ClickFix campaigns hide executables in PNG images
Original title: ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers
Huntress says separate operators used ClickFix to reach domain controllers, steal access, and persist via tasks and Run keys.
Huntress reported that ClickFix activity now includes fake verification pages that persuade users to run pasted commands, with one chain rebuilding complete executables from data hidden in PNG pixels. Separate investigations used DLL sideloading, WinRM, PsExec, and administrative shares to reach Windows domain controllers. Other cases used browser-cache tricks and DuskDesk, a Node.js remote access trojan. Huntress says the chains are unrelated operators adapting the same lure.
Unconfirmed: Huntress describes separate investigations rather than one operation combining every technique.
- A September intrusion reached a primary domain controller after DLL sideloading and created an account plus a reverse SSH tunnel.
- February activity delivered Matanbuchus 3.0 and AstarionRAT and reached two domain controllers via PsExec.
- A May MSI ClickFix case compromised 11 hosts through administrative shares.
- One command searched a browser cache for a file of exactly 17,635 bytes.
Impact: Persistent access, credential theft, and domain movement
- 1.Do not paste webpage instructions into a terminal.
- 2.Monitor encoded PowerShell, new persistence entries, and unexpected SSH traffic.
- 3.Inspect unexpected scripting runtimes such as Node.js.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apirequestaccess.com | Windows\CurrentVersion\Run Case-specific persistence Domain apirequestaccess[.]com MSI delivery URL http://apirequestaccess[.]com/cfirm.php? |
| domain | ghost.io | ):- Context Indicator Description Redirect https://vvestalw.ghost[.]io/ Typosquatted redirector Redirect https://moziw[.]com/vve |
| domain | moziw.com | estalw.ghost[.]io/ Typosquatted redirector Redirect https://moziw[.]com/vvestalw/ Intermediate redirector Landing https://westlaw |
| domain | westlaw-signon.com | ziw[.]com/vvestalw/ Intermediate redirector Landing https://westlaw-signon[.]com/ Fake verification Archive cf_verify.zip Initial package |
| ipv4 | 151.240.151.76 | =QsKjQ1pEd43R33hJ1xV4LQwIVE8 Case-specific download Address 151.240.151[.]76 Delivery infrastructure SHA256 e921fe5307e29bf6fd00000dd5 |
| ipv4 | 167.148.201.104 | an.dat RAT settings Persistence DuskDesk Run value Endpoint 167.148.201[.]104:3861 Potential command server Note: IP addresses and doma |
| ipv4 | 23.227.199.41 | ell Script C:\ProgramData\ShService\r.ps1 Tunnel setup Host 23.227.199[.]41 SSH destination Persistence CertEnrollCtrl_Y0db6oZq9 Task |
| sha256 | 4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb | 440c3089e1a002c837bed147fbeb0c52 Malicious dui70.dll SHA256 4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb Malicious 1.bat Persistence LockScreenContentServer_qQrRrJi |
| sha256 | de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2 | \ProgramData\7168f7f870a45fbb\ Sideloading directory SHA256 de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2 Signed LockScreenContentServer.exe SHA256 ed37c12fc4beea987 |
| sha256 | e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9 | oad Address 151.240.151[.]76 Delivery infrastructure SHA256 e921fe5307e29bf6fd00000dd594356affd3a7b044e52720c7f10decbdc305b9 Node.exe artifact Implant LimeMint.js Malicious JavaScript |
| sha256 | ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52 | 7c8240e4f71c09fa2 Signed LockScreenContentServer.exe SHA256 ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52 Malicious dui70.dll SHA256 4155a4c7e857d9b613e14cf00e148037 |
From the original article
3 min read at cybersecuritynews.com
ClickFix attacks are moving beyond simple malware downloads, with recent investigations revealing executable payloads hidden inside PNG images and intrusions reaching Windows domain controllers. The activity shows how a fake verification prompt can become the starting point for persistent access, credential theft, and movement across corporate networks. The trick still depends on convincing someone to […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.