# ClickFix Cluster Uses DLL Sideloading and Compromised WordPress Sites to Deliver Lorem Ipsum Loader, Linked to Vanilla Tempest

> Field Effect tracked three distinct ClickFix social-engineering campaigns (June-July 2026) that share file-naming conventions, DLL sideloading via renamed legitimate binaries, and command-and-control dead drops hosted on digitalpoint.com forum profiles. The cluster overlaps with BlueVoyant's Lorem Ipsum loader and, via the Supper backdoor, is attributed to the financially motivated ransomware actor Vanilla Tempest (aka Rapid Brigantine, DEV-0832, Vice Society).

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-08-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2199
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-vanilla-tempest-clickfix-sideloading-cluster-tl-2026-2199.webp?v=56dfb5a8 (Threadlinqs threat intel: Vanilla Tempest ClickFix DLL Sideloading: Detection & IOCs (TL-2026-2199) — High severity, 33 IOCs, 9 detection rules.)
- **ID:** TL-2026-2199
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Vanilla Tempest
- **Detections:** 9 (1 shown free below) · **IOCs:** 33 (3 shown free below)

## Description

Field Effect's 2026-08-24 report documents a ClickFix cluster comprising three distinct campaigns observed between mid-June and July 2026, unified by shared naming conventions, a common DLL-sideloading pattern, and a shared command-and-control (C2) dead-drop resolver hosted on the digitalpoint.com forum. Campaign 1 (mid-June 2026) delivered remotely hosted MSI packages via a ClickFix clipboard prompt invoking `MsieXEc.ExE /pAckAGe`, abusing legitimate installers for 3D PDF Maker Smart, Bitwarden VPN, and ESET SysInspector to sideload a malicious mscoree.dll alongside a renamed copy of Microsoft's ClickOnce Launch Utility (masquerading as 'NET Runtime Optimization Service.exe'). Persistence was established via a scheduled task, a hidden ProgramData subfolder was created with attrib.exe (+h +s), and PowerShell executed dsregcmd.exe /status for host discovery; Field Effect documented an approximately six-day dwell time before loader deployment. Campaign 2 (late June 2026) shared Campaign 1's infrastructure and mscoree.dll/ClickOnce sideload chain but delivered payloads via PowerShell downloading and executing an outdated NodeJS v7.10.1 runtime alongside a malicious update.js. Campaign 3 (July 2026) used a compromised WordPress site serving JavaScript from /js/all.min.js that performed Polygon-blockchain-based C2 domain retrieval, fingerprinted the victim (RAM, CPU, browser language/user agent), and served a localized ClickFix lure leading to an embedded Python 3.5 install, an obfuscated Captcha.py payload, and DLL sideloading via LockScreenContentServer.exe; persistence used a Run registry key plus an hourly scheduled task, with second-stage infrastructure hosted at cooldogshistory.com. Across all three campaigns, post-compromise activity included Active Directory and host-discovery commands (nltest.exe /dclist:, net.exe group "domain admins" /domain, nltest /domain_trusts, ipconfig.exe, net.exe user <user> /domain, net.exe localgroup administrators) and an ADSI-searcher PowerShell query for user accounts with populated description fields. C2 used a dead-drop resolver technique on digitalpoint.com forum member profiles (digitalpoint.com/members/trytodetectme.1134520, digitalpoint.com/members/documentpublisher.1139897), where encoded, space-delimited strings in the profile info tab decode to live C2 domains; victims subsequently POST JFIF-disguised uploads to /api/init/<guid>. Prior reporting on this same dead-drop technique (tracked by BlueVoyant against the Lorem Ipsum loader) documents the resolver platform migrating from letsdiskuss.com to digitalpoint.com after public disclosure, while retaining the '-=(' / ')=-' delimiter convention, substitution-cipher decoding, one-profile-to-one-C2-cluster mapping, and per-victim beaconing to three redundant Cloudflare-fronted C2 domains. Field Effect ties this cluster to BlueVoyant's Lorem Ipsum loader family, active since February 2026 and originally delivered via trojanized, fraudulently code-signed Microsoft Teams installers before pivoting to ClickFix after Microsoft disrupted the malware-signing service the operators relied on. BlueVoyant and other reporting attribute Lorem Ipsum/ClickFix activity to Rapid Brigantine, also tracked as Vanilla Tempest, DEV-0832, Vice Society, and Vice Spider, and describe Lorem Ipsum's DLL side-loading chains (observed using both mscoree.dll and msvcp140.dll variants) as leading to ransomware deployment (Rhysida, BlackCat, Zeppelin, Quantum Locker in BlueVoyant's broader Lorem Ipsum tracking). Independently, Microsoft has attributed the Active Directory/domain-trust enumeration TTPs and the Supper backdoor specifically to Vanilla Tempest, a financially motivated actor that receives handoffs from Storm-0494 (Gootloader) intrusions and has deployed INC ransomware against U.S. healthcare targets, using AnyDesk, MEGA, RDP, and WMI for lateral movement and exfiltration ahead of ransomware detonation. Field Effect's cluster does not itself confirm ransomware deployment; the Vanilla Tempest link is via TTP/tooling overlap (Supper backdoor behavior and AD enumeration patterns), not a directly observed ransomware payload in these three campaigns.

