ClickFix Attacks Evolve: Malware Hidden in PNG Images and Windows Domain Controller Compromise (Huntress)

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5754 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Persistence: Scheduled Task and Run Key With Known Names or User-Writable Payloads

Detects persistence used across the TL-2026-5754 chains: scheduled tasks and Run-key values named CertEnrollCtrl_Y0db6oZq9, LockScreenContentServer_qQrRrJiHX, SysyService, Application Maintenance or DuskDesk, and generic schtasks /create or Run-key writes that launch payloads from ProgramData, AppData or Temp.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1053.005, T1547.001
• Data sources: sysmon, DeviceProcessEvents, DeviceRegistryEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=13) earliest=-24h
| eval blob=lower(coalesce(CommandLine,"")." ".coalesce(TargetObject,"")." ".coalesce(Details,""))
| eval ioc_hit=if(match(blob,"certenrollctrl_y0db6ozq9|lockscreencontentserver_qqrrrjihx|sysyservice|application maintenance|duskdesk"),1,0)
| eval task_create=if(EventCode=1 AND match(lower(Image),".schtasks[.]exe$") AND match(blob,"/create") AND match(blob,"programdata|appdata|.temp.|powershell|[.]bat|[.]ps1"),1,0)
| eval run_key=if(EventCode=13 AND match(lower(TargetObject),"currentversion.run") AND match(lower(Details),"programdata|appdata|.temp.|node[.]exe|powershell"),1,0)
| where ioc_hit=1 OR task_create=1 OR run_key=1
| eval persistence_type=case(task_create=1,"scheduled_task",run_key=1,"run_key",true(),"named_artifact")
| stats count min(_time) as first_seen max(_time) as last_seen values(persistence_type) as types values(CommandLine) as commands values(TargetObject) as run_keys values(Details) as run_values by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let ioc_names = dynamic(["CertEnrollCtrl_Y0db6oZq9","LockScreenContentServer_qQrRrJiHX","SysyService","Application Maintenance","DuskDesk"]);
let tasks = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | where ProcessCommandLine has_any (ioc_names) or ProcessCommandLine has_any ("ProgramData", "AppData", "\\Temp\\", "powershell", ".bat", ".ps1")
    | project Timestamp, DeviceName, AccountName, Signal = "scheduled_task_create", Detail = ProcessCommandLine, Parent = InitiatingProcessFileName;
let runkeys = DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where ActionType == "RegistryValueSet" and RegistryKey matches regex @"(?i)currentversion.run"
    | where RegistryValueName has_any (ioc_names) or RegistryValueData has_any ("ProgramData", "AppData", "\\Temp\\", "node.exe", "powershell")
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Signal = "run_key_set", Detail = strcat(RegistryValueName, "=", RegistryValueData), Parent = InitiatingProcessFileName;
union tasks, runkeys
| order by Timestamp desc

Sigma

title: ClickFix Scheduled Task Persistence With Known Task Names or User-Writable Payload Paths
id: 7b2e9d14-3c5a-4f08-a6d3-91e4c2b80f02
status: experimental
description: Detects schtasks /create for the task names reported in TL-2026-5754 (CertEnrollCtrl_Y0db6oZq9, LockScreenContentServer_qQrRrJiHX, SysyService, Application Maintenance, DuskDesk) or tasks whose action runs from ProgramData, AppData or Temp via PowerShell or batch files. Run-key persistence is covered in the SPL and KQL forms.
references:
    - https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix
    - https://attack.mitre.org/techniques/T1053/005/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.t1547.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_names:
        CommandLine|contains:
            - 'CertEnrollCtrl_Y0db6oZq9'
            - 'LockScreenContentServer_qQrRrJiHX'
            - 'SysyService'
            - 'Application Maintenance'
            - 'DuskDesk'
    selection_paths:
        CommandLine|contains:
            - '\ProgramData\'
            - '\AppData\'
            - '\Temp\'
    selection_launcher:
        CommandLine|contains:
            - 'powershell'
            - '.bat'
            - '.ps1'
    condition: selection_img and (selection_names or (selection_paths and selection_launcher))
falsepositives:
    - Software installers that register updater tasks pointing at ProgramData or AppData
    - Administrators creating maintenance tasks that call PowerShell scripts
level: high

