Skip to navigation

Threat reportMalwareTL-2026-2199

ClickFix Cluster Uses DLL Sideloading and Compromised WordPress Sites to Deliver Lorem Ipsum Loader, Linked to Vanilla Tempest

highACTIVE

Field Effect tracked three distinct ClickFix social-engineering campaigns (June-July 2026) that share file-naming conventions, DLL sideloading via renamed legitimate binaries, and command-and-control dead drops hosted on digitalpoint.com forum profiles. The cluster overlaps with BlueVoyant's Lorem Ipsum loader and, via the Supper backdoor, is attributed to the financially motivated ransomware actor Vanilla Tempest (aka Rapid Brigantine, DEV-0832, Vice Society).

Key facts for Vanilla Tempest ClickFix sideloading cluster

IdentifiersTL-2026-2199
Also known asLorem Ipsum Loader ClickFix cluster
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsWordPress Self-hosted WordPress sites (compromised for drive-by delivery); Microsoft Windows (target OS for MSI/DLL-sideload payload chain)
AttributionVanilla Tempest (medium confidence)
MalwareINC Ransomware - S1139
ToolsGootLoader
MITRE ATT&CK techniquesT1053.005 Scheduled Task/Job: Scheduled Task, T1059.003 Command and Scripting Interpreter: Windows Command Shell, T1059.006 Command and Scripting Interpreter: Python, T1059.007 Command and Scripting Interpreter: JavaScript, T1069.002 Permission Groups Discovery: Domain Groups, T1087.002 Account Discovery: Domain Account, T1102.001 Web Service: Dead Drop Resolver, T1204.004 User Execution: Malicious Copy and Paste, T1218.007 System Binary Proxy Execution: Msiexec, T1482 Domain Trust Discovery, T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder, T1564.004 Hide Artifacts: NTFS File Attributes and 3 more in the attack flow
MotivationFINANCIAL
Target sectorsarchitecture, legal services, construction technology, health, education, it
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for Vanilla Tempest ClickFix sideloading cluster

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2199 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: mscoree.dll/dui70.dll Sideload, Hidden Persistence & AD/Domain-Trust Discovery (SPL)

Detects the shared post-exploitation chain across all three ClickFix campaigns: a non-system-path process loading mscoree.dll or dui70.dll (via the renamed ClickOnce Launch Utility posing as 'NET Runtime Optimization Service.exe' or via LockScreenContentServer.exe), a hidden ProgramData staging folder created with attrib.exe +h +s, scheduled-task or Run-key persistence, and Active Directory/domain-trust host-discovery commands (nltest.exe /dclist:, /domain_trusts, dsregcmd.exe /status, net.exe group "domain admins"/localgroup administrators/user <user> /domain) consistent with Vanilla Tempest pre-ransomware staging.

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=7 (ImageLoaded="*\\mscoree.dll" OR ImageLoaded="*\\dui70.dll") AND Image!="C:\\Windows\\System32\\*" AND Image!="C:\\Windows\\SysWOW64\\*")
OR (EventCode=1 Image="*\\attrib.exe" CommandLine="*+h*" CommandLine="*ProgramData*")
OR (EventCode=1 (Image="*\\schtasks.exe" OR Image="*\\reg.exe") (CommandLine="*/create*" OR CommandLine="*\\Run\"*"))
OR (EventCode=1 (Image="*\\nltest.exe" OR Image="*\\dsregcmd.exe") (CommandLine="*dclist*" OR CommandLine="*domain_trusts*" OR CommandLine="*/status*"))
OR (EventCode=1 Image="*\\net.exe" (CommandLine="*domain admins*" OR CommandLine="*localgroup administrators*" OR CommandLine="*/domain*"))
| eval detection_bucket=case(
    EventCode=7, "dll_sideload_mscoree_dui70",
    match(Image,"attrib\.exe"), "hidden_programdata_attrib",
    match(Image,"schtasks\.exe|reg\.exe"), "scheduled_task_or_runkey_persistence",
    match(Image,"nltest\.exe|dsregcmd\.exe"), "domain_trust_host_discovery",
    match(Image,"net\.exe"), "ad_group_account_discovery",
    1=1, "other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ImageLoaded) as modules by ComputerName, User, detection_bucket
| sort -last_seen

