Loading story…
Researchers reported a ClickFix infection chain delivering a Node.js-based Interlock RAT variant after victims paste and execute a concealed PowerShell command through the Windows Run dialog. The malware downloads a legitimate signed Node.js runtime into the user’s roaming AppData directory and uses it to run a payload masquerading as debug.txt, minimizing suspicious executable artifacts. The campaign establishes raw TCP command-and-control over port 443 and persists through an HKCU\...\Run value named ChromeUpdater.
The Node.js variant fingerprints compromised hosts, supports SOCKS proxying, and performs extensive endpoint and Active Directory reconnaissance, including searches of computer descriptions for likely backup servers. The activity follows earlier reporting that KongTuke FileFix lures also led to a new Interlock RAT variant, indicating that Interlock operators are using multiple social-engineering execution techniques to deploy the malware. Attribution to Interlock is based on its distinctive C2 protocol header and observed behavior; the reports do not identify the keyboard operator.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
CISA, the FBI, HHS, and MS-ISAC issued joint advisory AA25-203A concerning Interlock.
The Interlock double-extortion ransomware operation was first observed.
A ClickFix lure induced a victim to run a concealed PowerShell command via the Windows Run dialog, which downloaded a signed Node.js runtime and executed an Interlock RAT payload stored as debug.txt. The RAT used raw TCP C2 over port 443, established ChromeUpdater HKCU Run-key persistence, and conducted host, Active Directory, and backup-server reconnaissance without observed ransomware encryption.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Researchers and Microsoft documented multiple **ClickFix** intrusion chains that trick users into pasting malicious commands after fake browser errors or security prompts, then abuse native tools and staged scripting environments to deliver malware. In one Windows chain, a caret-obfuscated command entered through the Run dialog used the **finger** protocol over TCP/79 to fetch a batch stage, killed `explorer.exe`, copied and renamed the native `curl.exe`, downloaded the legitimate **IronPython 3.4.2** release from GitHub disguised as a PDF, extracted it with `tar.exe`, and launched an encoded Python payload. That payload decoded layered content, disabled TLS certificate verification, contacted `artides[.]net` for in-memory execution, beaconed to `claudeam[.]com`, and ended with **RemoteLibraryInjection** into `explorer.exe` plus installation of a global low-level keylogger. Microsoft separately described the **CrashFix** variant, which used a fake Chrome extension impersonating **uBlock Origin Lite** to establish foothold, intentionally crashed the browser, and then prompted victims to run commands that renamed `finger.exe` and fetched obfuscated PowerShell. On domain-joined systems, the activity dropped a portable **WinPython** environment and the **ModeloRAT** Python remote access trojan, established persistence through a Run key, and in related cases created a scheduled task named **`SoftwareProtection`** for repeated execution. Additional reporting showed the same broader ClickFix ecosystem targeting **Windows, macOS, and Linux**, including a Perl-based **Pearl Stealer** that harvested browser, wallet, document, and Apple Notes data, stole macOS passwords, and exfiltrated files after OS-specific clipboard-delivered commands downloaded payloads from attacker infrastructure.
Aug 14, 2026
ClickFix (FakeCaptcha) campaigns are coercing Windows users into pasting attacker-supplied commands into the Run dialog, turning fake verification prompts into initial-access vectors. Recent activity has delivered the Node.js-based **ChainScript** RAT through `msiexec.exe` and Spotify-, Zoom-, or Teams-themed MSI installers; ChainScript persists via a scheduled task and Run key, uses Polygon smart contracts to discover WebSocket C2 servers, and supports shells, file operations, screen capture, wallet discovery, payload deployment, updates, and cleanup. A separate SmartApeSG-branded lure installed an unidentified RAT and persisted MeshAgent from `%LocalAppData%\Temp%` to connect with a malicious Mesh server. Another ClickFix chain used caret-obfuscated Run-dialog commands, copied and renamed `curl.exe`, retrieved a purported PDF containing the legitimate IronPython 3.4.2 ZIP, and executed an in-memory Python payload through a renamed interpreter. The payload contacted `artides[.]net` with the `K8VGmQTrzX` User-Agent, disabled TLS certificate validation, then reportedly injected into a restarted `explorer.exe` and installed a low-level keyboard hook. Defenders should prioritize process-creation and RunMRU telemetry for `explorer.exe` spawning `mshta.exe`, `cmd.exe`, PowerShell, `pwsh.exe`, or `conhost.exe`, particularly with encoded commands, download cradles, clipboard activity, obfuscation, or unusual child processes; correlated DNS and `mshta.exe` detections improve resilience against easily changed lures and command strings.
Sep 22, 2026