Full Report
Huntress uncovered an attack utilizing a ClickFix lure to initiate a multi-stage malware execution chain. This analysis reveals how threat actors use steganography to conceal infostealers like LummaC2 and Rhadamanthys within seemingly harmless PNGs.
Analysis Summary
# Tool/Technique: ClickFix Steganographic Loader
## Overview
This attack involves a multi-stage execution chain initiated by a **ClickFix** lure—a social engineering tactic that tricks users into manually executing malicious commands. The campaign is notable for its use of **steganography**, hiding infostealer payloads (LummaC2 and Rhadamanthys) within the pixel data of PNG images to evade network and file-based security scanners.
## Technical Details
- **Type:** Malware Loader / Social Engineering Technique
- **Platform:** Windows
- **Capabilities:** Steganography, Payload Decryption in Memory, Credential Theft, Anti-Analysis/Evasion.
- **First Seen:** October 2024 (Current campaign activity)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing (ClickFix lure sites)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (User pasting command)
- T1059.005 - Command and Scripting Interpreter: Visual Basic (mshta.exe)
- T1059.007 - Command and Scripting Interpreter: JavaScript/VBScript
- **TA0005 - Defense Evasion**
- T1027.003 - Obfuscation: Steganography
- T1027 - Obfuscated Files or Information (XOR/Base64)
- T1218.005 - System Binary Proxy Execution: mshta.exe
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
## Functionality
### Core Capabilities
- **Social Engineering (ClickFix):** Uses "Human Verification" or fake "Windows Update" screens to prompt users to press `Win+R`, `Ctrl+V`, and `Enter`.
- **Command Execution:** Leverages `mshta.exe` to execute remote scripts directly from the Windows Run prompt.
- **Steganographic Extraction:** The loader downloads a PNG file and extracts hidden malicious bytes from specific color channels (RGB) to reconstruct the final payload.
- **Dynamic Decryption:** Uses JavaScript (XOR and Base64) to decrypt second-stage loaders in memory via Blob URLs, preventing the script from touching the disk in plaintext.
### Advanced Features
- **Full-Screen Fake Windows Update:** Mimics the "Working on updates" splash screen to create a sense of urgency and legitimacy.
- **In-Memory Reconstruction:** The infostealer is never stored as a standalone executable on disk; it is reconstructed and executed directly in memory from image pixel data.
## Indicators of Compromise
- **File Names:** `rps.gz`, `bg.png`, `pixel.png` (Names vary per campaign)
- **Network Indicators:**
- `f6b04000.consent-verify.pages[.]dev` (Lure site)
- `81.0x5a.29[.]64` (C2/Payload Host)
- `81.91.178[.]42` (C2/Payload Host)
- **Behavioral Indicators:**
- Unexpected `mshta.exe` execution connecting to external IP addresses.
- Browser processes or `cmd.exe` spawning `mshta.exe`.
- Suspicious clipboard modifications followed by `Win+R` usage.
## Associated Threat Actors
- **LummaC2 Operators**
- **Rhadamanthys Operators**
- (Often attributed to various "Infostealer-as-a-Service" affiliates)
## Detection Methods
- **Behavioral Detection:** Monitor for `mshta.exe` launching with URL arguments in the command line, especially those originating from user-driven processes.
- **Network Monitoring:** Alert on connections to known ClickFix infrastructure (e.g., `.pages.dev` subdomains used for lures).
- **Endpoint Detection:** Flag the creation of Blob URLs within browser memory followed by suspicious script execution.
- **Clipboard Monitoring:** (Advanced) Detect scripts or sites that automatically push shell commands to the system clipboard.
## Mitigation Strategies
- **User Training:** Educate employees to never follow instructions that involve `Win+R` and pasting commands from a website.
- **Attack Surface Reduction:** Restrict or block `mshta.exe` from executing unless required for specific business functions.
- **Browser Security:** Implement web filtering to block known malicious hosting providers and TLDs used for lures.
- **AppLocker/Windows Defender Application Control (WDAC):** Use policies to prevent the execution of unsigned scripts and unauthorized system binaries.
## Related Tools/Techniques
- **ClearFake:** A similar campaign using fake browser update overlays.
- **Violentmonkey Project:** Shared techniques for Blob URL script injection.
- **PowerShell Steganography:** Similar concepts used to hide code in image headers or EXIF data.