New ClickFix Attack Wave Targets Windows Systems to Deploy StealC Stealer

Cybersecurity: ClickFix Attack Overview

A recent campaign targeting Windows users employs fake CAPTCHA verification pages to deceive victims into executing harmful PowerShell commands. This operation, known as ClickFix, implements a multi-stage, fileless infection chain culminating in the deployment of StealC, a sophisticated information-stealer. The malware is capable of extracting credentials, cryptocurrency wallets, gaming accounts, emails, and detailed system fingerprints.

The attack initiates when users navigate to a compromised website where JavaScript is injected to display a fake Cloudflare verification page. Upon interaction, the page copies a malicious PowerShell command to the clipboard, advising the user to execute it as a security measure. This command performs in-memory execution, fetching additional scripts from attacker-controlled infrastructure without creating disk-based artifacts.

The initial PowerShell loader downloads shellcode from a remote IP and executes it directly in memory. The loader uses .NET reflection for dynamic API resolution, bypassing typical security controls focused on disk activity. The shellcode, identified as cptch.bin, is generated with the Donut framework to facilitate in-memory execution of the malware.

The final payload, StealC, is downloaded and injected into a legitimate Windows process such as svchost.exe . StealC is distributed via a malware-as-a-service model and employs encryption to obfuscate its components. It targets various browsers, cryptocurrency wallets, and system files, staging stolen data for exfiltration to a command-and-control server.

Category Indicator Description

IP Address 94.154.35.115 Stage 2 payload delivery

IP Address 91.92.240.219 PowerShell loader

IP Address 178.16.53.70 PowerShell loader

IP Address 91.92.240.190 StealC command-and-control server

URL hxxp[:]//94.154.35.115/user_profiles_photo/cptch.bin Stage 2 payload file

URL hxxp[:]//94.154.35.115/user_profiles_photo/cptchbuild.bin Additional payload file

URL hxxp[:]//91.92.240.219/ PowerShell loader host

URL hxxp[:]//91.92.240.190/fbfde0da45a9450b.php StealC command-and-control endpoint

URL hxxps[:]//goveanrs.org/jsrepo Suspicious JavaScript-hosting domain

URL hxxps[:]//madamelam.com Potential malicious redirect or payload domain

This attack highlights the need for enhanced user awareness, strict PowerShell logging, and behavioral monitoring of clipboard activity, network connections, and unusual process relationships.

Based on reporting by GBHackers.