ClickFix Gets Creative: Malware Buried in Images

What it is

A Huntress writeup of a ClickFix campaign (observed since early October) delivering LummaC2 and Rhadamanthys infostealers through a five-stage chain. The summary covers the steganography; what it does not carry is the concrete IOCs, the two distinct lure variants, and the client-side JavaScript evasion that hides the initial command.

How it works

Two lure variants have been seen feeding the same steganographic loader: the original "Human Verification"/robot-check page, and a newer full-screen fake Windows Update splash with "Working on updates" animations that ends by prompting Win+R → paste → run.

The lure page ships a portion of its JavaScript encrypted in an ENC variable, with keys derived from KEY_HEX via hexToKey(); a rolling xorDecode() reconstructs the plaintext script. The decrypted code is wrapped in a Blob, injected via a blob: URL (the same technique Violentmonkey uses), and the blob URL is revoked on load (URL.revokeObjectURL) to erase traces. The final in-memory script uses navigator.clipboard.writeText() to plant the mshta command. This means the malicious string never appears statically in page source — string-based detections on the lure page will miss it.

From there: mshta.exe fetches JScript → in-memory PowerShell → XOR-decrypted, reflectively loaded .NET assembly → a stego loader assembly whose entry point drkdbVkywZ() calls a chain of 10,000 empty functions as an anti-analysis tramp before rebuilding shellcode from PNG color channels.

flowchart TD
  A[Lure: Human Verify OR fake Windows Update] --> B[Encrypted JS decrypted via blob URL]
  B --> C[clipboard: mshta command]
  C --> D[mshta.exe → in-memory PowerShell]
  D --> E[XOR-decrypted .NET assembly, reflectively loaded]
  E --> F[Stego loader: shellcode from PNG pixels]

Indicators

From the incident described (all defanged in source):

• Lure host: hXXps://f6b04000.consent-verify.pages[.]dev/ (now down)
• Clipboard command: mshta hXXp://81.0x5a.29[.]64/ebc/rps.gz (note the mixed-radix octal/hex IP obfuscation 81.0x5a.29.64)
• PowerShell stage host: hXXp://corezea[.]com/ebc

What to do

The page gives no explicit detections or mitigations in the fetched portion. The actionable hooks are behavioral: watch for mshta.exe spawning from explorer.exe/Run-dialog context fetching remote .gz payloads, PowerShell reflectively loading assemblies, and clipboard-write followed by Win+R execution — the ClickFix signature. Block the domains/IP above.

Caveats

The fetched text is truncated at Stage 3 (Figure 13); later stages, full IOC lists, and any formal detection guidance from the original post are not present here. Only one incident's indicators are given — treat them as campaign samples, not an exhaustive list.