## MITRE ATT&CK

- T1681 Search Threat Vendor Data
- T1583.006 Acquire Infrastructure: Web Services
- T1204.004 User Execution: Malicious Copy and Paste
- T1218.007 System Binary Proxy Execution: Msiexec
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1574.001 Hijack Execution Flow: DLL
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1564.004 Hide Artifacts: NTFS File Attributes
- T1069.002 Permission Groups Discovery: Domain Groups
- T1087.002 Account Discovery: Domain Account
- T1482 Domain Trust Discovery
- T1102.001 Web Service: Dead Drop Resolver

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**mscoree.dll/dui70.dll Sideload, Hidden Persistence & AD/Domain-Trust Discovery (SPL)** (`TL-2026-2199-SPL-002`)

Detects the shared post-exploitation chain across all three ClickFix campaigns: a non-system-path process loading mscoree.dll or dui70.dll (via the renamed ClickOnce Launch Utility posing as 'NET Runtime Optimization Service.exe' or via LockScreenContentServer.exe), a hidden ProgramData staging folder created with attrib.exe +h +s, scheduled-task or Run-key persistence, and Active Directory/domain-trust host-discovery commands (nltest.exe /dclist:, /domain_trusts, dsregcmd.exe /status, net.exe group "domain admins"/localgroup administrators/user <user> /domain) consistent with Vanilla Tempest pre-ransomware staging.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1574.001, T1053.005, T1547.001, T1564.004, T1069.002, T1087.002, T1482
- **Data sources:** sysmon, windows_security, microsoft_defender_deviceprocessevents, microsoft_defender_deviceimageloadevents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
(EventCode=7 (ImageLoaded="*\\mscoree.dll" OR ImageLoaded="*\\dui70.dll") AND Image!="C:\\Windows\\System32\\*" AND Image!="C:\\Windows\\SysWOW64\\*")
OR (EventCode=1 Image="*\\attrib.exe" CommandLine="*+h*" CommandLine="*ProgramData*")
OR (EventCode=1 (Image="*\\schtasks.exe" OR Image="*\\reg.exe") (CommandLine="*/create*" OR CommandLine="*\\Run\"*"))
OR (EventCode=1 (Image="*\\nltest.exe" OR Image="*\\dsregcmd.exe") (CommandLine="*dclist*" OR CommandLine="*domain_trusts*" OR CommandLine="*/status*"))
OR (EventCode=1 Image="*\\net.exe" (CommandLine="*domain admins*" OR CommandLine="*localgroup administrators*" OR CommandLine="*/domain*"))
| eval detection_bucket=case(
    EventCode=7, "dll_sideload_mscoree_dui70",
    match(Image,"attrib\.exe"), "hidden_programdata_attrib",
    match(Image,"schtasks\.exe|reg\.exe"), "scheduled_task_or_runkey_persistence",
    match(Image,"nltest\.exe|dsregcmd\.exe"), "domain_trust_host_discovery",
    match(Image,"net\.exe"), "ad_group_account_discovery",
    1=1, "other")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ImageLoaded) as modules by ComputerName, User, detection_bucket
| sort -last_seen
```

### Microsoft KQL

