# Corium: ClickFix Distribution and Campaign-Management Panel Advertised on Exploit.IN

> Hudson Rock reports Corium, a ClickFix distribution and campaign-management panel advertised by the user "Cassiopeia" on the Russian-language cybercrime forum Exploit.IN. It is a delivery platform, not an infostealer: it packages fake CAPTCHA / Windows Update / SmartScreen lures, multiple ClickFix execution methods and per-campaign analytics for buyers who supply their own payloads. Evasion claims are the seller's and are unverified.

- **Published:** 2026-11-09T09:48:22Z
- **Last reviewed:** 2026-11-09T09:48:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5538
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5538.png
- **ID:** TL-2026-5538
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Cassiopeia
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (3 shown free below)

## Description

Corium is described by Hudson Rock (INFOSTEALERS blog, 2026-11-09) as a ClickFix distribution and campaign-management platform, "not an infostealer family in its own right." The report is based solely on a forum advertisement and screenshots posted by the seller "Cassiopeia" on Exploit.IN. Hudson Rock did not validate the evasion claims, examine a working deployment, or tie any infection campaign to Corium. Pricing was not disclosed.

Panel functionality: operators upload an executable or ZIP archive (automatic ZIP extraction is claimed; the screenshots show a payload named Security.exe) and associate it with a campaign. The upload form exposes fields for a Windows Update-themed landing page, campaign name, traffic source, redirect URL, custom domain, Telegram chat ID and internal notes. Landing-page templates imitate Cloudflare Turnstile, Google reCAPTCHA, hCaptcha, Microsoft Defender SmartScreen warnings and a Windows Update prompt referencing KB5035238, with claimed automatic adaptation to screen resolution and light/dark themes.

Advertised ClickFix delivery methods: (1) Win+R Run dialog, with headless execution via conhost.exe or in-memory PowerShell variants; (2) Win+X to open a Windows terminal for longer commands; (3) Ctrl+L / FileFix address-bar abuse in Explorer or a browser; (4) the search-ms protocol to direct the user to a delivered file; (5) a CAPTCHA-triggered file download. The seller also advertises 14 ready-made DLL-hijacking variants built around trusted system executables, with portable source, build instructions and a callback that reports installations back to the panel. Claims of macOS support, polymorphic payloads and bypass of some endpoint warnings are unverified.

A one-line JavaScript embed overlays the fake verification on existing websites (WordPress, Joomla, OpenCart and Bitrix are named), as a CAPTCHA-style modal or full-screen overlay with optional background blur, triggered on page load, first click, a configurable delay or exit intent. Analytics cover page views, CAPTCHA clicks, executions, conversion rate, dwell time, OS/browser/country/language/resolution/referrer profiles, partner statistics links for traffic suppliers, and customizable Telegram alerts (campaign, file, source, browser, OS, IP, time).

Context: Sekoia (2026-09-21) documented Exvicy, another Exploit.IN-advertised ClickFix framework assessed as a copy of ErrTraffic. Hudson Rock's July 2026 Artlist case (compromised subdomain, EtherHiding injection, initial access via an infostealer-stolen WordPress credential) is explicitly NOT attributed to Corium. No CVEs, hashes, IPs or C2 infrastructure are published for Corium. Defensive focus: endpoint detection of user-initiated Win+R/Win+X/FileFix/search-ms execution chains, CMS integrity and script-injection monitoring, and monitoring for infostealer-exposed web admin credentials.

## MITRE ATT&CK

- T1659 Content Injection
- T1204.004 Malicious Copy and Paste
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1574.001 DLL
- T1036 Masquerading
- T1583.001 Domains
- T1608.001 Upload Malware
- T1608.004 Drive-by Target

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Corium ClickFix Win+R / Win+X Paste-and-Execute Shell Chain — Exploitation Phase** (`TL-2026-5538-SPL-001`)

