Skip to navigation

Threat reportMalwareTL-2026-5538

Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.IN

mediumACTIVE

Hudson Rock reports Corium, a ClickFix distribution and campaign-management panel advertised by the user "Cassiopeia" on the Russian-language cybercrime forum Exploit.IN. It is a delivery platform, not an infostealer: it packages fake CAPTCHA / Windows Update / SmartScreen lures, multiple ClickFix execution methods and per-campaign analytics for buyers who supply their own payloads.

Key facts for Corium ClickFix panel

IdentifiersTL-2026-5538
Also known asCorium panel
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsMicrosoft Windows (Run dialog, Windows Terminal, File Explorer, search-ms protocol); Various WordPress, Joomla, OpenCart and Bitrix websites (JavaScript embed injection targets)
AttributionCassiopeia (low confidence)
MalwareCorium
ToolsErrTraffic, Exvicy
MITRE ATT&CK techniquesT1036 Masquerading, T1059.001 PowerShell, T1059.003 Windows Command Shell, T1204.002 Malicious File, T1204.004 Malicious Copy and Paste, T1574.001 DLL, T1583.001 Domains, T1608.001 Upload Malware, T1608.004 Drive-by Target, T1659 Content Injection
MotivationFINANCIAL
Target sectorscross-sector
Target regionsGlobal
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for Corium ClickFix panel

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5538 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Corium ClickFix Win+R / Win+X Paste-and-Execute Shell Chain — Exploitation Phase

Behavioural detection of the user-initiated ClickFix execution chain productised by the Corium panel (T1204.004): explorer.exe (Win+R Run dialog, address-bar paste) or WindowsTerminal.exe (Win+X) launching powershell.exe, cmd.exe, conhost.exe --headless, mshta.exe or curl.exe with download-cradle, encoded-command or hidden-window arguments. Fake CAPTCHA, SmartScreen and Windows Update (KB5035238) lures all end in this pattern.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.004, T1059.001, T1059.003
  • Data sources: sysmon, windows_security_4688
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*\\explorer.exe" OR ParentImage="*\\WindowsTerminal.exe") (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\conhost.exe" OR Image="*\\mshta.exe" OR Image="*\\curl.exe") (CommandLine="*-enc *" OR CommandLine="*-EncodedCommand*" OR CommandLine="*iex *" OR CommandLine="*iex(*" OR CommandLine="*Invoke-Expression*" OR CommandLine="*DownloadString*" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*iwr *" OR CommandLine="*curl *" OR CommandLine="*mshta http*" OR CommandLine="*--headless*" OR CommandLine="*-w hidden*" OR CommandLine="*-WindowStyle Hidden*") | eval threat="TL-2026-5538 Corium ClickFix Win+R/Win+X paste-and-execute" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as shells by host, User, ParentImage, threat | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "WindowsTerminal.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "conhost.exe", "mshta.exe", "curl.exe")
| where ProcessCommandLine matches regex @"(?i)(-enc\s|-encodedcommand|\biex\b|invoke-expression|downloadstring|invoke-webrequest|\biwr\b|\bcurl\b|mshta(\.exe)?\s+https?://|--headless|-w(indowstyle)?\s+hidden)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: Corium ClickFix Paste-and-Execute Shell Launched From Explorer or Windows Terminal
id: 3f6a1c52-8b7e-4d1a-9c34-5e2b7a901d11
status: experimental
description: Detects a shell or LOLBin spawned by explorer.exe (Win+R Run dialog, FileFix address bar) or WindowsTerminal.exe (Win+X) with download-cradle, encoded or hidden-window arguments, the execution chain advertised by the Corium ClickFix panel.
references:
    - https://www.infostealers.com/article/corium-a-new-clickfix-panel-shows-how-malware-delivery-is-becoming-a-turnkey-business/
    - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\WindowsTerminal.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\conhost.exe'
            - '\mshta.exe'
            - '\curl.exe'
    selection_cmd:
        CommandLine|contains:
            - '-enc '
            - '-EncodedCommand'
            - 'iex '
            - 'iex('
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'curl '
            - 'mshta http'
            - '--headless'
            - '-w hidden'
            - '-WindowStyle Hidden'
    condition: selection_parent and selection_img and selection_cmd
falsepositives:
    - Administrators launching scripted PowerShell or curl from the Run dialog or a terminal
    - Software installers or helpdesk tools launched interactively from Explorer that use encoded or hidden-window PowerShell
level: high

