ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers

ClickFix attacks are moving beyond simple malware downloads, with recent investigations revealing executable payloads hidden inside PNG images and intrusions reaching Windows domain controllers.

The activity shows how a fake verification prompt can become the starting point for persistent access, credential theft, and movement across corporate networks.

The trick still depends on convincing someone to run a command copied from a webpage. Attackers now support that request with fake security checks, colored terminal messages, and animated progress bars, making malware installation look like a routine browser verification.

Huntress researchers identified these techniques across several investigations detailed in a November 10 report.

The findings describe separate attack chains, not one operation combining every technique. Researchers believe unrelated operators are adapting ClickFix because it continues to persuade users to execute malicious commands.

ClickFix Attacks Evolve

In one investigation, a pasted PowerShell command displayed a fake Cloudflare check while downloading an archive. Its contents included a signed Microsoft executable, a malicious DLL, and a batch script.

The script retrieved PNG images containing executable data inside their pixels, rebuilt the binaries on disk, and launched them.

Unlike earlier ClickFix image hiding techniques that concealed shellcode, this chain reconstructed complete executables. Scheduled tasks and registry Run keys maintained access afterward.

The image itself was not the trigger: the user’s command started the code responsible for extracting and running its hidden contents.

A separate September intrusion used DLL sideloading and Windows administration tools to reach a primary domain controller. After establishing persistence, the attacker examined domain trusts, administrator membership, and account details.

WinRM enabled lateral movement, followed by account creation and a second reverse SSH tunnel. Earlier incidents showed similar consequences. February activity delivered Matanbuchus 3.0 and AstarionRAT before reaching two domain controllers through PsExec.

May’s ClickFix MSI installation attack spread malware through administrative shares, compromising 11 hosts before containment.

Browser Cache Tricks and Defensive Priorities

Another investigation found commands tailored to Chrome, Firefox, or Brave. A compromised dental website first placed a file in the browser cache.

The pasted command searched for its exact 17,635-byte size, copied it into temporary storage, and executed it as a batch script. Huntress also observed DuskDesk, a Node.js remote access trojan disguised as management software.

Related Node.js ClickFix malware campaigns illustrate why administrators should examine unexpected scripting runtimes rather than trust an application’s appearance. DuskDesk used logon persistence and contacted a potential command server.

Huntress recommends teaching users never to paste webpage instructions into terminals, restricting untrusted execution, and monitoring encoded PowerShell, new persistence entries, and unexpected SSH traffic.

Detection should connect these behaviors rather than depend only on changing filenames or hashes.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers appeared first on Cyber Security News.