StrikeStub: ClickFix-delivered PowerShell loader and modular RAT (HVNC, keylogger, credential theft)

Key facts

Detection coverage

As of 2026-11-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5863 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: StrikeStub ClickFix Hidden PowerShell Downloader Launched from Explorer

Detects the StrikeStub ClickFix paste-and-run stager (TL-2026-5863): powershell.exe/pwsh.exe spawned by explorer.exe (Win+R Run dialog) with a hidden window, an iwr/Invoke-WebRequest style download, and either a StrikeStub indicator (squidscript.com, Cloudflare.exe, the 'Ray Verification ID' decoy suffix) or a Start-Process launch from %TEMP% (svc.exe). Behaviour-first: the generic hidden-download-from-Run-dialog pattern fires even if the payload host rotates.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1564.003
• Data sources: sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventID 1), DeviceProcessEvents, windows process_creation
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
| eval cmd=lower(CommandLine)
| eval hidden=if(like(cmd,"%-w%hidden%") OR like(cmd,"% -w 1 %"),1,0)
| eval download=if(like(cmd,"%iwr%") OR like(cmd,"%invoke-webrequest%") OR like(cmd,"%downloadfile%") OR like(cmd,"%start-bitstransfer%"),1,0)
| eval stager=if(like(cmd,"%start-process%") AND like(cmd,"%temp%"),1,0)
| eval ioc=if(like(cmd,"%squidscript.com%") OR like(cmd,"%cloudflare.exe%") OR like(cmd,"%ray verification id%"),1,0)
| where hidden=1 AND download=1 AND (ioc=1 OR stager=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

// StrikeStub ClickFix: hidden PowerShell download launched from explorer.exe (Win+R paste)
let ioc = dynamic(['squidscript.com','Cloudflare.exe','Ray Verification ID']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe','pwsh.exe')
| where ProcessCommandLine matches regex @'(?i)[ ]-w[a-z]*[ ]+(hidden|1)([ ]|$)'
| where ProcessCommandLine has_any ('iwr','Invoke-WebRequest','DownloadFile','Start-BitsTransfer')
| where ProcessCommandLine has_any (ioc) or (ProcessCommandLine has 'Start-Process' and ProcessCommandLine has 'TEMP')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Sigma

title: StrikeStub ClickFix Hidden PowerShell Download Launched from Explorer
id: 7c1e5a3e-2b4d-4f6a-9d11-5a8b0c3e1f01
status: experimental
description: Detects the StrikeStub ClickFix paste-and-run stager - hidden powershell/pwsh spawned by explorer.exe (Win+R) that downloads a payload with iwr and stages it in TEMP or references squidscript.com / Cloudflare.exe.
references:
  - https://www.akamai.com/blog/security-research/2026/nov/strikestub-clickfix-powershell-malware-modular-rat
  - https://attack.mitre.org/techniques/T1204/004/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_hidden:
    CommandLine|contains:
      - '-w hidden'
      - '-wi hidden'
      - '-win hidden'
      - '-windowstyle hidden'
      - ' -w 1 '
  selection_download:
    CommandLine|contains:
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'DownloadFile'
      - 'Start-BitsTransfer'
  selection_stager:
    CommandLine|contains:
      - 'squidscript.com'
      - 'Cloudflare.exe'
      - 'Ray Verification ID'
      - 'env:TEMP'
  condition: all of selection_*
falsepositives:
  - Administrators running hidden download one-liners from the Run dialog
  - Software deployment helpers launched interactively from Explorer
level: high

Known false positives:

• Administrators running hidden PowerShell download one-liners from the Run dialog
• Interactive software-deployment or helpdesk scripts launched from Explorer that stage tools in %TEMP%

Tuning notes: Remove the stager/ioc branch requirement only for hunting. Allowlist known helpdesk accounts and signed deployment tools by User or CommandLine hash. Consider alerting on any hidden-window PowerShell from explorer.exe in high-risk user groups.

