# Arabic Streaming Websites ClickFix Campaign (MyCima, WeCima, EgyBest, Shahid4u, Cima4U, Moviz)

> Typosquatted Arabic streaming sites fingerprint visitors with JavaScript, route them through traffic distribution systems (TDS) to ClickFix pages, and trick them into pasting clipboard commands into PowerShell or CMD. The commands pull multi-stage payloads (PowerShell scripts, an MSI installer, executables). The source names no malware family and no threat actor.

- **Published:** 2026-10-24T21:13:36Z
- **Last reviewed:** 2026-10-24T21:13:36Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4416
- **ID:** TL-2026-4416
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Research published 2026-10-06 by muha2xmad describes a ClickFix social-engineering campaign aimed at users of Arabic-language streaming platforms. The actors register typosquatted and look-alike domains for MyCima (mycima.party, mycima.fast), WeCima (wecimaa.cam, wecimaa.cyou), EgyBest (egybest.life, w1.egybest.land, egybest.fast, egybest.ltd), Shahid4u (shahid4u.blog, shahed4u.you, shhahid4u.diy), Cima4U (cima4u14.shop, cima4u.help, cima4p.co) and Moviz (moviz-time.pro, movizwap.surf, moviz-story.online, movizlaand.top, moviz-time.one).

Visiting a lure site loads JavaScript that collects browser telemetry (user agent, screen and window size, device pixel ratio, timezone, connection effectiveType, iframe and focus state, bot-detection fields) and sends it as Base64-encoded JSON to a profiling endpoint (cf.quickbase.icu/api/v1/px2). Visitors who pass the checks are redirected through a TDS (for example mangafantasyrealm.cfd/indexacrtbt3.php) to a ClickFix landing page. Landing domains include galacticflowtech.lol, galaxyflowsystems.lol, pulsarflowtech.lol, cinemadataflow.cfd, cloudflare.vc and cloudflare.bz. Several are fronted by Cloudflare, and cloudflare.vc resolves to 94.103.1.233 and 31.76.252.130, hosted at dhost.su (Russian). The page shows a fake CAPTCHA, verification or error prompt that places a command on the clipboard and tells the victim to paste and run it.

The source documents several command variants. (1) A PowerShell download to %TEMP%\zpppne.ps1 from nebuladatastream.lol, run with -ep bypass. (2) iex(irm ...) from imagedrah.com using a custom 'WUA/...' User-Agent and an 'X-WUA' header. (3) A decimal-encoded IP (1450003207, which is 86.109.75.7) used to fetch a script to %TEMP%\1451.ps1. (4) A CMD character-index cipher that rebuilds a command from a lookup string. The cipher decodes to a hidden-window powershell.exe -enc command, which downloads an MSI from the decimal IP 2549127135 (151.240.151.223) as u.msi and installs it silently with msiexec /i u.msi /qn MSIINSTALLPERUSER=1. The source also lists a 7z archive, an executable with a random name and an executable disguised as a Windows update (update-KB4703886.exe).

Attribution and payload family: the source states no actor and, in the fetched text, no malware family. The Malpedia entry tags DCRat and Ave Maria (WarZoneRAT), but that tagging is not confirmed by the article and no family is asserted here. Victim counts and exploitation scope are not stated. The article lists many look-alike phishing domains (banking, SaaS and retail brands) seen on the same infrastructure; these are listed in the source but are not tied to this campaign's payload chain. The source also lists a very large number of ATT&CK technique IDs, such as credential dumping and data destruction. Only techniques supported by the documented chain are mapped here. One PowerShell script hash in the source was truncated and is excluded from the IOCs. Defenders should hunt for clipboard-pasted PowerShell and CMD, Invoke-WebRequest/irm to decimal-IP hosts, hidden-window encoded PowerShell, and per-user msiexec quiet installs from %TEMP%.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1218.007 System Binary Proxy Execution: Msiexec
- T1036 Masquerading
- T1583.001 Acquire Infrastructure: Domains

## Sources

- [Arabic Streaming Websites ClickFix Campaign (muha2xmad)](https://muha2xmad.github.io/threat-intelligence/streaming-clickfix-campaign/)
- [Malpedia library entry: Arabic Streaming Websites ClickFix Campaign](https://malpedia.caad.fkie.fraunhofer.de/library/87004d54-d2af-4d4a-b540-305eb1800ff7/)
- [muha2xmad IOCs repository: arabic streaming clickfix campaign](https://github.com/muha2xmad/IOCs/tree/main/arabic%20streaming%20clickfix%20campaign)
- [muha2xmad Sigma rules: PS streaming ClickFix campaign](https://github.com/muha2xmad/Sigma-Rules/tree/main/PS%20streaming%20ClickFix%20campaign)
- [ANY.RUN analysis task 43a11b7e-d8b9-49b4-8408-02643568f94c](https://app.any.run/tasks/43a11b7e-d8b9-49b4-8408-02643568f94c/)
- [Archive.org snapshot of the muha2xmad article](http://web.archive.org/web/20261012101441/https://muha2xmad.github.io/threat-intelligence/streaming-clickfix-campaign/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4416