```kql
DeviceImageLoadEvents
| where Timestamp > ago(24h)
| where FileName in~ ("mscoree.dll","dui70.dll")
| where InitiatingProcessFolderPath !startswith @"c:\windows\system32" and InitiatingProcessFolderPath !startswith @"c:\windows\syswow64"
| project Timestamp, DeviceName, ActorProcess=InitiatingProcessFileName, ActorPath=InitiatingProcessFolderPath, Evidence=strcat("sideload:", FileName), Bucket="dll_sideload_mscoree_dui70"
| union (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where (FileName =~ "attrib.exe" and ProcessCommandLine has "+h" and ProcessCommandLine has "ProgramData")
        or (FileName in~ ("schtasks.exe","reg.exe") and ProcessCommandLine has_any ("/create", @"\Run\""))
        or (FileName in~ ("nltest.exe","dsregcmd.exe") and ProcessCommandLine has_any ("dclist","domain_trusts","/status"))
        or (FileName == "net.exe" and ProcessCommandLine has_any ("domain admins","localgroup administrators","/domain"))
    | project Timestamp, DeviceName, ActorProcess=FileName, ActorPath=FolderPath, Evidence=ProcessCommandLine, Bucket="persistence_or_ad_discovery"
)
| order by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Cluster - Non-System mscoree.dll/dui70.dll Sideload
id: 2d7c6e14-9a3b-4f58-8e21-6b4f0a2c7d33
status: experimental
description: Detects mscoree.dll or dui70.dll being loaded by a process executing outside System32/SysWOW64, consistent with the Field Effect ClickFix cluster's renamed-LOLBin sideload chain (fake 'NET Runtime Optimization Service.exe' / ClickOnce Launch Utility, LockScreenContentServer.exe) tied to the Lorem Ipsum loader and Vanilla Tempest. Pair with host-based hunting for the accompanying attrib.exe hidden-ProgramData staging, scheduled-task/Run-key persistence, and nltest/dsregcmd/net.exe domain-trust and AD-group discovery documented for this cluster.
references:
    - https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns
    - https://www.bluevoyant.com/blog/orem-ipsum-clickfix-rapid-brigantine
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-29
tags:
    - attack.persistence
    - attack.defense-evasion
    - attack.discovery
    - attack.t1574.001
    - attack.t1053.005
    - attack.t1547.001
    - attack.t1564.004
    - attack.t1069.002
    - attack.t1087.002
    - attack.t1482
    - attack.tool.supper_backdoor
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith:
            - '\mscoree.dll'
            - '\dui70.dll'
    filter_system:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter_system
falsepositives:
    - Vendor .NET or UI applications that legitimately load mscoree.dll/dui70.dll from a non-standard but sanctioned install directory — verify code signature and binary path against a known-good baseline.
    - Help-desk/IT scripts legitimately invoking nltest, dsregcmd, or net.exe for domain troubleshooting or scheduled AD audits.
level: high
```

**Known false positives:**

- Vendor .NET or UI applications that legitimately load mscoree.dll/dui70.dll from a non-standard but sanctioned install directory — verify code signature and binary path against a known-good baseline.
- Help-desk/IT scripts legitimately invoking nltest, dsregcmd, or net.exe for domain troubleshooting or scheduled AD audits.

