ClickFix Campaign via Microsoft Lookalike Domain (login.microsoftofice.cz) Targeting Czech Company with Unnamed PureBasic/Batch RAT

Key facts for PureBasic ClickFix RAT

Detection coverage for PureBasic ClickFix RAT

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5163 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Run-Dialog Command Pulling Payload via curl (login.microsoftofice.cz / kupujto.unas.cz)

Detects the TL-2026-5163 ClickFix delivery chain: after the victim pastes the clipboard command into Win+R, explorer.exe spawns cmd.exe/PowerShell that runs curl against login.microsoftofice.cz, kupujto.unas.cz/hereissomeinterest, the lokopoko.php username beacon, Windows_Repair.zip, 7za.png, the C:\Drivers etwork\FDOR123D staging directory or the Czech 'Nejsem ROBOT' padding string. Behaviour-first: the explorer-parent shell running curl is the core signal, the IOC strings raise fidelity.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.003, T1105
• Data sources: Sysmon EventCode 1 (index=endpoint, sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational), Microsoft Defender for Endpoint DeviceProcessEvents, Windows process_creation (Sigma)
• Severity: high
• Confidence: high

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
```TL-2026-5163 ClickFix: Win+R paste means explorer.exe is the parent of the shell that pulls the payload with curl```
| where match(ParentImage, "(?i)\\\\explorer[.]exe$")
| where match(Image, "(?i)\\\\(cmd|powershell|pwsh|mshta)[.]exe$")
| where match(CommandLine, "(?i)curl")
| where match(CommandLine, "(?i)(microsoftofice[.]cz|kupujto[.]unas[.]cz|lokopoko[.]php|windows_repair[.]zip|7za[.]png|hereissomeinterest|fdor123d|nejsem[ ]+robot)")
| table _time host User ParentImage Image CommandLine

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe")
| where ProcessCommandLine has "curl"
| where ProcessCommandLine has_any ("microsoftofice.cz", "kupujto.unas.cz", "lokopoko.php", "Windows_Repair.zip", "7za.png", "hereissomeinterest", "FDOR123D", "Nejsem ROBOT")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

Sigma

title: ClickFix Run Dialog Command Pulling Payload via curl - TL-2026-5163
id: 7c1e4a52-3b0d-4f6a-9d21-5a8e0c3f7b11
status: experimental
description: Detects a shell spawned by explorer.exe (Win+R paste) running curl against the TL-2026-5163 lookalike and staging infrastructure or staging paths.
references:
  - https://flare.io/learn/resources/blog/microsoft-lookalike-domain-clickfix-campaign
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.003
  - attack.command-and-control
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_shell:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
  selection_curl:
    CommandLine|contains: 'curl'
  selection_ioc:
    CommandLine|contains:
      - 'microsoftofice.cz'
      - 'kupujto.unas.cz'
      - 'lokopoko.php'
      - 'Windows_Repair.zip'
      - '7za.png'
      - 'hereissomeinterest'
      - 'FDOR123D'
      - 'Nejsem ROBOT'
  condition: selection_parent and selection_shell and selection_curl and selection_ioc
falsepositives:
  - Administrators pasting curl commands into Win+R against internal or legitimate download hosts (will not match the IOC strings)
level: high

Known false positives:

• Administrators or helpdesk staff pasting a curl download command into the Run dialog for a legitimate internal tool (only matches if the command also contains one of the campaign IOC strings)
• Security awareness or red-team exercises that replay the ClickFix command chain

Tuning notes: Keep the IOC alternation current as new staging hosts appear. To hunt the technique generically, drop the final IOC where-clause and baseline explorer.exe -> cmd/powershell -> curl for your estate, then allowlist known admin accounts. Requires Sysmon process-creation with command line (EventCode 1) or MDE.

• 🔒 ClickFix Pasted Command Recorded in RunMRU ('Nejsem ROBOT' padding) · unlock with TL Creds
• 🔒 Microsoft Aggregator SubHost Startup Folder Persistence Shortcut · unlock with TL Creds
• 🔒 Batch RAT Execution and Beacon Behaviour ([indicator] / tst.bat, curl Egress Test, Proxy Registry Probe) · unlock with TL Creds
• 🔒 DNS Resolution of [indicator] Lookalike and [indicator] Staging Host · unlock with TL Creds
• 🔒 Masquerading PureBasic Loaders (RuntimeBroker.exe / Microsoft Aggregator SubHost.exe) and finish.vbs Decoy · unlock with TL Creds
• 🔒 Scripted or Masquerading Process Connecting to ClickFix Staging and C2 Infrastructure · unlock with TL Creds
• 🔒 Renamed 7-Zip (7za.exe) Extracting Password-Protected Windows_Repair.zip · unlock with TL Creds
• 🔒 Web Proxy Traffic to octopuspush C2 Paths and ClickFix Delivery Infrastructure · unlock with TL Creds