Known false positives:

  • Administrators intentionally running scripted PowerShell or curl from the Run dialog or a terminal
  • Interactive installers or helpdesk tooling that launch encoded or hidden-window PowerShell from Explorer

Tuning notes: Requires Sysmon EventCode 1 (or Security 4688 with command-line auditing) in index=sysmon; adjust index/sourcetype to your environment. Exclude known admin accounts and approved deployment scripts by User or CommandLine hash. Add Image names (wscript.exe, msiexec.exe, bitsadmin.exe) if your ClickFix telemetry shows them.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Corium search-ms: Protocol Used to Open Remote Location — Exploitation Phase · unlock with TL Creds
  • Corium FileFix Ctrl+L Address-Bar Paste With Decoy Document-Path Comment · unlock with TL Creds
  • ClickFix Ecosystem Infrastructure Contact — Exvicy C2 and Example Lure Domains Related to Corium · unlock with TL Creds
  • Corium Headless conhost.exe Command Execution — Post-Click Execution · unlock with TL Creds
  • Corium JavaScript Embed Planting via CMS Admin Edits — WordPress, Joomla, OpenCart, Bitrix · unlock with TL Creds
  • Corium ClickFix Paste-and-Execute Artifacts in RunMRU and TypedPaths — Post-Exploitation Evidence · unlock with TL Creds
  • Corium Payload Execution — [indicator] or ZIP-Extracted Binary From User-Writable Path · unlock with TL Creds
  • Corium DLL-Hijacking Variant — Unsigned DLL Side-Loaded Beside Process in User-Writable Path · unlock with TL Creds

Indicators of compromise for Corium ClickFix panel

As of 2026-11-09, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-5538.

Sample indicators (3 of 10)

  • IP address: 94.26.90[.]126
  • Domain: solaric[.]com[.]ph
  • IP address: 89.34.90[.]159

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

10 indicators of compromise · unlock with TL Creds. Compare plans

How Corium ClickFix panel works

Evasion claims are the seller's and are unverified.

Corium is described by Hudson Rock (INFOSTEALERS blog, 2026-11-09) as a ClickFix distribution and campaign-management platform, "not an infostealer family in its own right." The report is based solely on a forum advertisement and screenshots posted by the seller "Cassiopeia" on Exploit.IN. Hudson Rock did not validate the evasion claims, examine a working deployment, or tie any infection campaign to Corium. Pricing was not disclosed.

Panel functionality: operators upload an executable or ZIP archive (automatic ZIP extraction is claimed; the screenshots show a payload named Security.exe) and associate it with a campaign. The upload form exposes fields for a Windows Update-themed landing page, campaign name, traffic source, redirect URL, custom domain, Telegram chat ID and internal notes. Landing-page templates imitate Cloudflare Turnstile, Google reCAPTCHA, hCaptcha, Microsoft Defender SmartScreen warnings and a Windows Update prompt referencing KB5035238, with claimed automatic adaptation to screen resolution and light/dark themes.

Advertised ClickFix delivery methods: (1) Win+R Run dialog, with headless execution via conhost.exe or in-memory PowerShell variants; (2) Win+X to open a Windows terminal for longer commands; (3) Ctrl+L / FileFix address-bar abuse in Explorer or a browser; (4) the search-ms protocol to direct the user to a delivered file; (5) a CAPTCHA-triggered file download. The seller also advertises 14 ready-made DLL-hijacking variants built around trusted system executables, with portable source, build instructions and a callback that reports installations back to the panel. Claims of macOS support, polymorphic payloads and bypass of some endpoint warnings are unverified.

