Clickfix Attack Uses DNS Hijacking to Spread New Malware

After initial infection, the Clickfix attack proceeds by deploying a malicious Python script. This script then undertakes host and domain reconnaissance, gathering details about the target environment.

To maintain access to the compromised system, the malware establishes persistence by dropping a VBScript file and creating a shortcut named MonitoringService.lnk in the Windows Startup folder.

The final payload delivered in this campaign is a Remote Access Trojan (RAT) identified as ModeloRAT. Microsoft Defender Antivirus detects and blocks this activity under the threat signature Trojan:Win32/ClickFix.R!ml.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.