# ClickFix Attacks Evolve: Malware Hidden in PNG Images and Windows Domain Controller Compromise (Huntress)

> Huntress reports multiple unrelated ClickFix intrusion chains in which users paste a PowerShell command from a fake verification page, leading to persistence, reconnaissance and lateral movement. Observed tradecraft includes executables hidden in PNG pixel data, DLL sideloading through signed Microsoft binaries, reverse SSH tunnels, a Node.js RAT (DuskDesk), browser-cache-seeded delivery, and intrusions reaching Windows domain controllers via WinRM, PsExec and SMBExec.

- **Published:** 2026-11-11T11:09:54Z
- **Last reviewed:** 2026-11-11T11:09:54Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5754
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5754.png
- **ID:** TL-2026-5754
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 41 (3 shown free below)

## Description

Huntress (blog dated 2026-11-10, 'Beyond the clipboard: The evolving tradecraft of ClickFix') describes several unrelated ClickFix operators. Lures arrive via Bing malvertising with typosquatted redirectors (a fake Westlaw sign-on), SEO poisoning (LinkedIn and real-estate searches leading to fake Cloudflare 'Verify that you are human' turnstiles), and a compromised dental-practice website that showed a fake consent pop-up followed by a fake turnstile. The victim is instructed to paste a PowerShell command; some commands open a terminal that prints colored fake 'verification' output (or fake progress bars) while the payload downloads, and one variant shows an error if a post-download payload check fails, likely prompting a retry.

Chain A (early September) downloads cf_verify.zip to the user's Temp folder and extracts it to C:\ProgramData\f8f33b09aed97a47\, containing 1.bat, CertEnrollCtrl.exe and CertEnroll.dll (DLL sideloading). 1.bat creates a user Run key and a scheduled task, both named CertEnrollCtrl_Y0db6oZq9. CertEnrollCtrl.exe launches a PowerShell script for Active Directory reconnaissance using nltest, net, whoami and findstr. A Base64 PowerShell command in %LocalAppData%\Temp\6341434163416441.txt creates C:\ProgramData\ShService, drops an SSH private key and r.ps1, builds a reverse SSH tunnel to 23.227.199.41 and registers the scheduled task SysyService. The operator then used WinRM to reach the primary domain controller, created a new user account, attempted to add it to the local Administrators group, and opened a second reverse SSH tunnel.

Chain B drops verify_pkg.zip containing the signed Microsoft binary LockScreenContentServer.exe, a rogue dui70.dll and 1.bat into C:\ProgramData\7168f7f870a45fbb\. 1.bat is a multi-stage PowerShell stager that retrieves PNG images with full executables hidden in pixel data, rebuilds the binaries on disk and runs them; persistence is a scheduled task and Run key named LockScreenContentServer_qQrRrJiHX. Huntress notes an earlier ClickFix steganography case (blog of 2025-11-24) hid shellcode rather than complete executables; that earlier case read the red channel of each pixel and XOR-decoded it, delivering LummaC2 and Rhadamanthys.

A compromised dental site delivered a browser-cache-seeded variant: the pasted command detects Firefox, Chrome or Brave, searches the browser cache for a file named f_* of exactly 17,635 bytes that was cached when the fake page loaded, copies it to %TEMP%\t.bat and executes it, producing stage-two payloads. A separate MSI delivered from apirequestaccess[.]com installed DuskDesk, a Node.js RAT (node.exe, LimeMint.js, launch.js, UmberOceanTan.dat) persisted by a user Run key value named DuskDesk and beaconing to 167.148.201.104:3861; it masquerades as remote-management software, possibly mimicking RustDesk.

The report also references two earlier Huntress incident write-ups. February 2026 (blog 2026-02-16): a ClickFix prompt ran a silent mixed-case msiexec install from binclloudapp[.]com (registered 2026-02-05) that deployed Matanbuchus 3.0 (ChaCha20-encrypted strings and shellcode, ntdll/kernel32 unhooking, embedded Lua interpreter, sideloading via Zillya binaries and java.exe/jli.dll) and then AstarionRAT (24 commands, RSA-encrypted C2 disguised as telemetry, SOCKS5 proxy, credential theft). The operator returned about 17 hours later, used a compromised service account to RDP to a Windows Server, ran rdp.bat to create the rogue DefaultService admin account, and used PsExec to push tooling to the Windows Server and a Backup Domain Controller, targeting both DCs within about 40 minutes; Defender quarantined jli.dll and a final PsExec attempt toward the primary DC failed. May 2026 (blog 2026-06-16): a pasted command launched mshta through pcalua.exe to fetch an HTA that ran inst24.msi (msiexec /qn), installing the Potemkin loader (Run-key persistence); about five hours later a Node.js EtherRAT loader was deployed (C2 resolved from an Ethereum smart contract), a renamed cloudflared client (svchost.exe) opened a quick tunnel, the operator used WinRM, Chisel SOCKS tunnels, Defender tampering (Set-MpPreference, exclusion C:\ProgramData\p, stopping WinDefend), browser credential theft including Chrome App-Bound Encryption bypass, reached a domain controller, and SMBExec spread the EtherRAT MSI to more than 11 hosts before containment.