Known false positives:

• Installers and updaters (browsers, collaboration clients) that register tasks or Run values under AppData
• Administrator scripts creating scheduled maintenance tasks with PowerShell actions

Tuning notes: Named-artifact matches are near-zero false positive; keep the generic path branch at medium priority and allowlist known updater task names. Requires Sysmon EventCode 13 for Run key writes. 'Application Maintenance' is a generic name and should be correlated with a ProgramData payload path.

• 🔒 ClickFix PNG Steganography Stager and Signed-Binary DLL Sideload From ProgramData · unlock with TL Creds
• 🔒 ClickFix Post-Exploitation: AD Reconnaissance and Rogue Admin Account Creation · unlock with TL Creds
• 🔒 ClickFix Lateral Movement: WinRM, PsExec and SMBExec Toward Domain Controllers · unlock with TL Creds
• 🔒 ClickFix MSI Delivery: Silent Msiexec From URL and Pcalua-Proxied Mshta · unlock with TL Creds
• 🔒 Microsoft Defender Tampering: Exclusions, Feature Disablement and WinDefend Stop · unlock with TL Creds
• 🔒 DuskDesk Node.js RAT: Implant Execution, C2 Beacon and Run-Key Persistence · unlock with TL Creds
• 🔒 ClickFix Paste-and-Run Shell Launched From Explorer, Browser or Terminal · unlock with TL Creds
• 🔒 ClickFix C2: Reverse SSH Tunnels, Chisel SOCKS and Known Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 41 indicators of compromise for TL-2026-5754.

Sample indicators (3 of 41)

• IP address: 23.227.199[.]41
• Domain: westlaw-signon[.]com
• URL: hxxps://vvestalw[.]ghost[.]io/

Defanged, TLP:CLEAR. Full set of 41 indicators: unlock with TL Creds.

Technical analysis

Huntress (blog dated 2026-11-10, 'Beyond the clipboard: The evolving tradecraft of ClickFix') describes several unrelated ClickFix operators. Lures arrive via Bing malvertising with typosquatted redirectors (a fake Westlaw sign-on), SEO poisoning (LinkedIn and real-estate searches leading to fake Cloudflare 'Verify that you are human' turnstiles), and a compromised dental-practice website that showed a fake consent pop-up followed by a fake turnstile. The victim is instructed to paste a PowerShell command; some commands open a terminal that prints colored fake 'verification' output (or fake progress bars) while the payload downloads, and one variant shows an error if a post-download payload check fails, likely prompting a retry.

Chain A (early September) downloads cf_verify.zip to the user's Temp folder and extracts it to C:\ProgramData\f8f33b09aed97a47\, containing 1.bat, CertEnrollCtrl.exe and CertEnroll.dll (DLL sideloading). 1.bat creates a user Run key and a scheduled task, both named CertEnrollCtrl_Y0db6oZq9. CertEnrollCtrl.exe launches a PowerShell script for Active Directory reconnaissance using nltest, net, whoami and findstr. A Base64 PowerShell command in %LocalAppData%\Temp\6341434163416441.txt creates C:\ProgramData\ShService, drops an SSH private key and r.ps1, builds a reverse SSH tunnel to 23.227.199.41 and registers the scheduled task SysyService. The operator then used WinRM to reach the primary domain controller, created a new user account, attempted to add it to the local Administrators group, and opened a second reverse SSH tunnel.

Chain B drops verify_pkg.zip containing the signed Microsoft binary LockScreenContentServer.exe, a rogue dui70.dll and 1.bat into C:\ProgramData\7168f7f870a45fbb\. 1.bat is a multi-stage PowerShell stager that retrieves PNG images with full executables hidden in pixel data, rebuilds the binaries on disk and runs them; persistence is a scheduled task and Run key named LockScreenContentServer_qQrRrJiHX. Huntress notes an earlier ClickFix steganography case (blog of 2025-11-24) hid shellcode rather than complete executables; that earlier case read the red channel of each pixel and XOR-decoded it, delivering LummaC2 and Rhadamanthys.