Microsoft KQL

DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName in~ ("mscoree.dll","dui70.dll")
| where InitiatingProcessFolderPath !startswith @"c:\windows\system32" and InitiatingProcessFolderPath !startswith @"c:\windows\syswow64"
| project Timestamp, DeviceName, ActorProcess=InitiatingProcessFileName, ActorPath=InitiatingProcessFolderPath, Evidence=strcat("sideload:", FileName), Bucket="dll_sideload_mscoree_dui70"
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where (FileName =~ "attrib.exe" and ProcessCommandLine has "+h" and ProcessCommandLine has "ProgramData")
        or (FileName in~ ("schtasks.exe","reg.exe") and ProcessCommandLine has_any ("/create", @"\Run\""))
        or (FileName in~ ("nltest.exe","dsregcmd.exe") and ProcessCommandLine has_any ("dclist","domain_trusts","/status"))
        or (FileName == "net.exe" and ProcessCommandLine has_any ("domain admins","localgroup administrators","/domain"))
    | project Timestamp, DeviceName, ActorProcess=FileName, ActorPath=FolderPath, Evidence=ProcessCommandLine, Bucket="persistence_or_ad_discovery"
)
| order by Timestamp desc

Sigma

title: ClickFix Cluster - Non-System mscoree.dll/dui70.dll Sideload
id: 2d7c6e14-9a3b-4f58-8e21-6b4f0a2c7d33
status: experimental
description: Detects mscoree.dll or dui70.dll being loaded by a process executing outside System32/SysWOW64, consistent with the Field Effect ClickFix cluster's renamed-LOLBin sideload chain (fake 'NET Runtime Optimization Service.exe' / ClickOnce Launch Utility, LockScreenContentServer.exe) tied to the Lorem Ipsum loader and Vanilla Tempest. Pair with host-based hunting for the accompanying attrib.exe hidden-ProgramData staging, scheduled-task/Run-key persistence, and nltest/dsregcmd/net.exe domain-trust and AD-group discovery documented for this cluster.
references:
    - https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns
    - https://www.bluevoyant.com/blog/orem-ipsum-clickfix-rapid-brigantine
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.discovery
    - attack.t1574.001
    - attack.t1053.005
    - attack.t1547.001
    - attack.t1564.004
    - attack.t1069.002
    - attack.t1087.002
    - attack.t1482
    - attack.tool.supper_backdoor
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\mscoree.dll'
            - '\dui70.dll'
    filter_system:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter_system
falsepositives:
    - Vendor .NET or UI applications that legitimately load mscoree.dll/dui70.dll from a non-standard but sanctioned install directory — verify code signature and binary path against a known-good baseline.
    - Help-desk/IT scripts legitimately invoking nltest, dsregcmd, or net.exe for domain troubleshooting or scheduled AD audits.
level: high

Known false positives:

  • Vendor .NET or UI applications that legitimately load mscoree.dll/dui70.dll from a non-standard but sanctioned install directory — verify code signature and binary path against a known-good baseline.
  • Help-desk/IT scripts legitimately invoking nltest, dsregcmd, or net.exe for domain troubleshooting or scheduled AD audits.

Tuning notes: Baseline legitimate mscoree.dll/dui70.dll load paths in your environment before moving to blocking mode; scope the domain/account-discovery sub-selections to exclude hosts running scheduled AD-health-check or backup tooling that legitimately runs nltest/dsregcmd/net.exe on a schedule.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ClickFix Msiexec /package Remote MSI Execution (KQL) · unlock with TL Creds
  • mscoree.dll/dui70.dll Sideload, Hidden Persistence & AD/Domain-Trust Discovery (KQL) · unlock with TL Creds
  • Dead-Drop Resolver Beaconing & Cluster C2 Infrastructure (KQL) · unlock with TL Creds
  • ClickFix Msiexec /package Remote MSI Execution (Sigma) · unlock with TL Creds
  • mscoree.dll/dui70.dll Sideload, Hidden Persistence & AD/Domain-Trust Discovery (Sigma) · unlock with TL Creds
  • Dead-Drop Resolver Beaconing & Cluster C2 Infrastructure (Sigma) · unlock with TL Creds
  • ClickFix Msiexec /package Remote MSI Execution (SPL) · unlock with TL Creds
  • Dead-Drop Resolver Beaconing & Cluster C2 Infrastructure (SPL) · unlock with TL Creds

Indicators of compromise for Vanilla Tempest ClickFix sideloading cluster

As of 2026-08-29, Threadlinqs Intelligence tracks 33 indicators of compromise for TL-2026-2199.

Sample indicators (3 of 33)

  • IP address: 144.172.103[.]194
  • Domain: seephotoalbum[.]com
  • URL: hxxps://digitalpoint[.]com/members/trytodetectme.1134520

Defanged, TLP:CLEAR. Full set of 33 indicators: unlock with TL Creds.