Indicators of compromise for PureBasic ClickFix RAT

As of 2026-11-03, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-5163.

Sample indicators (3 of 26)

• IP address: 209.38.249[.]166
• Domain: microsoftofice[.]cz
• File hash: bcd389ba3926c573a8002c2cc8cc8d07a38c346928d7322f5e080b5c2c447bee

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How PureBasic ClickFix RAT works

No threat actor is attributed.

Flare's Emerging Threats Team (Assaf Morag) analyzed a Microsoft lookalike domain, microsoftofice.cz (registered October 2025, with an SSL certificate for login.microsoftofice.cz seen in Certificate Transparency logs on 2025-11-25), flagged by Flare Lookalike Domain Monitoring. The root domain serves a default Apache page and is configured for Microsoft 365 mail (MX, SPF, verification records), while the malicious content is served only from the 'login' subdomain (delivery server 209.38.249.166, DigitalOcean, Apache/2.4.68 Debian). The campaign is targeted at a specific, named Czech company: the lure and the follow-on dialog box are in Czech and impersonate that company's IT department.

Initial access is ClickFix (T1204.004). The lure page https://login.microsoftofice.cz/runner.html shows a fake human-verification prompt and uses navigator.clipboard.writeText() to place a malicious command on the clipboard. The victim is told to press Win+R, paste and run it, and a redirect to a success page follows about 25 seconds after the button click. Flare notes the pasted command is padded with Czech 'Nejsem ROBOT' text, which leaves a hunting artifact in the RunMRU registry key. The command creates the staging directory C:\Drivers\network\FDOR123D\, contacts https://login.microsoftofice.cz/lokopoko.php?name=<Windows username> (leaking the victim username), and uses curl to download Windows_Repair.zip (AES-encrypted, password 'Lopata') and a genuine 7-Zip 25.01 binary delivered as 7za.png from kupujto.unas.cz/hereissomeinterest/ (a free Webzdarma.cz hosting platform, 185.64.219.6, VSHosting s.r.o.). 7za.png is renamed to 7za.exe and used to extract the archive. A shortcut, 'Microsoft Aggregator SubHost.lnk', is copied to the user's Startup folder for persistence, and finish.vbs is run through wscript.exe to show a Czech-language IT-department decoy dialog.

The RAT is made of two native 32-bit PureBasic loaders, both UPX-packed (RuntimeBroker.exe, 23,040 bytes packed, and Microsoft Aggregator SubHost.exe, 22,016 bytes packed). Each extracts an embedded batch script from its resource section, writes it to disk (runner.bat and tst.bat respectively) and runs it via ShellExecuteExA. The packed samples had no VirusTotal detections, while the unpacked samples were detected by 26 engines each. runner.bat is the executor: it reads the first line of comm.txt, runs it, writes stdout to input.txt, and refuses to run unless pasec.txt contains the exact string 'lodyha'. This execution guardrail means sandbox or VirusTotal runs without the matching passphrase execute nothing. tst.bat is the beacon. After a 10-second delay it tests egress with 'curl -s -k -I http://www.google.cz', and on failure falls back to the static proxy read from HKCU\...\Internet Settings (ProxyEnable/ProxyServer; no PAC, WPAD or proxy authentication support). It fingerprints the host (%COMPUTERNAME%|%USERNAME%|date|time) and obfuscates the data by inserting a random 2-digit value after every 3 characters, with the stride appended. It POSTs this to pages.php, polls name.html for a target selector (a single COMPUTERNAME or USERNAME, or 'universal'; the observed value was 'nic'), polls comm.html about every 5 seconds for commands, runs them via runner.bat, and POSTs output to pages2.php. The C2 base URL (https://kupujto.unas.cz/hereissomeinterest/octopuspush/) is stored in hehe.txt. The LNK tracker block recovered the build machine name desktop-hoe0aar.

Flare suspects an unidentified second stage and recommends reimaging rather than cleaning. The sector of the targeted company is not stated, and no actor attribution is made. Czech-language strings ('Lopata', 'HLEDAM', 'nalezeno', 'nic', 'Nejsem ROBOT') suggest a Czech-speaking operator, but this is Flare's inference, not an attribution. Severity HIGH is an analyst judgment (targeted delivery, interactive RAT capability), not a source-stated figure.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027.002 Software Packing; T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1036.008 Masquerade File Type; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails

Execution

T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1106 Native API; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1090 Proxy

Discovery

T1082 System Information Discovery

