Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks

Hackers are using ClickFix tricks to install malware loaders and Python tunnels on Windows systems, creating access that could support ransomware attacks.

A late September incident shows how a user running a command can start an infection chain built around trusted Microsoft programs, hidden code, and encrypted network traffic.

The attack was stopped before ransomware reached the affected systems. However, the tools and methods matched activity previously linked to Vice Society, a cybercrime group associated with Rhysida ransomware.

That connection points to a likely ransomware goal, not proof that encryption occurred or that the group carried out this incident.

Researchers from Forescout identified Lorem Ipsum Loader during the investigation and examined five samples alongside 39 AxolotlLoader samples.

Their technical analysis of both loaders, published October 14, describes a new installer-based delivery method, shared command traffic, and important differences between the malware families.

Hackers Use ClickFix and Python Tunnels

ClickFix persuades people to run commands presented as verification steps or fixes. Its TerminalFix variant directs users toward Windows Terminal or PowerShell.

Earlier reporting on fake Cloudflare CAPTCHA prompts showed how this approach can lead to a reverse tunnel into corporate networks without exploiting a software flaw.

In the incident Forescout examined, ZIP archives contained a signed Microsoft executable, a malicious DLL, and a batch script.

Starting the trusted program caused it to load the nearby malicious library, a method called DLL sideloading. The script also created a registry startup entry and a scheduled task that ran hourly.

The malicious DLL carried an added section containing encoded instructions. A dictionary of 260 random five-letter words helped decode the hidden payload.

Another layer used XOR decoding, while an embedded JPEG acted as a decoy. These steps concealed the downloader before its code ran in memory. The loader then restored parts of a Windows library from a clean disk copy, a step intended to interfere with endpoint monitoring.

It launched another copy of its host program, injected code into that process, and ended the original process. A unique marker and mutex helped prevent duplicate instances.

Python Tunnel Gives Attackers a Route Back

To locate its command servers, Lorem Ipsum read encoded information from profiles on a legitimate public forum. This “dead-drop” method separated the server list from the malware itself.

After registration, the loader checked for tasks every five seconds, using traffic that claimed to come from Firefox. The final downloaded tool was a Python tunnel client. It connected over encrypted TLS traffic on port 443 and switched to WebSocket communication.

Related ClickFix Python proxy attacks have used different tools for a similar purpose: keeping a route into a compromised environment after the first infection.

Through the tunnel, the remote server could request TCP connections to specified destinations and relay data in both directions. Several connections could remain active at once.

Keepalive messages maintained access, while a shutdown command let the operator stop the client. Browser-like headers helped the connection appear less suspicious.

Forescout also found a separate delivery chain using a modified Teams MSI installer and two PowerShell stages. One script unpacked a GZIP-compressed payload, which then allocated memory and executed code.

Earlier coverage of fake Microsoft Teams installers documents another ransomware-linked campaign abusing the same trusted software brand, although its payloads differed.

The comparison found three AxolotlLoader variants spread across different host programs. Unlike Lorem Ipsum’s word-based encoding, Axolotl used embedded PNG data to decode shellcode.

Both families shared registration patterns and hosting links, but their code differed. Forescout considered an evolutionary relationship likely, while stressing that it could not confirm one. That distinction matters because a loader or tunnel does not prove ransomware execution.

Coverage of ClickFix ransomware lateral movement shows how other malware chains can support later activity, but investigators must establish each stage separately. Here, containment interrupted the chain before the suspected final payload arrived.

Forescout recommends user training alongside checks for unusual PowerShell process chains, DLL loads outside normal Windows folders, and matching registry entries and scheduled tasks.

Defenders should also review non-browser access to forum profiles and suspicious registration traffic. Shared hosting addresses and the reported TLS fingerprint should support investigation rather than serve as standalone proof of compromise.

