Beware of the New ‘Executive Award’ Campaign That Uses ClickFix to Deliver Stealerium Malware
A recent phishing campaign has emerged, targeting organizations with a deceptive "Executive Award" theme. This operation combines social engineering tactics with advanced malware delivery methods.
A recent phishing campaign has emerged, targeting organizations with a deceptive "Executive Award" theme. This operation combines social engineering tactics with advanced malware delivery methods.
The attack is executed in two stages. Initially, users are deceived into providing their login credentials through a fraudulent HTML form. Subsequently, the Stealerium information stealer is deployed, compromising affected systems.
The campaign exemplifies a growing trend where attackers integrate credential theft with malware infections in a single coordinated operation.
The attack initiates with a sophisticated HTML phishing page titled "Virtual-Gift-Card-Claim.html," which emulates a legitimate corporate award notification. Users interacting with this page are misled into believing they are verifying their account credentials to claim an executive award. In reality, their login information is sent to a Telegram command-and-control server managed by the attackers.
This credential harvesting phase is the first stage of the infection chain.
A recent phishing campaign has emerged, targeting organizations with a deceptive "Executive Award" theme.
Security analysts from SpiderLabs identified the malware by analyzing the campaign's infrastructure and attack patterns. Upon falling for the phishing page, users receive a malicious SVG file named "account-verification-form.svg." This file triggers a PowerShell script via the ClickFix exploit chain, a technique exploiting Windows messaging systems to execute hidden commands.
The PowerShell code downloads and installs the Stealerium infostealer on the victim's computer without their knowledge or consent. Stealerium extracts sensitive information silently from infected systems.
The malware communicates with command-and-control servers at 31.57.147.77:6464 and uses multiple download endpoints for retrieving additional components and commands. This architecture allows attackers to adapt their attack based on system conditions and existing security measures.
Understanding the Infection Mechanism and PowerShell Execution
The attack exploits legitimate Windows features against users. When the malicious SVG file opens, the embedded PowerShell commands execute with minimal visibility. The ClickFix chain abuses Windows messaging protocols to trigger execution without raising typical security alerts.
Following this, Stealerium downloads additional components, including the primary DLL file, batch scripts, and command executables. The malware establishes persistence, ensuring it survives system restarts and continues data extraction. Organizations should monitor for unusual PowerShell activity, suspicious SVG file executions, and network connections to the identified command-and-control infrastructure at 31.57.147.77:6464.
Endpoint detection systems should be configured to flag attempts to execute PowerShell commands from non-standard sources. Network monitoring should block access to known malicious IP addresses and watch for DNS requests associated with this campaign.
Users should be cautious of unsolicited emails claiming executive recognition or award notifications, as these are effective social engineering vectors.
Based on reporting by Cyber Security News.