**Tuning notes:** Baseline legitimate mscoree.dll/dui70.dll load paths in your environment before moving to blocking mode; scope the domain/account-discovery sub-selections to exclude hosts running scheduled AD-health-check or backup tooling that legitimately runs nltest/dsregcmd/net.exe on a schedule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Msiexec /package Remote MSI Execution (KQL) (locked: unlock with TL Creds)
- mscoree.dll/dui70.dll Sideload, Hidden Persistence & AD/Domain-Trust Discovery (KQL) (locked: unlock with TL Creds)
- Dead-Drop Resolver Beaconing & Cluster C2 Infrastructure (KQL) (locked: unlock with TL Creds)
- ClickFix Msiexec /package Remote MSI Execution (Sigma) (locked: unlock with TL Creds)
- mscoree.dll/dui70.dll Sideload, Hidden Persistence & AD/Domain-Trust Discovery (Sigma) (locked: unlock with TL Creds)
- Dead-Drop Resolver Beaconing & Cluster C2 Infrastructure (Sigma) (locked: unlock with TL Creds)
- ClickFix Msiexec /package Remote MSI Execution (SPL) (locked: unlock with TL Creds)
- Dead-Drop Resolver Beaconing & Cluster C2 Infrastructure (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 33)

Defanged, TLP:CLEAR.

- IP address: `144.172.103[.]194`
- Domain: `seephotoalbum[.]com`
- URL: `hxxps://digitalpoint[.]com/members/trytodetectme.1134520`

Full set of 33 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [A ClickFix cluster: Observed activity from recent ClickFix campaigns](https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns)
- [Malpedia library entry: A ClickFix cluster (win.lorem_ipsum)](https://malpedia.caad.fkie.fraunhofer.de/library/aa772504-4ae8-43c6-a495-a89404fa6c20/)
- [Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine](https://www.bluevoyant.com/blog/orem-ipsum-clickfix-rapid-brigantine)
- [Lorem Ipsum Malware: Trojanized MS Teams Installers, Multi-Stage Loader & Backdoor](https://www.bluevoyant.com/blog/lorem-ipsum-trojanized-microsoft-teams-installers-multi-stage-loader-backdoor)
- ['Lorem Ipsum' Malware Pivots to ClickFix Delivery](https://www.darkreading.com/cyberattacks-data-breaches/lorem-ipsum-malware-clickfix-delivery)
- [ClickFix Campaigns Expand Malware Delivery With New Loaders and Fake Update Lures](https://thehackernews.com/2026/06/clickfix-campaigns-expand-malware.html)
- [Rapid Brigantine ties ClickFix malware to fake updates](https://itbrief.co.nz/story/rapid-brigantine-ties-clickfix-malware-to-fake-updates)
- [ClickFix Campaigns Deliver BabaDeda, Lorem Ipsum, and Potemkin Loaders](https://www.hivepro.com/threat-advisory/clickfix-campaigns-deliver-babadeda-lorem-ipsum-and-potemkin-loaders)
- [Microsoft: Vanilla Tempest hackers hit healthcare with INC ransomware](https://www.bleepingcomputer.com/news/microsoft/microsoft-vanilla-tempest-hackers-hit-healthcare-with-inc-ransomware/)
- [Microsoft: US Healthcare Sector Targeted by INC Ransomware Affiliate](https://www.securityweek.com/microsoft-us-healthcare-sector-targeted-by-inc-ransomware-affiliate/)
- [Microsoft Warns of New INC Ransomware Targeting U.S. Healthcare Sector](https://thehackernews.com/2024/09/microsoft-warns-of-new-inc-ransomware.html)
- [Vanilla Tempest's Ransomware Tactics: Gootloader to INC Payload](https://www.anvilogic.com/threat-reports/vanilla-tempest-ransomware-tech)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2199