33 indicators of compromise · unlock with TL Creds. Compare plans

How Vanilla Tempest ClickFix sideloading cluster works

Field Effect's 2026-08-24 report documents a ClickFix cluster comprising three distinct campaigns observed between mid-June and July 2026, unified by shared naming conventions, a common DLL-sideloading pattern, and a shared command-and-control (C2) dead-drop resolver hosted on the digitalpoint.com forum. Campaign 1 (mid-June 2026) delivered remotely hosted MSI packages via a ClickFix clipboard prompt invoking `MsieXEc.ExE /pAckAGe`, abusing legitimate installers for 3D PDF Maker Smart, Bitwarden VPN, and ESET SysInspector to sideload a malicious mscoree.dll alongside a renamed copy of Microsoft's ClickOnce Launch Utility (masquerading as 'NET Runtime Optimization Service.exe'). Persistence was established via a scheduled task, a hidden ProgramData subfolder was created with attrib.exe (+h +s), and PowerShell executed dsregcmd.exe /status for host discovery; Field Effect documented an approximately six-day dwell time before loader deployment. Campaign 2 (late June 2026) shared Campaign 1's infrastructure and mscoree.dll/ClickOnce sideload chain but delivered payloads via PowerShell downloading and executing an outdated NodeJS v7.10.1 runtime alongside a malicious update.js. Campaign 3 (July 2026) used a compromised WordPress site serving JavaScript from /js/all.min.js that performed Polygon-blockchain-based C2 domain retrieval, fingerprinted the victim (RAM, CPU, browser language/user agent), and served a localized ClickFix lure leading to an embedded Python 3.5 install, an obfuscated Captcha.py payload, and DLL sideloading via LockScreenContentServer.exe; persistence used a Run registry key plus an hourly scheduled task, with second-stage infrastructure hosted at cooldogshistory.com. Across all three campaigns, post-compromise activity included Active Directory and host-discovery commands (nltest.exe /dclist:, net.exe group "domain admins" /domain, nltest /domain_trusts, ipconfig.exe, net.exe user <user> /domain, net.exe localgroup administrators) and an ADSI-searcher PowerShell query for user accounts with populated description fields. C2 used a dead-drop resolver technique on digitalpoint.com forum member profiles (digitalpoint.com/members/trytodetectme.1134520, digitalpoint.com/members/documentpublisher.1139897), where encoded, space-delimited strings in the profile info tab decode to live C2 domains; victims subsequently POST JFIF-disguised uploads to /api/init/<guid>. Prior reporting on this same dead-drop technique (tracked by BlueVoyant against the Lorem Ipsum loader) documents the resolver platform migrating from letsdiskuss.com to digitalpoint.com after public disclosure, while retaining the '-=(' / ')=-' delimiter convention, substitution-cipher decoding, one-profile-to-one-C2-cluster mapping, and per-victim beaconing to three redundant Cloudflare-fronted C2 domains. Field Effect ties this cluster to BlueVoyant's Lorem Ipsum loader family, active since February 2026 and originally delivered via trojanized, fraudulently code-signed Microsoft Teams installers before pivoting to ClickFix after Microsoft disrupted the malware-signing service the operators relied on. BlueVoyant and other reporting attribute Lorem Ipsum/ClickFix activity to Rapid Brigantine, also tracked as Vanilla Tempest, DEV-0832, Vice Society, and Vice Spider, and describe Lorem Ipsum's DLL side-loading chains (observed using both mscoree.dll and msvcp140.dll variants) as leading to ransomware deployment (Rhysida, BlackCat, Zeppelin, Quantum Locker in BlueVoyant's broader Lorem Ipsum tracking). Independently, Microsoft has attributed the Active Directory/domain-trust enumeration TTPs and the Supper backdoor specifically to Vanilla Tempest, a financially motivated actor that receives handoffs from Storm-0494 (Gootloader) intrusions and has deployed INC ransomware against U.S. healthcare targets, using AnyDesk, MEGA, RDP, and WMI for lateral movement and exfiltration ahead of ransomware detonation. Field Effect's cluster does not itself confirm ransomware deployment; the Vanilla Tempest link is via TTP/tooling overlap (Supper backdoor behavior and AD enumeration patterns), not a directly observed ransomware payload in these three campaigns.