A compromised dental site delivered a browser-cache-seeded variant: the pasted command detects Firefox, Chrome or Brave, searches the browser cache for a file named f_* of exactly 17,635 bytes that was cached when the fake page loaded, copies it to %TEMP%\t.bat and executes it, producing stage-two payloads. A separate MSI delivered from apirequestaccess[.]com installed DuskDesk, a Node.js RAT (node.exe, LimeMint.js, launch.js, UmberOceanTan.dat) persisted by a user Run key value named DuskDesk and beaconing to 167.148.201.104:3861; it masquerades as remote-management software, possibly mimicking RustDesk.

The report also references two earlier Huntress incident write-ups. February 2026 (blog 2026-02-16): a ClickFix prompt ran a silent mixed-case msiexec install from binclloudapp[.]com (registered 2026-02-05) that deployed Matanbuchus 3.0 (ChaCha20-encrypted strings and shellcode, ntdll/kernel32 unhooking, embedded Lua interpreter, sideloading via Zillya binaries and java.exe/jli.dll) and then AstarionRAT (24 commands, RSA-encrypted C2 disguised as telemetry, SOCKS5 proxy, credential theft). The operator returned about 17 hours later, used a compromised service account to RDP to a Windows Server, ran rdp.bat to create the rogue DefaultService admin account, and used PsExec to push tooling to the Windows Server and a Backup Domain Controller, targeting both DCs within about 40 minutes; Defender quarantined jli.dll and a final PsExec attempt toward the primary DC failed. May 2026 (blog 2026-06-16): a pasted command launched mshta through pcalua.exe to fetch an HTA that ran inst24.msi (msiexec /qn), installing the Potemkin loader (Run-key persistence); about five hours later a Node.js EtherRAT loader was deployed (C2 resolved from an Ethereum smart contract), a renamed cloudflared client (svchost.exe) opened a quick tunnel, the operator used WinRM, Chisel SOCKS tunnels, Defender tampering (Set-MpPreference, exclusion C:\ProgramData\p, stopping WinDefend), browser credential theft including Chrome App-Bound Encryption bypass, reached a domain controller, and SMBExec spread the EtherRAT MSI to more than 11 hosts before containment.

No threat actor is named and the operators are described as unrelated. The report recommends application control, blocking execution from user-writable paths, restricting the Run dialog/terminal, user training, and behavioral detection (browser or user-launched processes spawning cmd/PowerShell/Windows Terminal, encoded PowerShell, new scheduled tasks and Run keys, unexpected SSH connections) over atomic indicators. The article does not provide ATT&CK mappings or victim sectors; the mappings in this record are the analyst's interpretation of the described behavior. BeaconBeagle lookups for the Chain A/DuskDesk IPs returned HTTP 502 during research, so no C2 correlation was obtained.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.002 SMB/Windows Admin Shares; T1021.006 Windows Remote Management

Defense Evasion

T1027.003 Steganography; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1218.007 Msiexec; T1574.001 DLL

Discovery

T1033 System Owner/User Discovery; T1069.002 Domain Groups; T1087.002 Domain Account; T1482 Domain Trust Discovery

Persistence

T1053.005 Scheduled Task; T1098 Account Manipulation; T1136.001 Local Account; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.007 JavaScript; T1204.004 Malicious Copy and Paste; T1569.002 Service Execution

Credential Access

T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains; T1583.008 Malvertising

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Block the listed domains and IPs (westlaw-signon.com, moziw.com, vvestalw.ghost.io, apirequestaccess.com, binclloudapp.com, 23.227.199.41, 151.240.151.76, 167.148.201.104) and hunt for the listed file, task and Run-key artifacts
• Hunt for scheduled tasks and Run keys named CertEnrollCtrl_Y0db6oZq9, LockScreenContentServer_qQrRrJiHX, SysyService, 'Application Maintenance' and DuskDesk
• Review domain controllers and admin hosts for unexpected new accounts (e.g. DefaultService), WinRM/PsExec/SMBExec activity and outbound SSH from C:\ProgramData\ShService
• Isolate affected endpoints and reset credentials for accounts used on them

