures, suspicious WebDAV or MSHTA activity, obfuscated PowerShell, persistence mechanisms, and browser credential theft.
Aug 14, 2026