A one-line JavaScript embed overlays the fake verification on existing websites (WordPress, Joomla, OpenCart and Bitrix are named), as a CAPTCHA-style modal or full-screen overlay with optional background blur, triggered on page load, first click, a configurable delay or exit intent. Analytics cover page views, CAPTCHA clicks, executions, conversion rate, dwell time, OS/browser/country/language/resolution/referrer profiles, partner statistics links for traffic suppliers, and customizable Telegram alerts (campaign, file, source, browser, OS, IP, time).

Context: Sekoia (2026-09-21) documented Exvicy, another Exploit.IN-advertised ClickFix framework assessed as a copy of ErrTraffic. Hudson Rock's July 2026 Artlist case (compromised subdomain, EtherHiding injection, initial access via an infostealer-stolen WordPress credential) is explicitly NOT attributed to Corium. No CVEs, hashes, IPs or C2 infrastructure are published for Corium. Defensive focus: endpoint detection of user-initiated Win+R/Win+X/FileFix/search-ms execution chains, CMS integrity and script-injection monitoring, and monitoring for infostealer-exposed web admin credentials.

MITRE ATT&CK techniques by tactic:

Stealth

T1036 Masquerading

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204.002 Malicious File; T1204.004 Malicious Copy and Paste

stealth

T1574.001 DLL

Resource Development

T1583.001 Domains; T1608.001 Upload Malware; T1608.004 Drive-by Target

Initial Access

T1659 Content Injection

Remediation for Corium ClickFix panel

Immediate actions

  • Alert on explorer.exe/browser-parented launches of powershell.exe, cmd.exe, conhost.exe --headless, wt.exe or mshta.exe shortly after a Win+R, Win+X or address-bar paste
  • Alert on search-ms: protocol URIs launched from browsers or the Run dialog
  • Audit WordPress, Joomla, OpenCart and Bitrix sites for unauthorized script injections and unexpected admin changes
  • Reset WordPress, hosting and admin credentials that appear in infostealer logs

Workarounds

  • Block clipboard-to-terminal execution paths via endpoint policy
  • Review DLL search-order and side-loading exposure of trusted signed executables run from user-writable paths

Longer-term hardening

  • Restrict or log the Run dialog and Win+X terminal via Group Policy / AppLocker / WDAC where business needs allow
  • Enable PowerShell script block and module logging and command-line process auditing
  • Deploy subresource integrity and a strict Content-Security-Policy on owned websites
  • Train users that legitimate CAPTCHA challenges never require running terminal commands or installing software
  • Correlate web intelligence, endpoint telemetry and credential-exposure feeds

Affected and fixed versions

  • Microsoft — Windows (Run dialog, Windows Terminal, File Explorer, search-ms protocol)
    Vulnerable versions: Social-engineering technique; no specific vulnerable version
  • Various — WordPress, Joomla, OpenCart and Bitrix websites (JavaScript embed injection targets)
    Vulnerable versions: Sites with compromised admin access or injected scripts

Timeline of Corium ClickFix panel

  • Microsoft Threat Intelligence publishes analysis of the ClickFix social-engineering technique, the baseline locked-ioc-9 productizes.
  • Related framework locked-ioc-10 is first advertised on locked-ioc-7 as a rentable ClickFix panel (per Sekoia).
  • Hudson Rock publishes the Artlist case: a compromised subdomain served a fake CAPTCHA via EtherHiding after an infostealer-exposed WordPress credential; stated as not attributed to locked-ioc-9.
  • Hudson Rock details Cavalier ClickFix Monitoring threat feeds (introduced July 2026).
  • Sekoia publishes locked-ioc-10 analysis, assessing it as a copy of the locked-ioc-8 ClickFix framework.
  • Hudson Rock states it did not verify the evasion claims, examine a working deployment or attribute any infection campaign to locked-ioc-9.
  • Hudson Rock publishes its report on locked-ioc-9, advertised on locked-ioc-7 by user locked-ioc-6 (advertisement dated November 2026).

Sources cited for Corium ClickFix panel

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats