Critical Multi-Stage ClickFix Flaw Lets Attackers Deploy MLTBackdoor Malware

Key Takeaways

• A sophisticated multi-stage infection chain, dubbed ClickFix, is actively deploying the evasive MLTBackdoor malware.
• MLTBackdoor employs extensive obfuscation, including junk code and control flow flattening, making it exceptionally difficult to analyze and detect.
• The malware utilizes a domain generation algorithm (DGA) for daily changing command-and-control (C2) infrastructure and abuses legitimate Microsoft binaries to evade security tools.
• Security researchers at Zscaler ThreatLabz identified MLTBackdoor in May 2026, linking it to ransomware-affiliated threat actors.

Advanced MLTBackdoor Malware Leverages ClickFix Campaign for Covert Infiltration

A new and highly advanced backdoor, named MLTBackdoor, has emerged as a significant concern for cybersecurity professionals. Discovered in May 2026, this malware operates through a complex, multi-stage infection process designed to bypass conventional security measures and establish a persistent presence on compromised systems. Its sophisticated evasion techniques and ability to blend into normal network traffic make it particularly challenging to detect and eradicate.

The initial vector for this threat is a social engineering tactic known as ClickFix. Attackers host a deceptive prompt, often on automotive-themed websites, enticing users to copy and execute a seemingly innocuous command. This seemingly simple user action triggers the entire malicious chain, leading to the silent download, decryption, and installation of the MLTBackdoor deep within the victim’s environment.

According to researchers at Zscaler ThreatLabz, who first identified and analyzed the malware, MLTBackdoor is likely being utilized by threat actors associated with ransomware operations. Zscaler’s report, shared with Cyber Security News (CSN), highlights the malware’s primary objective: to secure a robust foothold within a target network, enabling attackers to conduct further reconnaissance and lateral movement.

Deep Evasion and Resilience Mechanisms

MLTBackdoor’s most striking characteristic is its extensive use of obfuscation to hinder analysis. Approximately 95% of its codebase consists of superfluous mathematical operations, intentionally designed to confuse and prolong reverse engineering efforts. Furthermore, the malware employs control flow flattening, a technique that transforms straightforward program logic into a convoluted, non-linear structure, rendering it exceptionally difficult for analysts to trace execution paths.

Adding to its resilience, the malware integrates a domain generation algorithm (DGA). This DGA dynamically creates a new command-and-control (C2) domain daily. This capability ensures that even if security teams identify and block one C2 domain, MLTBackdoor can seamlessly switch to a newly generated one, maintaining communication with its operators without interruption.

The Multi-Stage ClickFix Infection Chain

The infection sequence is a carefully orchestrated process that activates the moment a user falls for the ClickFix prompt. The executed command discreetly creates a hidden directory, retrieves a disguised archive from a DGA-generated domain, and then exploits a legitimate Microsoft Defender binary, mpextms.exe, for DLL sideloading. This technique allows the malware to load its malicious dynamic-link library (DLL) while appearing to be a trusted system process, thereby circumventing basic security detections.

Within the downloaded archive, two critical files reside: data.bin and endpointdlp.dll. The endpointdlp.dll is responsible for decrypting the RC4-encrypted data.bin, which contains the MLTBackdoor’s second-stage payload. Following its installation, the backdoor executes a self-update routine and reuses the endpointdlp.dll filename, further camouflaging its presence on the compromised system.

Once operational, MLTBackdoor establishes communication over port 443, utilizing a custom encrypted binary protocol. This traffic is designed to mimic legitimate system activity, often employing a Microsoft-style user-agent string and a fixed API path. This sophisticated masquerading makes it exceedingly difficult for network monitoring tools to flag its C2 communications as malicious.

Pre-Execution Checks and Dynamic Capabilities

Before initiating its core malicious functions, MLTBackdoor conducts a comprehensive set of ten environment checks. These checks include scans for virtual machines, debuggers, known analysis tools, and sandbox drivers. It also verifies system specifications such as RAM (checking for less than two gigabytes) and processor count (checking for a single processor). The results of these checks are compiled into a bitmask and transmitted to the attacker’s server during the initial check-in, providing operators with detailed intelligence about the target’s environment.

Beyond its advanced stealth, MLTBackdoor possesses a robust set of built-in commands, enabling attackers to perform various operations such as file download and upload, directory listing, and file/folder manipulation (deletion, renaming, creation). A particularly potent feature is its Beacon Object File (BOF) loader. This allows threat actors to inject custom code modules directly into the malware’s memory at runtime, expanding its functionalities without leaving any persistent files on disk, thereby significantly increasing its evasiveness.

What You Should Do

• Block Known Indicators of Compromise (IoCs): Immediately implement blocks for all identified domains, IP addresses, and file hashes associated with MLTBackdoor and the ClickFix campaign.
• Monitor for DLL Sideloading: Actively monitor for unusual execution patterns or suspicious loading of DLLs by legitimate Microsoft binaries, particularly mpextms.exe.
• Enhance Social Engineering Defenses: Update threat detection rules and educate users about ClickFix-style social engineering attacks, emphasizing caution when copying and executing commands from untrusted websites.
• Network Traffic Analysis: Scrutinize outbound connections on port 443 for unusual user-agent strings or API paths that do not align with expected legitimate traffic, as these could indicate MLTBackdoor C2 communications.
• Regular Security Updates: Ensure all operating systems, applications, and security software are kept up-to-date with the latest patches to mitigate potential exploitation pathways.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.