Indicators of compromise (IoCs):-

Confirmed Network Indicators

Indicator	Type	Source context
scriptedgeapp[.]com	Domain	Lorem Ipsum command server
213.109.203[.]107	IPv4	Lorem Ipsum command server
transferrootway[.]com	Domain	Lorem Ipsum command server
45.66.249[.]57	IPv4	Lorem Ipsum command server
updaterdeskarc[.]com	Domain	Lorem Ipsum command server
185.28.119[.]81	IPv4	Lorem Ipsum command server
signinbyte[.]com	Domain	Lorem Ipsum command server
185.28.119[.]14	IPv4	Lorem Ipsum command server
queuepodnet[.]com	Domain	Lorem Ipsum command server
45.66.249[.]132	IPv4	Lorem Ipsum command server
vaycia[.]shop	Domain	Lorem Ipsum command server
animals-offline[.]com	Domain	Lorem Ipsum command server
loginrestforest[.]com	Domain	Lorem Ipsum command server
animalsviewstory[.]com	Domain	Lorem Ipsum command server
blogpostmessage[.]com	Domain	Lorem Ipsum command server
bloganimals[.]com	Domain	AxolotlLoader command server
185.28.119[.]138	IPv4	AxolotlLoader command server
letsdiskuss[.]com/user/lindawilliams51453	Profile path	Abused profile on a legitimate website
letsdiskuss[.]com/user/dhuahsd12d2752	Profile path	Abused profile on a legitimate website
letsdiskuss[.]com/user/joeblack1673	Profile path	Abused profile associated with MSI-to-PowerShell delivery
POST /api/init/<uuid>	HTTP pattern	Registration using image/jpeg and Firefox/143 headers
a0e9f5d64349fb13191bc781f81f42e1	JA3 fingerprint	Supporting detection signal, not standalone proof

Source: Forescout’s confirmed network IoC table.

Additional Source-Reported Hunting Artifacts

Artifact	Value or pattern	Context
Profile contact	lindawilliams@onionmail[.]org	Contact on the observed dead-drop profile
Alternate resolver	digitalpoint[.]com/members/<name>	Legitimate platform abused in other reported samples
Encoded-list delimiters	-=( and )=-	Markers surrounding encoded server information
Additional command endpoint	/api/cl/	Observed in other samples
Tunnel endpoint	/tunnel	TLS-protected WebSocket upgrade
Tunnel client	client.py	Final Python tunneling utility
User-Agent	Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0	Loader command traffic
Sideloading pair	vdsldr.exe / vdsutil.dll	Clean executable and malicious library
Sideloading pair	CertEnrollCtrl.exe / CertEnroll.dll	Clean executable and malicious library
Batch script	1.bat	Establishes persistence and launches the host
Persistence names	vdsldr_j6cx7eGEb; CertEnrollCtrl_L9k737tk9	Observed registry/task names
Persistence pattern	<basename>_<9 chars>	Correlate matching registry values and tasks
Task interval	/sc minute /mo 60	Hourly scheduled execution
Loader resources	.cpoc; RT_RCDATA	Encoded payload and word dictionary
Axolotl artifacts	fothk; .detourc; .detourd; 0x6997XXXX	Variant-dependent section and shellcode patterns
Runtime DLLs	libgcc_s_seh-1.dll; libwinpthread-1.dll	Files created together by PowerShell
PowerShell arguments	-AgentDll; -DepsDir; -Shim	Source-recommended script and process hunting terms
Hunting range	185.28.119.0/24	Infrastructure lead; check shared hosting before blocking
Certificate subject	BUSINESS CONSULTING SP Z O O	Shared by the 39 analyzed Axolotl samples
Certificate serial	330007dc4e73fc0b983770783900000007dc4e	Axolotl signing certificate
Certificate issuer	Microsoft ID Verified CS AOC CA 01	Reported certificate issuer
Certificate validity	February 19–22, 2026	Reported validity period

Source: Forescout’s analysis and detection guidance.

Unconfirmed Pivot Indicators

These values came from infrastructure pivots and were not individually confirmed as malicious in the report. Duplicate domain entries have been removed.

