ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers - CyberSecurityNews

The latest investigations reveal that ClickFix attacks have moved beyond simple malware downloads. Attackers now embed executable payloads directly inside the pixels of PNG images. Once a user runs a command copied from a webpage, the malware extracts the hidden data, rebuilds the binaries on disk, and launches them.

In one detailed chain, a pasted PowerShell command displayed a fake Cloudflare check while downloading an archive. The archive contained a signed Microsoft executable, a malicious DLL, and a batch script. This script retrieved PNG images, reconstructed the complete executables, and established persistence via scheduled tasks and registry Run keys.

A separate September intrusion used DLL sideloading and Windows administration tools to reach a primary domain controller. After establishing persistence, the attacker examined domain trusts and administrator membership. WinRM enabled lateral movement, followed by account creation and a second reverse SSH tunnel.

Earlier incidents showed similar consequences. February activity delivered Matanbuchus 3.0 and AstarionRAT before reaching two domain controllers through PsExec. May’s ClickFix MSI installation attack spread malware through administrative shares, compromising 11 hosts before containment.

Another investigation found commands tailored to Chrome, Firefox, or Brave. A compromised dental website first placed a file in the browser cache. The pasted command searched for its exact 17,635-byte size, copied it into temporary storage, and executed it as a batch script.

Huntress also observed DuskDesk, a Node.js remote access trojan disguised as management software. The malware used logon persistence and contacted a potential command server. Related Node.js ClickFix malware campaigns illustrate why administrators should examine unexpected scripting runtimes rather than trust an application’s appearance.

Huntress recommends teaching users never to paste webpage instructions into terminals, restricting untrusted execution, and monitoring encoded PowerShell, new persistence entries, and unexpected SSH traffic. Detection should connect these behaviors rather than depend only on changing filenames or hashes.