No threat actor is named and the operators are described as unrelated. The report recommends application control, blocking execution from user-writable paths, restricting the Run dialog/terminal, user training, and behavioral detection (browser or user-launched processes spawning cmd/PowerShell/Windows Terminal, encoded PowerShell, new scheduled tasks and Run keys, unexpected SSH connections) over atomic indicators. The article does not provide ATT&CK mappings or victim sectors; the mappings in this record are the analyst's interpretation of the described behavior. BeaconBeagle lookups for the Chain A/DuskDesk IPs returned HTTP 502 during research, so no C2 correlation was obtained.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.001 Domains
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1136.001 Local Account
- T1098 Account Manipulation
- T1574.001 DLL
- T1027.003 Steganography
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1218.007 Msiexec
- T1218.005 Mshta
- T1685 Disable or Modify Tools
- T1555.003 Credentials from Web Browsers
- T1482 Domain Trust Discovery
- T1069.002 Domain Groups
- T1087.002 Domain Account
- T1033 System Owner/User Discovery
- T1021.006 Windows Remote Management
- T1021.002 SMB/Windows Admin Shares

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Persistence: Scheduled Task and Run Key With Known Names or User-Writable Payloads** (`TL-2026-5754-SPL-002`)

Detects persistence used across the TL-2026-5754 chains: scheduled tasks and Run-key values named CertEnrollCtrl_Y0db6oZq9, LockScreenContentServer_qQrRrJiHX, SysyService, Application Maintenance or DuskDesk, and generic schtasks /create or Run-key writes that launch payloads from ProgramData, AppData or Temp.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1053.005, T1547.001
- **Data sources:** sysmon, DeviceProcessEvents, DeviceRegistryEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=13) earliest=-24h
| eval blob=lower(coalesce(CommandLine,"")." ".coalesce(TargetObject,"")." ".coalesce(Details,""))
| eval ioc_hit=if(match(blob,"certenrollctrl_y0db6ozq9|lockscreencontentserver_qqrrrjihx|sysyservice|application maintenance|duskdesk"),1,0)
| eval task_create=if(EventCode=1 AND match(lower(Image),".schtasks[.]exe$") AND match(blob,"/create") AND match(blob,"programdata|appdata|.temp.|powershell|[.]bat|[.]ps1"),1,0)
| eval run_key=if(EventCode=13 AND match(lower(TargetObject),"currentversion.run") AND match(lower(Details),"programdata|appdata|.temp.|node[.]exe|powershell"),1,0)
| where ioc_hit=1 OR task_create=1 OR run_key=1
| eval persistence_type=case(task_create=1,"scheduled_task",run_key=1,"run_key",true(),"named_artifact")
| stats count min(_time) as first_seen max(_time) as last_seen values(persistence_type) as types values(CommandLine) as commands values(TargetObject) as run_keys values(Details) as run_values by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let ioc_names = dynamic(["CertEnrollCtrl_Y0db6oZq9","LockScreenContentServer_qQrRrJiHX","SysyService","Application Maintenance","DuskDesk"]);
let tasks = DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
    | where ProcessCommandLine has_any (ioc_names) or ProcessCommandLine has_any ("ProgramData", "AppData", "\\Temp\\", "powershell", ".bat", ".ps1")
    | project Timestamp, DeviceName, AccountName, Signal = "scheduled_task_create", Detail = ProcessCommandLine, Parent = InitiatingProcessFileName;
let runkeys = DeviceRegistryEvents
    | where Timestamp > ago(24h)
    | where ActionType == "RegistryValueSet" and RegistryKey matches regex @"(?i)currentversion.run"
    | where RegistryValueName has_any (ioc_names) or RegistryValueData has_any ("ProgramData", "AppData", "\\Temp\\", "node.exe", "powershell")
    | project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, Signal = "run_key_set", Detail = strcat(RegistryValueName, "=", RegistryValueData), Parent = InitiatingProcessFileName;
union tasks, runkeys
| order by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Scheduled Task Persistence With Known Task Names or User-Writable Payload Paths
id: 7b2e9d14-3c5a-4f08-a6d3-91e4c2b80f02
status: experimental
description: Detects schtasks /create for the task names reported in TL-2026-5754 (CertEnrollCtrl_Y0db6oZq9, LockScreenContentServer_qQrRrJiHX, SysyService, Application Maintenance, DuskDesk) or tasks whose action runs from ProgramData, AppData or Temp via PowerShell or batch files. Run-key persistence is covered in the SPL and KQL forms.
references:
    - https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix
    - https://attack.mitre.org/techniques/T1053/005/
author: Threadlinqs Team
date: 2026/11/11
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.t1547.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains: '/create'
    selection_names:
        CommandLine|contains:
            - 'CertEnrollCtrl_Y0db6oZq9'
            - 'LockScreenContentServer_qQrRrJiHX'
            - 'SysyService'
            - 'Application Maintenance'
            - 'DuskDesk'
    selection_paths:
        CommandLine|contains:
            - '\ProgramData\'
            - '\AppData\'
            - '\Temp\'
    selection_launcher:
        CommandLine|contains:
            - 'powershell'
            - '.bat'
            - '.ps1'
    condition: selection_img and (selection_names or (selection_paths and selection_launcher))
falsepositives:
    - Software installers that register updater tasks pointing at ProgramData or AppData
    - Administrators creating maintenance tasks that call PowerShell scripts
level: high

```

**Known false positives:**

- Installers and updaters (browsers, collaboration clients) that register tasks or Run values under AppData
- Administrator scripts creating scheduled maintenance tasks with PowerShell actions

**Tuning notes:** Named-artifact matches are near-zero false positive; keep the generic path branch at medium priority and allowlist known updater task names. Requires Sysmon EventCode 13 for Run key writes. 'Application Maintenance' is a generic name and should be correlated with a ProgramData payload path.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix PNG Steganography Stager and Signed-Binary DLL Sideload From ProgramData (locked: unlock with TL Creds)
- ClickFix Post-Exploitation: AD Reconnaissance and Rogue Admin Account Creation (locked: unlock with TL Creds)
- ClickFix Lateral Movement: WinRM, PsExec and SMBExec Toward Domain Controllers (locked: unlock with TL Creds)
- ClickFix MSI Delivery: Silent Msiexec From URL and Pcalua-Proxied Mshta (locked: unlock with TL Creds)
- Microsoft Defender Tampering: Exclusions, Feature Disablement and WinDefend Stop (locked: unlock with TL Creds)
- DuskDesk Node.js RAT: Implant Execution, C2 Beacon and Run-Key Persistence (locked: unlock with TL Creds)
- ClickFix Paste-and-Run Shell Launched From Explorer, Browser or Terminal (locked: unlock with TL Creds)
- ClickFix C2: Reverse SSH Tunnels, Chisel SOCKS and Known Infrastructure (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 41)

Defanged, TLP:CLEAR.

- IP address: `23.227.199[.]41`
- Domain: `westlaw-signon[.]com`
- URL: `hxxps://vvestalw[.]ghost[.]io/`

Full set of 41 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Beyond the clipboard: The evolving tradecraft of ClickFix (Huntress)](https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix)
- [ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers](https://cybersecuritynews.com/clickfix-attacks-evolve/)
- [ClickFix Gets Creative: Malware Buried in Images (Huntress)](https://www.huntress.com/blog/clickfix-malware-buried-in-images)
- [ClickFix to Matanbuchus 3.0 and AstarionRAT analysis (Huntress)](https://www.huntress.com/blog/clickfix-matanbuchus-astarionrat-analysis)
- [Potemkin loader, RMMProject and EtherRAT ClickFix attack (Huntress)](https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack)
- [New AstarionRAT spread via Matanbuchus 3.0 intrusion (SC Media brief)](https://www.scworld.com/brief/new-astarionrat-spread-via-matanbuchus-3-0-intrusion)
- [MITRE ATT&CK T1204.004 User Execution: Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5754