Indicators	Source pivot or relationship
creativecurrentmedia[.]com dailydoodleart[.]com oiedra[.]com uoidsod[.]com wandertalesblog[.]com	Linked certificate subject “Mariah Lingle”
biblegodlike[.]com reeeeealy[.]com semigoddess[.]com	Linked certificate subject “PAUL DEPASTENE”
bestpopularimages[.]com editdocumentfree[.]com opendocumentonline[.]com photocategories[.]com seephotoalbum[.]com topimagechecker[.]com topphotoalbum[.]com cloudbreachdetection[.]com beastcloudsecurity[.]com peekyourphoto[.]com newpopularimages[.]com yourbestsupervisiournow[.]com metricsdataway[.]com creativecurrentmedia[.]com cooldogshistory[.]com	Lorem Ipsum family node
syalae[.]com	Associated pivot addresses: 91.236.230[.]173, 92.118.126[.]226

Lorem Ipsum and Delivery-Chain SHA-256 Values

Hash strings below are transcribed exactly from the source. Some source-published strings appear shorter than the standard 64 hexadecimal characters; they have not been padded or silently corrected and should be verified before automated matching.

File or role	Source-published SHA-256
Modified Teams installer: MT_setup_v3.22.7182.msi	13a3fa500e91e35a34f71e0e88f07a5b3dd8251e9b423188030e31dbd8eaf603
Intermediate script: stage_03_aes_decrypted.ps1	074e58df3af3e83ca4fff7006ff6006b24b7182fde75fdbf894ee60161a6ed15
Final script: o1.ps1	ec7c33d434af7635f202dd726f34e03304f9a7d839c4625d962515d655d190c5
DLL	1a9541e8bf01f6f904d1759feeffea644f8669fc8d6a768cd55e0964e282e7c3
vdsutil.dll	e45888af7b94c773db1b956f6f1f8b3350c822505472522696c4f7942ce36cdd
ZIP bundle	9d054b244561b577365277b8338b0e702f35d892be8383cd2d65d79aee6dbc6b
DLL	f2d0445f6b6d9fe1143646c2c46b613405d418f11af98e464401205b36490ad4
ZIP bundle	53fecaa44dee57e25855f974b6e9662efccaf32bda965a83a1cd0b78e05fa2b3
vdsldr.exe — clean host, not itself malware	dc87b21776e184903d8f90a836422e3146b1f86ffa3997dd3630946d88ef91f5
1.bat	8a326b3512b7fb473f65630f6225a77717cef4ad574d0afe6654af279adf062f

AxolotlLoader SHA-256 Values

The following table preserves all 39 sample strings and their variant groupings as published by Forescout, including any apparent source-length errors.