• 🔒 StrikeStub RuntimeBroker/WindowsUpdate/svc.exe Masquerade Outside System32 · unlock with TL Creds
• 🔒 StrikeStub Keylogger Output File keylog_YYYY-MM-DD.txt Creation · unlock with TL Creds
• 🔒 StrikeStub Masquerade-Named Binary Outbound C2 Connections (WebSocket / HVNC Carrier) · unlock with TL Creds
• 🔒 StrikeStub ClickFix Run Dialog PowerShell Paste Recorded in RunMRU · unlock with TL Creds
• 🔒 StrikeStub Browser Credential Store Cloning by Non-Browser Process · unlock with TL Creds
• 🔒 StrikeStub Delivery Infrastructure DNS Lookup [indicator] and [indicator] · unlock with TL Creds
• 🔒 StrikeStub Persistence via Run Key and Startup Folder [indicator] · unlock with TL Creds
• 🔒 StrikeStub C2 User-Agent [indicator] and Payload Host [indicator] at Web Gateway · unlock with TL Creds

Indicators of compromise

As of 2026-11-12, Threadlinqs Intelligence tracks 14 indicators of compromise for TL-2026-5863.

Sample indicators (3 of 14)

• Domain: squidscript[.]com
• File hash: 092d83ade48eb9c71d51de133253958e5c1977f637957e2ba3e1e4c35f4627ec
• Domain: spiraldirect[.]ch

Defanged, TLP:CLEAR. Full set of 14 indicators: unlock with TL Creds.

Technical analysis

StrikeStub was documented by Akamai SIRT (Larry Cashdollar) on 2026-11-12. Delivery starts with a ClickFix lure on a compromised website, spiraldirect.ch, which displays a fake 'Verification Step' / 'Verify you are human' prompt and copies a PowerShell command to the clipboard. The victim is instructed to press Win+R, paste with Ctrl+V and press Enter. The command runs hidden (powershell -w hidden -c), uses iwr to download http://squidscript.com/Cloudflare.exe, saves it as $env:TEMP\svc.exe and launches it with Start-Process. The pasted text carries a decoy suffix, 'Verify you are human - Ray Verification ID: 6450'.

The payload is an unpacked PE32+ (x86-64, GUI subsystem) of 1,475,072 bytes built with MinGW/GCC (libstdc++ mangled and exception-handling symbols), with a PE compile timestamp of 2026-09-19. It masquerades as a Windows component: ProductName 'Microsoft Windows Operating System', InternalName/OriginalFilename RuntimeBroker / RuntimeBroker.exe, FileVersion '1.0.0.19041.1 (WinBuild.160101.0800)' and a manifest naming Microsoft.Windows.RuntimeBroker. The GCC toolchain artifacts are a static tell, since the genuine RuntimeBroker.exe is MSVC-built. Persistence uses the Software\Microsoft\Windows\CurrentVersion\Run registry key and a Startup-folder copy named WindowsUpdate.exe (under \Microsoft\ in the Programs startup path), with a logged fallback to the binary's own path if setup fails. A mutex check aborts duplicate instances. Strings are protected by a compile-time XOR decryption loop at about 236 sites in .text, keyed from a Fibonacci-hashing multiplier (0x9e3779b9) and a per-string 16-bit constant; Akamai decoded 67 strings and 169 sites remained unresolved. APIs are resolved at runtime with LoadLibraryA/GetProcAddress.

C2 uses WebSocket over WinHTTP (WinHttpWebSocketSend/Receive/Close/CompleteUpgrade) plus a raw WS2_32 connect, with the User-Agent 'StrikeStub/1.0'. The handshake is: WebSocket connect, wait for 'enrollment_challenge', send a hello containing id, host and user, then receive 'hello_ack' and enter a session loop (not decoded). The C2 host and port are read from a runtime config whose location and format were not identified, so no C2 IOC is available. Capabilities seen in code: keylogging to dated files keylog_%04d-%02d-%02d.txt (commands keylog_live_data, keylog_clear_all); hidden VNC (hvnc_start, hvnc_stop, hvnc_enable_keyboard, hvnc_enable_cursor, hvnc_select_display); webcam capture (webcam_stop) and live desktop frame capture with a quality parameter; clipboard monitoring via GetClipboardData (possibly crypto-address swapping, unconfirmed); a binder that extracts and launches an embedded payload; and browser credential theft using DPAPI CryptUnprotectData for Chromium-based browsers, with Firefox profile cloning to avoid SQLite locks (Chrome, Brave and Firefox paths targeted).