Persistence

T1547.001 Registry Run Keys / Startup Folder

Remediation for PureBasic ClickFix RAT

Immediate actions

• Block DNS and web access to microsoftofice.cz, login.microsoftofice.cz and kupujto.unas.cz; block 209.38.249.166 and 185.64.219.6 where business use allows
• Search proxy logs (decrypting TLS where possible) for lokopoko.php, pages.php, pages2.php, name.html and comm.html requests and for /hereissomeinterest/octopuspush/ to identify affected users
• Hunt endpoints for C:\Drivers\network\FDOR123D\, the 'Microsoft Aggregator SubHost.lnk' Startup shortcut, RuntimeBroker.exe outside C:\Windows\System32\, and randomly named executables in C:\Windows\
• Review HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU for pasted commands (including 'Nejsem ROBOT' padding)
• Reimage confirmed-affected hosts rather than cleaning, since an unidentified second stage is suspected; reset credentials for affected users

Workarounds

• Restrict the Run dialog via Group Policy (NoRun) for non-administrative users
• Apply web-proxy category or newly-registered-domain blocking for lookalike domains

Longer-term hardening

• Train users that no legitimate website asks them to paste commands into the Run dialog
• Monitor new .cz and other ccTLD registrations that mimic your brands and Microsoft services (lookalike domain monitoring)
• Alert on process chains such as explorer.exe -> cmd.exe running curl, and on 7za.exe running from user-writable paths
• Alert on Startup folder modifications and block execution from non-standard paths such as C:\Drivers\ and user directories
• Restrict or monitor curl.exe where it is not required, and consider disabling the Win+R Run dialog for users who do not need it

Affected and fixed versions

• Microsoft — Windows (end-user workstations; Microsoft 365 brand impersonated)
  Vulnerable versions: Windows systems where the user runs the pasted Run-dialog command

Timeline of PureBasic ClickFix RAT

• 2025-10-01 Lookalike domain locked-ioc-19 registered (Flare states October 2025; exact day not given, date shown is the month start). Registrar REG-INTERNET-CZ, nameservers at FORPSI, Microsoft 365 MX/SPF records configured.
• 2025-11-25 SSL certificate for locked-ioc-18 appears in Certificate Transparency logs, indicating the malicious subdomain was provisioned.
• 2026-07-01 Flare Lookalike Domain Monitoring flags the domain (Flare dates this to Q3 2026; exact day not given, date shown is the quarter start), months before reputation services flagged it.
• 2026-11-03 Report ingested into the Threadlinqs platform as TL-2026-5163; no threat actor attributed and no CVE involved.
• 2026-11-03 Flare's analysis documents the delivery server locked-ioc-21 (Apache/2.4.68 Debian, DigitalOcean) and the staging host locked-ioc-20 (locked-ioc-22, VSHosting) still serving the lure, payload archive and C2 paths (/hereissomeinterest/locked-ioc-23/); Flare recommends reimaging affected hosts because a second stage is suspected.
• 2026-11-03 At time of Flare's publication the UPX-packed RuntimeBroker.exe and Microsoft Aggregator SubHost.exe loaders had no VirusTotal detections, while the unpacked versions were detected by 26 engines each; the locked-ioc-25 'lodyha' guardrail also means sandbox runs without the passphrase execute nothing.
• 2026-11-03 Flare publishes technical analysis of the ClickFix chain, the PureBasic/batch RAT and the full IOC set.

Sources cited for PureBasic ClickFix RAT

• Flare Lookalike Domain Monitoring flare.io · Vendor report
• MITRE ATT&CK T1204.004 - User Execution: Malicious Copy and Paste MITRE · Research
• MITRE ATT&CK T1480 - Execution Guardrails MITRE · Research
• MITRE ATT&CK T1027.002 - Obfuscated Files or Information: Software Packing MITRE · Research
• MITRE ATT&CK T1036.008 - Masquerading: Masquerade File Type MITRE · Research
• Inside a Microsoft Lookalike Domain Masquerading as Czech Company's IT Department Infrastructure (Flare, Assaf Morag) flare.io · Blog · 2026-11-03

More in malware

• Fake-download campaign uses trojanized Inno Setup installers to deliver monetization payloads (WorldProxyPool, CharityEngine/BOINC, AW Manager)
• Evolution of C2 Infrastructure: Blockchain-Based (On-Chain) C2 and EtherHiding Adoption by UNC5142, UNC5342 and Commodity Malware (Tsundere, SleepyDuck, SharkStealer)
• ClickFix: Fake CAPTCHA/Verification Prompts Deliver Stealers, Loaders and RATs (DeerStealer, HijackLoader, AMOS, NetSupport RAT, WeaselStore)
• Certified Bad: Abuse of Extended Validation Code-Signing Certificates Shared Across Malware Families (SolarMarker et al.)
• Impostor Certificates: Threat Actors Impersonating Businesses to Obtain Code-Signing Certificates for SolarMarker and Other Malware