MITRE ATT&CK techniques by tactic:

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Execution

T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1059.006 Command and Scripting Interpreter: Python; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.004 User Execution: Malicious Copy and Paste

Discovery

T1069.002 Permission Groups Discovery: Domain Groups; T1087.002 Account Discovery: Domain Account; T1482 Domain Trust Discovery

Command and Control

T1102.001 Web Service: Dead Drop Resolver

Defense Evasion

T1218.007 System Binary Proxy Execution: Msiexec; T1564.004 Hide Artifacts: NTFS File Attributes

stealth

T1574.001 Hijack Execution Flow: DLL

Resource Development

T1583.006 Acquire Infrastructure: Web Services

Reconnaissance

T1681 Search Threat Vendor Data

Remediation for Vanilla Tempest ClickFix sideloading cluster

Patches

  • No vendor CVE/patch applies — this is a social-engineering and living-off-the-land delivery campaign, not a software vulnerability

Immediate actions

  • Block the IOC domains and IPs in threat_iocs at DNS/proxy/perimeter firewall
  • Alert on/block outbound traffic to digitalpoint.com/members/trytodetectme.1134520 and digitalpoint.com/members/documentpublisher.1139897, and to /api/init/<guid> upload paths
  • Hunt via EDR for the listed SHA256 hashes and for the sideloading host processes (3DPDFMakerSmart.exe, 'NET Runtime Optimization Service.exe', LockScreenContentServer.exe) loading mscoree.dll/dui70.dll from non-standard paths
  • Deploy detections for ClickFix-style user execution (clipboard-paste into Run dialog or terminal) and for msiexec.exe invoked with remote /package URLs

Workarounds

  • User-awareness training specifically covering ClickFix/fake-CAPTCHA copy-paste prompts and unsolicited phone contact directing users to attacker-controlled 'photo/document' sites
  • Restrict or log Windows Run-dialog and clipboard-to-terminal execution on high-risk endpoints where feasible

Longer-term hardening

  • Deploy application allowlisting/EDR DLL side-load protection to block unsigned or renamed ClickOnce Launch Utility and other LOLBins executing from ProgramData
  • Monitor for scheduled-task and Run-key persistence created by non-standard installers, and for hidden (+h +s) ProgramData subfolders
  • Harden and continuously integrity-monitor WordPress installations (plugins, themes, WAF) given confirmed use of a compromised WordPress site as a delivery vector
  • Threat-hunt for downstream Vanilla Tempest / Supper-backdoor indicators (AnyDesk, MEGA, RDP + WMI lateral movement) given the attributed ransomware follow-on risk

Affected and fixed versions

  • WordPress — Self-hosted WordPress sites (compromised for drive-by delivery)
    Vulnerable versions: Not a WordPress-core CVE — arbitrary compromised sites used as a delivery host
  • Microsoft — Windows (target OS for MSI/DLL-sideload payload chain)
    Vulnerable versions: All Windows versions reachable via ClickFix social engineering

Timeline of Vanilla Tempest ClickFix sideloading cluster

  • BlueVoyant tracks the Lorem Ipsum loader campaign beginning, initially delivered via trojanized Microsoft Teams installers using fraudulently obtained code-signing certificates.
  • Microsoft disrupts the malware-signing-as-a-service operation the Lorem Ipsum operators relied on for signed installers, forcing a pivot from trojanized installers to ClickFix-based delivery.
  • Field Effect observes Campaign 1: ClickFix clipboard prompts invoking msiexec.exe to fetch remote MSI packages abusing 3D PDF Maker Smart, Bitwarden VPN, and ESET SysInspector to sideload mscoree.dll via a renamed ClickOnce Launch Utility.
  • Field Effect documents an approximately six-day dwell time in Campaign 1 intrusions between initial MSI-based compromise and loader deployment, with a hidden ProgramData subfolder created via attrib.exe (+h +s).
  • Field Effect observes Campaign 2, sharing Campaign 1's infrastructure: PowerShell downloads an outdated NodeJS v7.10.1 runtime and executes a malicious update.js alongside the same mscoree.dll sideload chain.
  • Field Effect observes Campaign 3: a compromised WordPress site serves JavaScript (/js/all.min.js) using Polygon blockchain-based C2 domain retrieval, victim fingerprinting, and a localized ClickFix lure leading to an embedded Python 3.5 install, obfuscated Captcha.py, and LockScreenContentServer.exe DLL sideloading with Run-key and hourly-scheduled-task persistence.
  • Field Effect publishes 'A ClickFix cluster,' correlating all three campaigns via shared naming conventions, DLL sideloading, and digitalpoint.com dead-drop C2, and links the cluster to BlueVoyant's Lorem Ipsum loader and, via the Supper backdoor, to Vanilla Tempest.

Sources cited for Vanilla Tempest ClickFix sideloading cluster

More from Vanilla Tempest

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats