# StrikeStub: ClickFix-delivered PowerShell loader and modular RAT (HVNC, keylogger, credential theft)

> Akamai SIRT analyzed StrikeStub, a modular Windows RAT delivered through a ClickFix fake human-verification lure on a compromised site (spiraldirect.ch) that has the victim paste a hidden PowerShell command which downloads a payload from squidscript.com. The malware talks to its C2 over WebSocket and offers keylogging, hidden VNC, webcam/screen capture, clipboard monitoring and browser credential theft.

- **Published:** 2026-11-12T14:22:16Z
- **Last reviewed:** 2026-11-12T14:22:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5863
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5863.png
- **ID:** TL-2026-5863
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (3 shown free below)

## Description

StrikeStub was documented by Akamai SIRT (Larry Cashdollar) on 2026-11-12. Delivery starts with a ClickFix lure on a compromised website, spiraldirect.ch, which displays a fake 'Verification Step' / 'Verify you are human' prompt and copies a PowerShell command to the clipboard. The victim is instructed to press Win+R, paste with Ctrl+V and press Enter. The command runs hidden (powershell -w hidden -c), uses iwr to download http://squidscript.com/Cloudflare.exe, saves it as $env:TEMP\svc.exe and launches it with Start-Process. The pasted text carries a decoy suffix, 'Verify you are human - Ray Verification ID: 6450'.

The payload is an unpacked PE32+ (x86-64, GUI subsystem) of 1,475,072 bytes built with MinGW/GCC (libstdc++ mangled and exception-handling symbols), with a PE compile timestamp of 2026-09-19. It masquerades as a Windows component: ProductName 'Microsoft Windows Operating System', InternalName/OriginalFilename RuntimeBroker / RuntimeBroker.exe, FileVersion '1.0.0.19041.1 (WinBuild.160101.0800)' and a manifest naming Microsoft.Windows.RuntimeBroker. The GCC toolchain artifacts are a static tell, since the genuine RuntimeBroker.exe is MSVC-built. Persistence uses the Software\Microsoft\Windows\CurrentVersion\Run registry key and a Startup-folder copy named WindowsUpdate.exe (under \Microsoft\ in the Programs startup path), with a logged fallback to the binary's own path if setup fails. A mutex check aborts duplicate instances. Strings are protected by a compile-time XOR decryption loop at about 236 sites in .text, keyed from a Fibonacci-hashing multiplier (0x9e3779b9) and a per-string 16-bit constant; Akamai decoded 67 strings and 169 sites remained unresolved. APIs are resolved at runtime with LoadLibraryA/GetProcAddress.

C2 uses WebSocket over WinHTTP (WinHttpWebSocketSend/Receive/Close/CompleteUpgrade) plus a raw WS2_32 connect, with the User-Agent 'StrikeStub/1.0'. The handshake is: WebSocket connect, wait for 'enrollment_challenge', send a hello containing id, host and user, then receive 'hello_ack' and enter a session loop (not decoded). The C2 host and port are read from a runtime config whose location and format were not identified, so no C2 IOC is available. Capabilities seen in code: keylogging to dated files keylog_%04d-%02d-%02d.txt (commands keylog_live_data, keylog_clear_all); hidden VNC (hvnc_start, hvnc_stop, hvnc_enable_keyboard, hvnc_enable_cursor, hvnc_select_display); webcam capture (webcam_stop) and live desktop frame capture with a quality parameter; clipboard monitoring via GetClipboardData (possibly crypto-address swapping, unconfirmed); a binder that extracts and launches an embedded payload; and browser credential theft using DPAPI CryptUnprotectData for Chromium-based browsers, with Firefox profile cloning to avoid SQLite locks (Chrome, Brave and Firefox paths targeted).

Akamai assesses StrikeStub as a likely MaaS or builder-kit RAT/stealer similar to DcRat or AsyncRAT derivatives. No attribution, no CVEs and no victimology were published. A companion sample from the same batch (SHA256 092d83ade48eb9c71d51de133253958e5c1977f637957e2ba3e1e4c35f4627ec) has not been analyzed and its relationship is unconfirmed. Severity and ACTIVE status are analyst-assigned from the live ClickFix delivery chain; the article gives no score or explicit exploitation statement.

## MITRE ATT&CK

- T1204.004 User Execution: Malicious Copy and Paste
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1106 Native API
- T1071.001 Application Layer Protocol: Web Protocols
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1564.003 Hide Artifacts: Hidden Window
- T1027.007 Obfuscated Files or Information: Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1056.001 Input Capture: Keylogging
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1021.005 Remote Services: VNC
- T1113 Screen Capture
- T1125 Video Capture
- T1027 Obfuscated Files or Information
- T1112 Modify Registry
- T1057 Process Discovery

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**StrikeStub ClickFix Hidden PowerShell Downloader Launched from Explorer** (`TL-2026-5863-SPL-001`)

Detects the StrikeStub ClickFix paste-and-run stager (TL-2026-5863): powershell.exe/pwsh.exe spawned by explorer.exe (Win+R Run dialog) with a hidden window, an iwr/Invoke-WebRequest style download, and either a StrikeStub indicator (squidscript.com, Cloudflare.exe, the 'Ray Verification ID' decoy suffix) or a Start-Process launch from %TEMP% (svc.exe). Behaviour-first: the generic hidden-download-from-Run-dialog pattern fires even if the payload host rotates.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1564.003
- **Data sources:** sysmon (index=sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventID 1), DeviceProcessEvents, windows process_creation
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
| eval cmd=lower(CommandLine)
| eval hidden=if(like(cmd,"%-w%hidden%") OR like(cmd,"% -w 1 %"),1,0)
| eval download=if(like(cmd,"%iwr%") OR like(cmd,"%invoke-webrequest%") OR like(cmd,"%downloadfile%") OR like(cmd,"%start-bitstransfer%"),1,0)
| eval stager=if(like(cmd,"%start-process%") AND like(cmd,"%temp%"),1,0)
| eval ioc=if(like(cmd,"%squidscript.com%") OR like(cmd,"%cloudflare.exe%") OR like(cmd,"%ray verification id%"),1,0)
| where hidden=1 AND download=1 AND (ioc=1 OR stager=1)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentCommandLine) as parent_command_lines by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
// StrikeStub ClickFix: hidden PowerShell download launched from explorer.exe (Win+R paste)
let ioc = dynamic(['squidscript.com','Cloudflare.exe','Ray Verification ID']);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe','pwsh.exe')
| where ProcessCommandLine matches regex @'(?i)[ ]-w[a-z]*[ ]+(hidden|1)([ ]|$)'
| where ProcessCommandLine has_any ('iwr','Invoke-WebRequest','DownloadFile','Start-BitsTransfer')
| where ProcessCommandLine has_any (ioc) or (ProcessCommandLine has 'Start-Process' and ProcessCommandLine has 'TEMP')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc
```

### Sigma

```yaml
title: StrikeStub ClickFix Hidden PowerShell Download Launched from Explorer
id: 7c1e5a3e-2b4d-4f6a-9d11-5a8b0c3e1f01
status: experimental
description: Detects the StrikeStub ClickFix paste-and-run stager - hidden powershell/pwsh spawned by explorer.exe (Win+R) that downloads a payload with iwr and stages it in TEMP or references squidscript.com / Cloudflare.exe.
references:
  - https://www.akamai.com/blog/security-research/2026/nov/strikestub-clickfix-powershell-malware-modular-rat
  - https://attack.mitre.org/techniques/T1204/004/
author: Threadlinqs Team
date: 2026/11/12
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1564.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_ps:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_hidden:
    CommandLine|contains:
      - '-w hidden'
      - '-wi hidden'
      - '-win hidden'
      - '-windowstyle hidden'
      - ' -w 1 '
  selection_download:
    CommandLine|contains:
      - 'iwr '
      - 'Invoke-WebRequest'
      - 'DownloadFile'
      - 'Start-BitsTransfer'
  selection_stager:
    CommandLine|contains:
      - 'squidscript.com'
      - 'Cloudflare.exe'
      - 'Ray Verification ID'
      - 'env:TEMP'
  condition: all of selection_*
falsepositives:
  - Administrators running hidden download one-liners from the Run dialog
  - Software deployment helpers launched interactively from Explorer
level: high

```

**Known false positives:**

- Administrators running hidden PowerShell download one-liners from the Run dialog
- Interactive software-deployment or helpdesk scripts launched from Explorer that stage tools in %TEMP%

**Tuning notes:** Remove the stager/ioc branch requirement only for hunting. Allowlist known helpdesk accounts and signed deployment tools by User or CommandLine hash. Consider alerting on any hidden-window PowerShell from explorer.exe in high-risk user groups.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- StrikeStub RuntimeBroker/WindowsUpdate/svc.exe Masquerade Outside System32 (locked: unlock with TL Creds)
- StrikeStub Keylogger Output File keylog_YYYY-MM-DD.txt Creation (locked: unlock with TL Creds)
- StrikeStub Masquerade-Named Binary Outbound C2 Connections (WebSocket / HVNC Carrier) (locked: unlock with TL Creds)
- StrikeStub ClickFix Run Dialog PowerShell Paste Recorded in RunMRU (locked: unlock with TL Creds)
- StrikeStub Browser Credential Store Cloning by Non-Browser Process (locked: unlock with TL Creds)
- StrikeStub Delivery Infrastructure DNS Lookup [indicator] and [indicator] (locked: unlock with TL Creds)
- StrikeStub Persistence via Run Key and Startup Folder [indicator] (locked: unlock with TL Creds)
- StrikeStub C2 User-Agent [indicator] and Payload Host [indicator] at Web Gateway (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 14)

Defanged, TLP:CLEAR.

- Domain: `squidscript[.]com`
- File hash: `092d83ade48eb9c71d51de133253958e5c1977f637957e2ba3e1e4c35f4627ec`
- Domain: `spiraldirect[.]ch`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT (Akamai, Larry Cashdollar)](https://www.akamai.com/blog/security-research/2026/nov/strikestub-clickfix-powershell-malware-modular-rat)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1021.005 Remote Services: VNC](https://attack.mitre.org/techniques/T1021/005/)
- [Netskope: From ClickFix to MaaS - Exposing a Modular Windows RAT and its Admin Panel (related ClickFix RAT context, not StrikeStub)](https://www.netskope.com/blog/from-clickfix-to-maas-exposing-a-modular-windows-rat-and-its-admin-panel)
- [ReliaQuest: Threat Spotlight - ClickFix Evolves with PySoxy Proxying (related ClickFix context, not StrikeStub)](https://www.reliaquest.com/blog/threat-spotlight-clickfix-evolves-with-pysoxy-proxying/)
- [The Hacker News: ClickFix Campaigns Expand Malware Delivery (related ClickFix context, not StrikeStub)](https://thehackernews.com/2026/06/clickfix-campaigns-expand-malware.html)
- [NopalCyber threat hunting advisory: ClickFix PowerShell RAT (related ClickFix context, not StrikeStub)](https://www.nopalcyber.com/threat-hunting-advisory/may-18th,-2026)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5863