ClickFix campaigns hide executables in PNG images
Huntress says separate operators used ClickFix to reach domain controllers, steal access, and persist via tasks and Run keys.
68
Malware
AstarionRAT
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenNov 11, 2026
- Last mentioned10h ago
Timeline
2 articles · newest firstFake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
72
Appears with
- DuskDeskmalware · 2
- Huntressorganization · 2
- Matanbuchusmalware · 2
- Lumma Stealermalware · 1
- Potemkinmalware · 1
- NetSupport RATmalware · 1
- Chromeproduct · 1
- AMOSmalware · 1
- ClickFixmalware · 1
- Firefoxproduct · 1
- PowerShellproduct · 1
- Windowsproduct · 1
- Microsoftvendor · 1
- Braveproduct · 1
- EtherRATmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.