Threat reportMalwareTL-2026-4416
Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima, EgyBest, Shahid4u, Cima4U, Moviz)
Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima (TL-2026-4416), also tracked as Arabic Streaming ClickFix Campaign, is a high-severity malware campaign, first published 2026-10-24. It has no confirmed attribution, affects Microsoft Windows (PowerShell, Command Prompt, Windows Installer), maps to 8 MITRE ATT&CK techniques (T1027, T1036, T1059.001), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-4416
- Threat ID
- TL-2026-4416
- Also known as
- Arabic Streaming ClickFix Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- consumers, media and entertainment
- Target regions
- Middle East, North Africa
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima
Malware and tooling: Cmd
How Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima works
Typosquatted Arabic streaming sites fingerprint visitors with JavaScript, route them through traffic distribution systems (TDS) to ClickFix pages, and trick them into pasting clipboard commands into PowerShell or CMD. The commands pull multi-stage payloads (PowerShell scripts, an MSI installer, executables). The source names no malware family and no threat actor.
Research published 2026-10-06 by muha2xmad describes a ClickFix social-engineering campaign aimed at users of Arabic-language streaming platforms. The actors register typosquatted and look-alike domains for MyCima (mycima.party, mycima.fast), WeCima (wecimaa.cam, wecimaa.cyou), EgyBest (egybest.life, w1.egybest.land, egybest.fast, egybest.ltd), Shahid4u (shahid4u.blog, shahed4u.you, shhahid4u.diy), Cima4U (cima4u14.shop, cima4u.help, cima4p.co) and Moviz (moviz-time.pro, movizwap.surf, moviz-story.online, movizlaand.top, moviz-time.one).
Visiting a lure site loads JavaScript that collects browser telemetry (user agent, screen and window size, device pixel ratio, timezone, connection effectiveType, iframe and focus state, bot-detection fields) and sends it as Base64-encoded JSON to a profiling endpoint (cf.quickbase.icu/api/v1/px2). Visitors who pass the checks are redirected through a TDS (for example mangafantasyrealm.cfd/indexacrtbt3.php) to a ClickFix landing page. Landing domains include galacticflowtech.lol, galaxyflowsystems.lol, pulsarflowtech.lol, cinemadataflow.cfd, cloudflare.vc and cloudflare.bz. Several are fronted by Cloudflare, and cloudflare.vc resolves to 94.103.1.233 and 31.76.252.130, hosted at dhost.su (Russian). The page shows a fake CAPTCHA, verification or error prompt that places a command on the clipboard and tells the victim to paste and run it.
The source documents several command variants. (1) A PowerShell download to %TEMP%\zpppne.ps1 from nebuladatastream.lol, run with -ep bypass. (2) iex(irm ...) from imagedrah.com using a custom 'WUA/...' User-Agent and an 'X-WUA' header. (3) A decimal-encoded IP (1450003207, which is 86.109.75.7) used to fetch a script to %TEMP%\1451.ps1. (4) A CMD character-index cipher that rebuilds a command from a lookup string. The cipher decodes to a hidden-window powershell.exe -enc command, which downloads an MSI from the decimal IP 2549127135 (151.240.151.223) as u.msi and installs it silently with msiexec /i u.msi /qn MSIINSTALLPERUSER=1. The source also lists a 7z archive, an executable with a random name and an executable disguised as a Windows update (update-KB4703886.exe).
Attribution and payload family: the source states no actor and, in the fetched text, no malware family. The Malpedia entry tags DCRat and Ave Maria (WarZoneRAT), but that tagging is not confirmed by the article and no family is asserted here. Victim counts and exploitation scope are not stated. The article lists many look-alike phishing domains (banking, SaaS and retail brands) seen on the same infrastructure; these are listed in the source but are not tied to this campaign's payload chain. The source also lists a very large number of ATT&CK technique IDs, such as credential dumping and data destruction. Only techniques supported by the documented chain are mapped here. One PowerShell script hash in the source was truncated and is excluded from the IOCs. Defenders should hunt for clipboard-pasted PowerShell and CMD, Invoke-WebRequest/irm to decimal-IP hosts, hidden-window encoded PowerShell, and per-user msiexec quiet installs from %TEMP%.
MITRE ATT&CK techniques used in TL-2026-4416
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218.007 System Binary Proxy Execution: Msiexec
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1204.004 User Execution: Malicious Copy and Paste
Resource Development
Affected products and versions in Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima
- Microsoft — Windows (PowerShell, Command Prompt, Windows Installer)
Vulnerable versions: Windows endpoints whose users paste commands from the ClickFix pages
Remediation for Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima
Immediate actions
- Block the listed domains and IP addresses at DNS, proxy and egress firewall
- Hunt for powershell.exe or cmd.exe launched from explorer.exe or a browser shortly after a clipboard paste, especially with -enc, -ep bypass, -w h, iex(irm ...) or cmd /v:on
- Hunt for Invoke-WebRequest/Invoke-RestMethod to decimal-encoded IP hosts and for msiexec /i from %TEMP% with /qn MSIINSTALLPERUSER=1
- Isolate and triage hosts where u.msi, update-KB4703886.exe or the listed script hashes executed, and reset credentials used on them
Workarounds
- Block newly registered and typosquatted streaming-themed domains with DNS filtering
- Restrict msiexec silent installs from user-writable paths
Longer-term hardening
- Train users that no legitimate CAPTCHA or verification step asks them to paste a command into Run, PowerShell or Terminal
- Enable PowerShell Script Block Logging, Module Logging and Constrained Language Mode where feasible
- Restrict the Windows Run dialog and PowerShell for standard users via AppLocker or WDAC
- Deploy EDR with behavioral detection of script-based download-and-execute chains
Weaknesses (CWE) in Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima
Timeline of Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima
- DNS resolution of get-entry.to recorded in the source's infrastructure notes (earliest dated infrastructure artifact in the report)
- DNS resolution of sv4k.fun recorded in the source's infrastructure notes
- DNS resolution of sv4k.ru recorded in the source's infrastructure notes
- ClickFix attack chain recorded by the researcher (ANY.RUN sandbox analysis referenced in the report)
- Malpedia library entry created for the report, tagged with DCRat and Ave Maria (WarZoneRAT); the article itself does not confirm these families
- muha2xmad publishes the Arabic Streaming Websites ClickFix Campaign report with IOCs and Sigma rules
Sources cited for Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima
- Arabic Streaming Websites ClickFix Campaign (muha2xmad)
- Malpedia library entry: Arabic Streaming Websites ClickFix Campaign
- muha2xmad IOCs repository: arabic streaming clickfix campaign
- muha2xmad Sigma rules: PS streaming ClickFix campaign
- ANY.RUN analysis task 43a11b7e-d8b9-49b4-8408-02643568f94c
- Archive.org snapshot of the muha2xmad article
Detection coverage for TL-2026-4416
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4416 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4416
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.