Critical Microsoft ClickOnce flaw lets attackers install malware

Key Takeaways

• A recent attack campaign leveraged a social engineering technique called “ClickFix” to trick users into executing malicious commands.
• The campaign successfully compromised over 11 systems within an organization, deploying two sophisticated remote access tools: RMMProject and EtherRAT.
• Initial access was gained through an unmonitored endpoint, highlighting critical gaps in endpoint security.
• Attackers demonstrated advanced hands-on-keyboard capabilities, including evasion of Windows Defender and lateral movement across the network.

Sophisticated ClickFix Campaign Infiltrates Enterprise, Deploys Dual RATs

Cybersecurity researchers have uncovered a cunning attack campaign that exploited a deceptive “ClickFix” prompt to breach an organization’s network, ultimately compromising more than 11 systems and installing two distinct remote access tools (RATs). This advanced operation, dubbed “ClickFix,” relies on social engineering to persuade users to execute malicious commands, as detailed in a recent analysis.

The “ClickFix” tactic involves presenting users with a fake troubleshooting guide on a compromised website. This guide instructs the user to open the Windows Run dialog (Win+R), paste a provided command, and press Enter. The prompt is designed to appear as a legitimate system fix, exploiting user trust in authoritative-looking instructions to facilitate initial infection.

Initial Infiltration and Malware Deployment

The campaign, identified by researchers at Huntress in May 2026, began on an unmonitored endpoint. The absence of an endpoint agent on this initial machine allowed the attackers to operate undetected for a significant period, enabling a full “hands-on-keyboard” intrusion that spread across the victim’s network.

The infection chain commenced when a user, following the ClickFix instructions, executed a command utilizing pcalua.exe, a legitimate Windows utility. This action silently triggered the fetching and execution of a remote script. The script then proceeded to download and install an MSI package in the background, without any visible indication to the user.

This MSI package dropped a custom loader, named Potemkin by the researchers. Potemkin established a connection to a command-and-control (C2) server and subsequently loaded a comprehensive remote access tool known as RMMProject entirely into memory. RMMProject is a 4.4 MB DLL equipped with 15 task types, including browser credential theft, cookie stealing from Chrome, Firefox, and Edge, a hidden remote desktop module, and process injection capabilities.

In parallel, the attackers deployed EtherRAT, a Node.js-based backdoor that leverages the Ethereum blockchain to retrieve its C2 server address. This novel approach to C2 communication makes EtherRAT particularly resilient to traditional domain takedown efforts, complicating disruption by security teams.

According to a report by Huntress shared with Cyber Security News (CSN), the intrusion rapidly escalated. The threat actor moved laterally across the network using tools like WMIExec and SMBExec, actively combating Windows Defender. Ultimately, they succeeded in disabling the antivirus service, allowing EtherRAT to spread to over 11 hosts.

Attack Mechanics: From ClickFix to Persistent Access

The ClickFix attack initiated with a command that abused pcalua.exe to proxy mshta.exe, which then fetched a remote HTA file from cl.distritovagas[.]com. This HTA payload silently downloaded the MSI installer, inst24.msi, from an attacker-controlled server and executed it without any user prompts.

The MSI installer deployed the Potemkin loader into the user’s AppData folder and established persistence by registering a startup registry key, ensuring its survival across system reboots. Potemkin is a highly efficient loader, featuring a Domain Generation Algorithm (DGA) that can produce 10,000 potential domains from an embedded word list, probing each until a live C2 server is identified. Upon successful connection, Potemkin’s sole function is to fetch and reflectively load the RMMProject RAT.

Approximately five hours after the initial compromise, the attacker introduced EtherRAT and established a Cloudflare tunnel using a renamed copy of cloudflared. This provided a persistent, internet-reachable access point into the compromised network, further entrenching their presence.

Hands-On Intrusion and Defender Evasion

Once inside the network, a human operator took direct control, engaging in manual reconnaissance and lateral movement. They leveraged compromised Administrator credentials, performed reconnaissance activities consistent with the Impacket toolkit, and moved to the domain controller using WMIExec and SMBExec. The primary objective was to widely distribute EtherRAT across as many hosts as possible while simultaneously creating multiple redundant access paths.

The attacker made sustained efforts to neutralize Windows Defender throughout the intrusion. Their tactics included cycling through AMSI patches, manipulating registry policies, employing reflective in-memory loading, and abusing exclusion paths, before ultimately stopping the Defender service entirely. To ensure layered persistence against individual detections, they established a reverse shell on port 43301 and multiple Chisel SOCKS tunnels.

Huntress strongly advises organizations to conduct an immediate audit of their endpoint security coverage, particularly given that this sophisticated intrusion originated on a machine lacking any monitoring agent. Disabling the Windows Run dialog via Group Policy is recommended to eliminate the ClickFix entry point, as the attack’s success hinges on users pasting commands into this dialog. Furthermore, security teams should configure alerts for the presence of cloudflared or its renamed copies on endpoints. Any instances of Stop-Service WinDefend or bulk Add-MpPreference exclusion commands should be treated as high-confidence threat indicators.

What You Should Do

• Audit Endpoint Coverage: Immediately assess all endpoints to ensure comprehensive security agent deployment.
• Disable Windows Run Dialog: Consider disabling the Windows Run dialog through Group Policy if it’s not critical for your operational environment, as this removes a key entry point for ClickFix attacks.
• Monitor for Cloudflared: Implement alerts for the presence of cloudflared or any renamed variants on endpoints.
• Alert on Defender Tampering: Configure high-priority alerts for actions like Stop-Service WinDefend and bulk Add-MpPreference exclusion commands, as these are strong indicators of malicious activity.
• User Awareness Training: Educate users about social engineering tactics like ClickFix, emphasizing caution when encountering unexpected troubleshooting prompts or commands on websites.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.