Akamai assesses StrikeStub as a likely MaaS or builder-kit RAT/stealer similar to DcRat or AsyncRAT derivatives. No attribution, no CVEs and no victimology were published. A companion sample from the same batch (SHA256 092d83ade48eb9c71d51de133253958e5c1977f637957e2ba3e1e4c35f4627ec) has not been analyzed and its relationship is unconfirmed. Severity and ACTIVE status are analyst-assigned from the live ClickFix delivery chain; the article gives no score or explicit exploitation statement.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021.005 Remote Services: VNC

Defense Evasion

T1027 Obfuscated Files or Information; T1027.007 Obfuscated Files or Information: Dynamic API Resolution; T1036.005 Masquerading: Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hide Artifacts: Hidden Window

Credential Access

T1056.001 Input Capture: Keylogging; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Discovery

T1057 Process Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1106 Native API; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1071.001 Application Layer Protocol: Web Protocols

defense-impairment

T1112 Modify Registry

Collection

T1113 Screen Capture; T1125 Video Capture

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Remediation

Immediate actions

• Block squidscript.com and spiraldirect.ch at DNS, proxy and web gateway; hunt for HTTP requests to http://squidscript.com/Cloudflare.exe
• Search endpoints for %TEMP%\svc.exe, WindowsUpdate.exe in the user Startup folder, and RuntimeBroker.exe outside C:\Windows\System32
• Hunt for the User-Agent 'StrikeStub/1.0' and WinHTTP WebSocket upgrades from non-browser processes
• Isolate affected hosts and rotate credentials, session cookies and tokens stored in Chrome, Brave and Firefox on them

Workarounds

• Block execution of binaries named RuntimeBroker.exe or WindowsUpdate.exe outside their legitimate paths using application control
• Monitor HKCU\Software\Microsoft\Windows\CurrentVersion\Run for new values pointing at user-writable paths

Longer-term hardening

• Disable or restrict the Win+R Run dialog for standard users where feasible, and train users that legitimate verification pages never ask them to paste commands
• Alert on powershell.exe launched by explorer.exe with -w hidden and iwr/Invoke-WebRequest to a download into %TEMP%
• Use PowerShell Constrained Language Mode, script block logging and application control to block unsigned executables run from %TEMP%

Affected and fixed versions

• Microsoft — Windows
  Vulnerable versions: Windows endpoints where a user can run PowerShell via the Run dialog (no vulnerability exploited; social-engineering delivery)

Timeline

• 2026-09-19 PE TimeDateStamp of the StrikeStub main binary (MinGW/GCC build, masquerading as locked-ioc-6)
• 2026-09-24 Sample observed by Akamai SIRT about five days after its compile timestamp (derived from the article's 'five days after compile' statement)
• 2026-11-12 Threat added to the Threadlinqs platform as TL-2026-5863; no attribution, CVE or C2 host/port available at time of publication
• 2026-11-12 Akamai notes open items: no hashes for the main sample, companion sample 092d83ad... not yet checked, XOR string decoder resolved 67 strings with 169 of ~236 sites unresolved, and no detection content published
• 2026-11-12 Akamai documents the WebSocket C2 handshake (enrollment_challenge, hello with id/host/user, hello_ack) and operator-toggleable modules; C2 host/port come from a runtime config that was not recovered
• 2026-11-12 Delivery IOCs disclosed: locked-ioc-9 (compromised lure site), locked-ioc-8/locked-ioc-10 (payload host), svc.exe and locked-ioc-7 artifacts, and an unanalyzed companion sample hash
• 2026-11-12 Akamai publishes 'Dissecting StrikeStub' describing the ClickFix delivery chain, WebSocket C2 protocol and RAT capabilities

Sources cited

• NopalCyber threat hunting advisory: ClickFix PowerShell RAT (related ClickFix context, not StrikeStub) nopalcyber.com · Advisory · 2026-05-18
• Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT (Akamai, Larry Cashdollar) akamai.com · Research · 2026-11-12
• MITRE ATT&CK T1204.004 Malicious Copy and Paste MITRE · Research
• MITRE ATT&CK T1021.005 Remote Services: VNC MITRE · Research
• Netskope: From ClickFix to MaaS - Exposing a Modular Windows RAT and its Admin Panel (related ClickFix RAT context, not StrikeStub) netskope.com · Blog · 2026-04-06
• ReliaQuest: Threat Spotlight - ClickFix Evolves with PySoxy Proxying (related ClickFix context, not StrikeStub) reliaquest.com · Blog
• The Hacker News: ClickFix Campaigns Expand Malware Delivery (related ClickFix context, not StrikeStub) The Hacker News · News

More in malware

• ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender
• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines

Previous and next in malware

• Operation Endgame: Europol takedown of Gootloader, CastleRAT and StealC infrastructure; 6M+ stolen credentials recovered Previous report
• T-SQL Abused to Deliver XMRig Miner and Gh0st RAT on Compromised MS SQL Servers Next report