Behavioural detection of the user-initiated ClickFix execution chain productised by the Corium panel (T1204.004): explorer.exe (Win+R Run dialog, address-bar paste) or WindowsTerminal.exe (Win+X) launching powershell.exe, cmd.exe, conhost.exe --headless, mshta.exe or curl.exe with download-cradle, encoded-command or hidden-window arguments. Fake CAPTCHA, SmartScreen and Windows Update (KB5035238) lures all end in this pattern.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1059.003
- **Data sources:** sysmon, windows_security_4688
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage="*\\explorer.exe" OR ParentImage="*\\WindowsTerminal.exe") (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\cmd.exe" OR Image="*\\conhost.exe" OR Image="*\\mshta.exe" OR Image="*\\curl.exe") (CommandLine="*-enc *" OR CommandLine="*-EncodedCommand*" OR CommandLine="*iex *" OR CommandLine="*iex(*" OR CommandLine="*Invoke-Expression*" OR CommandLine="*DownloadString*" OR CommandLine="*Invoke-WebRequest*" OR CommandLine="*iwr *" OR CommandLine="*curl *" OR CommandLine="*mshta http*" OR CommandLine="*--headless*" OR CommandLine="*-w hidden*" OR CommandLine="*-WindowStyle Hidden*") | eval threat="TL-2026-5538 Corium ClickFix Win+R/Win+X paste-and-execute" | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(Image) as shells by host, User, ParentImage, threat | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("explorer.exe", "WindowsTerminal.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "conhost.exe", "mshta.exe", "curl.exe")
| where ProcessCommandLine matches regex @"(?i)(-enc\s|-encodedcommand|\biex\b|invoke-expression|downloadstring|invoke-webrequest|\biwr\b|\bcurl\b|mshta(\.exe)?\s+https?://|--headless|-w(indowstyle)?\s+hidden)"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: Corium ClickFix Paste-and-Execute Shell Launched From Explorer or Windows Terminal
id: 3f6a1c52-8b7e-4d1a-9c34-5e2b7a901d11
status: experimental
description: Detects a shell or LOLBin spawned by explorer.exe (Win+R Run dialog, FileFix address bar) or WindowsTerminal.exe (Win+X) with download-cradle, encoded or hidden-window arguments, the execution chain advertised by the Corium ClickFix panel.
references:
    - https://www.infostealers.com/article/corium-a-new-clickfix-panel-shows-how-malware-delivery-is-becoming-a-turnkey-business/
    - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-09
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\WindowsTerminal.exe'
    selection_img:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\conhost.exe'
            - '\mshta.exe'
            - '\curl.exe'
    selection_cmd:
        CommandLine|contains:
            - '-enc '
            - '-EncodedCommand'
            - 'iex '
            - 'iex('
            - 'Invoke-Expression'
            - 'DownloadString'
            - 'Invoke-WebRequest'
            - 'iwr '
            - 'curl '
            - 'mshta http'
            - '--headless'
            - '-w hidden'
            - '-WindowStyle Hidden'
    condition: selection_parent and selection_img and selection_cmd
falsepositives:
    - Administrators launching scripted PowerShell or curl from the Run dialog or a terminal
    - Software installers or helpdesk tools launched interactively from Explorer that use encoded or hidden-window PowerShell
level: high

```

**Known false positives:**

- Administrators intentionally running scripted PowerShell or curl from the Run dialog or a terminal
- Interactive installers or helpdesk tooling that launch encoded or hidden-window PowerShell from Explorer

**Tuning notes:** Requires Sysmon EventCode 1 (or Security 4688 with command-line auditing) in index=sysmon; adjust index/sourcetype to your environment. Exclude known admin accounts and approved deployment scripts by User or CommandLine hash. Add Image names (wscript.exe, msiexec.exe, bitsadmin.exe) if your ClickFix telemetry shows them.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Corium search-ms: Protocol Used to Open Remote Location — Exploitation Phase (locked: unlock with TL Creds)
- Corium FileFix Ctrl+L Address-Bar Paste With Decoy Document-Path Comment (locked: unlock with TL Creds)
- ClickFix Ecosystem Infrastructure Contact — Exvicy C2 and Example Lure Domains Related to Corium (locked: unlock with TL Creds)
- Corium Headless conhost.exe Command Execution — Post-Click Execution (locked: unlock with TL Creds)
- Corium JavaScript Embed Planting via CMS Admin Edits — WordPress, Joomla, OpenCart, Bitrix (locked: unlock with TL Creds)
- Corium ClickFix Paste-and-Execute Artifacts in RunMRU and TypedPaths — Post-Exploitation Evidence (locked: unlock with TL Creds)
- Corium Payload Execution — [indicator] or ZIP-Extracted Binary From User-Writable Path (locked: unlock with TL Creds)
- Corium DLL-Hijacking Variant — Unsigned DLL Side-Loaded Beside Process in User-Writable Path (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 10)

Defanged, TLP:CLEAR.

- IP address: `94.26.90[.]126`
- Domain: `solaric[.]com[.]ph`
- IP address: `89.34.90[.]159`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Corium: A New ClickFix Panel Shows How Malware Delivery Is Becoming a Turnkey Business](https://www.infostealers.com/article/corium-a-new-clickfix-panel-shows-how-malware-delivery-is-becoming-a-turnkey-business/)
- [Exvicy: A copycat of the ErrTraffic malware distribution framework (Sekoia)](https://www.sekoia.com/blog/exvicy-a-copycat-of-the-errtraffic-malware-distribution-framework)
- [New Exvicy ClickFix Framework Built on Rival ErrTraffic's Code (Infosecurity Magazine)](https://www.infosecurity-magazine.com/news/exvicy-clickfix-framework/)
- [How an Infostealer Infection Led to a Sophisticated ClickFix Campaign at Artlist (Hudson Rock)](https://www.infostealers.com/article/how-an-infostealer-infection-led-to-a-sophisticated-clickfix-campaign-at-artlist/)
- [Introducing Cavalier's New Threat Feeds: Deep Dive into ClickFix Monitoring (Hudson Rock)](https://www.infostealers.com/article/introducing-cavaliers-new-threat-feeds-deep-dive-into-clickfix-monitoring/)
- [Think Before You Click(Fix): Analyzing the ClickFix Social Engineering Technique (Microsoft Threat Intelligence)](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [Security Brief: ClickFix Social Engineering Technique Floods Threat Landscape (Proofpoint)](https://www.proofpoint.com/us/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape)
- [Don't Sweat the ClickFix Techniques (Huntress)](https://www.huntress.com/blog/dont-sweat-clickfix-techniques)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5538