Workarounds

• Disable the Win+R Run dialog via policy where operationally feasible
• Block outbound SSH (TCP 22) from workstations that do not require it

Longer-term hardening

• Deploy application control/allowlisting and block execution from user-writable paths such as Temp and ProgramData
• Restrict the Windows Run dialog and terminal access and limit local admin rights
• Alert on browser or user-launched processes spawning cmd.exe, PowerShell or Windows Terminal, and on encoded PowerShell or execution-policy bypass
• Alert on new scheduled tasks, Run keys, Defender exclusions and unexpected outbound SSH connections
• Train users never to paste commands from a web page into Run, a terminal or PowerShell

Affected and fixed versions

• Microsoft — Windows (endpoints, servers and Active Directory domain controllers)
  Vulnerable versions: Not version-specific; social-engineering driven
• Mozilla / Google / Brave — Firefox, Chrome and Brave browser caches abused for payload staging
  Vulnerable versions: Not version-specific

Timeline

• 2025-11-24 Huntress publishes 'ClickFix Gets Creative: Malware Buried in Images', documenting PNG steganography that hid shellcode (LummaC2 and Rhadamanthys payloads); the 2026-11 report contrasts this with chains hiding full executables.
• 2026-02-05 ClickFix MSI delivery domain locked-ioc-23 (Matanbuchus 3.0 / AstarionRAT intrusion) is registered.
• 2026-02-16 Huntress publishes its analysis of a February 2026 ClickFix intrusion: Matanbuchus 3.0 then AstarionRAT, a rogue DefaultService admin account, and PsExec to a Windows Server and two domain controllers (primary DC attempt failed).
• 2026-05-01 May 2026 (exact day not stated): ClickFix on an unmonitored endpoint led to Potemkin, RMMProject and EtherRAT; WinRM, Chisel and cloudflared tunnels followed and SMBExec spread malware via admin shares to 11+ hosts before containment.
• 2026-06-16 Huntress publishes its Potemkin loader / RMMProject / EtherRAT ClickFix write-up (YARA rules dated 2026-06-04).
• 2026-09-01 Early September 2026 (exact day not stated): ClickFix with DLL sideloading (locked-ioc-21) led to AD recon, reverse SSH tunnels and WinRM lateral movement to the primary domain controller, where a new account was created.
• 2026-11-10 Huntress publishes 'Beyond the clipboard: The evolving tradecraft of ClickFix' documenting PNG-embedded executables, browser-cache delivery, DuskDesk and DC compromises.
• 2026-11-11 Cyber Security News publishes coverage of the Huntress findings.

Sources cited

• Beyond the clipboard: The evolving tradecraft of ClickFix (Huntress) Huntress · Vendor report · 2026-11-10
• ClickFix Gets Creative: Malware Buried in Images (Huntress) Huntress · Vendor report · 2025-11-24
• ClickFix to Matanbuchus 3.0 and AstarionRAT analysis (Huntress) Huntress · Vendor report · 2026-02-16
• Potemkin loader, RMMProject and EtherRAT ClickFix attack (Huntress) Huntress · Vendor report · 2026-06-16
• MITRE ATT&CK T1204.004 User Execution: Malicious Copy and Paste MITRE · Research
• ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers cybersecuritynews.com · News · 2026-11-11
• New AstarionRAT spread via Matanbuchus 3.0 intrusion (SC Media brief) scworld.com · News

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Wpcdoor Backdoor Distributed via Korea-Based CMS DVR Management Software (Larva-26013) Previous report
• Qlik Sense Servers Targeted With PowerShell/Go Reverse Shells; ActiveMQ (CVE-2023-46604) and Veeam (CVE-2024-40711) Exploits Staged Next report