Variant / host	Source-published SHA-256

Variant / host	Source-published SHA-256
A1 / Task Explorer	0d1953c17fa0d705ea86d79b3df0ef8e0c5a49053acdce09fdbd07f74a23a7c6
A1 / Task Explorer	29491ba6d7d8ca6850c68a067f01cdb917904b7a61b4299255c90a6cd6b78b48
A1 / Task Explorer	3a7d7e18c2a4beef280c564a90516af931ecb9be0dbacbe905b5df2c2f73682c
A1 / Task Explorer	54e71dabe16426e3f96500236a5de4ea5ed8ba74af5eb2b5ccb4c885dad9d60c
A1 / Task Explorer	5ce2c6a2eb3ebd2f66d72cdbeec4c98ce507b0bc317c5beedd61053b4f871e75
A1 / Task Explorer	7d1fa95404b611ed1301e9a676f0fd6b90f24cd7c766b605bc9c0d08516b1f73
A1 / Task Explorer	8b6e79b74859b22dbe9ef9d9ae2c27236640f062560fb4a9d743245d2389091a
A1 / Task Explorer	a557a320aa0c8fed986cd969596481b23d2c77abf7469e67b70f1231f0103682
A1 / Task Explorer	cf184310de31b720d0294d673b308eb7b82fdab4d7999953cdf12acef9631c03
A1 / PE Detective	3d3d9d404a54a43f0d500546f54e64fb944705fff41f93d5e82ad7024eba8ba9
A1 / PE Detective	5d00d7882328e6d10c7e9dc4ab241ea507286efe4e3d87c2be8436d0af703581
A1 / PE Detective	68848814c4efb2269b898a53cf0ffa265cd7fb58ca4cc71c90206e5e4444d6c7
A1 / PE Detective	95fc2dd8decd8c37ac3e985b63a58fd477bc98888d0754e7f041f7f1f8d0f043
A1 / PE Detective	acfecbebe0e30deafec6ef578c4adea2ba7c2279d92df808018142819bd8808f
A1 / PE Detective	ee046a0baa3bbb928192e8fcf13533e806acba1fef6d93f4be24edb27e4bd811
A1 / PE Detective	f66c6ec3837107d3163fc260921d598375cc5a9beae06e961bf4b073fb2b7664
A1 / VS Web Protocol Handler	267d4018543138409387506aabafe2318980ae3cf5e06ebe2675bf36cb24116c
A1 / VS Web Protocol Handler	3c8d7b6c7a37fb489c3d62b4427c3c09b5b8f3797a02d0465d4828c9812a62eb
A1 / VS Web Protocol Handler	8f6e2d874ac99b12bd0451b554a522894923b6858ee9ca11fdf011aa1ca67f59
A2 / OLE/COM Object Viewer	186d4c16a3758b20967d712582fbe74e7dc0d566ff99753adcb11dc857006a96
A2 / OLE/COM Object Viewer	1cb54b0217afe3bb8d4b2577f5be4f16cbd00b3e2c79ec18ebb1d9daad0e3588
A2 / OLE/COM Object Viewer	24fc515ddfc5c60cfdc2f369831cf462ca7b14318a925aaee261272ff9a394d2
A2 / OLE/COM Object Viewer	2c439ef59a7ed4510ac93924f12e690b291b887624356aa8269ac5b3e307ef16
A2 / OLE/COM Object Viewer	4bcf66570431b60c9822d444071f909ab9c235c675ece1649e8c64dc061622cb
A2 / OLE/COM Object Viewer	786ebc7d74a5229495a44eaf6bd422a53cfaefdd555596d037eaffa76f434b69
A2 / OLE/COM Object Viewer	9bda1a463f363f67db1905824b28bf16f3e927752a15b7d5ac3d307125509718
A2 / OLE/COM Object Viewer	9c45329f4334ef71d927ec66ea277cc276087628054881303f78ef0b2cac93b8
A2 / OLE/COM Object Viewer	a9ac7de9161d9ca3a791179beee7a51c1b94d4c381e131308e6586b6009dd867
A2 / OLE/COM Object Viewer	b3c5b9b37bcc9093439e9846c9f175bad09121c9809fee2bd96835419eceec7e
B / IE Add-on Installer	004fb2c36532c00d3c3eb041c12fba99d26eb900880a361cb664f76e4d022a26
B / IE Add-on Installer	0fb48494ed9b87a63f24a4b09923d2aeb0fa63585d85e823c1cbb5250cbd8a0f
B / IE Add-on Installer	12049c977e193972b665995720243571cf775f6f0428460192536d92c8528dbb
B / IE Add-on Installer	7dc54e91f58ec057f2596598b81ededf5c6c0976725bf2c1a2fc032f4d87f2f2
B / IE Add-on Installer	8643a4a4612b85f78cf246039bec6252caa56b4ed018978d9b42789e9058d1e6
B / IE Add-on Installer	a09eee349d00f3cdc17562eb2b2373efba1fa5c498da94ee38c102918cb095a7
B / IE Add-on Installer	abe4a4dbb2de862a3fba8b4efd58cacd020eac3a70bb6a8f92eec74c23dedc91
B / IE Add-on Installer	b43820a5dd317a18cc21d529e2dc242a705c45a204b1b01a7106d4407e5a7e24
B / IE Add-on Installer	d08e8ba4011438dacca0db41877febd6b6995936ddebe88d2cd124ec03182af6
B / IE Add-on Installer	f8a1c837254b8be9204f073f91af539463bf4e1ffabfe626c7aca2a0552ae683

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.