Huntress: ClickFix lures hide malware in PNGs and reach domain controllers

Huntress says separate ClickFix operators trick users into running PowerShell that rebuilds malware from PNG pixels and reaches Windows domain controllers.

Huntress says ClickFix operators use fake Cloudflare checks, reached through Bing ads, SEO poisoning, or compromised sites, to make victims paste PowerShell. One chain unpacked a signed Microsoft binary, a rogue DLL, and a batch file, then rebuilt executables from PNG pixel data; a command looked for a 17,635-byte file in the browser cache. Huntress says later cases are unrelated operators adapting the same lure. A September intrusion sideloaded CertEnroll.dll, created an account, and opened a reverse SSH tunnel toward a primary domain controller. February and May cases delivered Matanbuchus 3.0, AstarionRAT, EtherRAT, and other loaders, reaching domain controllers with PsExec or administrative shares. A ChatGPT Custom GPT lure was tied to at least 40 incidents.