CampaignPublished 23 Apr 2026Updated 23 May 2026

Beyond PowerShell: Analyzing the Multi-Action ClickFix Variant

Source AlienVault OTX General

Description

This analysis documents a newly observed ClickFix variant that abuses native Windows utilities, specifically cmdkey and regsvr32, for payload delivery. Victims are socially engineered through fake CAPTCHA pages to execute a malicious command via the Windows Run dialog. The single command chains multiple actions: staging credentials using cmdkey, retrieving a remote DLL via regsvr32 from a UNC path, and executing it silently. The 64-bit DLL establishes persistence through a scheduled task pulled from a remote XML file hosted on attacker infrastructure. This approach avoids traditional malware drops and leverages exclusively trusted Windows components for high stealth. The variant demonstrates continued evolution of ClickFix techniques, moving beyond PowerShell to use command chaining with legitimate system tools.

Impact

The campaign enables attackers to execute arbitrary code on victim machines with high stealth by abusing trusted Windows utilities and avoiding traditional malware files. The chained command execution can lead to credential theft, remote DLL execution, and persistent access via scheduled tasks. This can facilitate further compromise and lateral movement within affected environments. The social engineering vector (fake CAPTCHA pages) targets user interaction to initiate the attack. No direct evidence of widespread exploitation or known active threat actors is reported.

Defensive guidance

Since the attack relies on social engineering to trick users into running commands via the Windows Run dialog, user awareness training to recognize and avoid fake CAPTCHA pages is critical. Restricting or monitoring the use of cmdkey and regsvr32, especially from untrusted sources or UNC paths, can help reduce risk. Implementing application control policies to limit execution of regsvr32 with remote DLLs and scheduled task creation from untrusted XML files may mitigate this threat.

Summary

This ClickFix variant uses social engineering to trick victims into executing a single chained command via the Windows Run dialog. The command leverages cmdkey to stage credentials, then uses regsvr32 to fetch and silently execute a remote DLL from a UNC network path. The DLL is 64-bit and establishes persistence by creating a scheduled task based on a remote XML configuration hosted on attacker infrastructure. This approach avoids dropping traditional malware files on disk and relies exclusively on trusted Windows utilities (cmdkey, regsvr32, scheduled tasks) to evade detection. The campaign demonstrates an evolution from prior PowerShell-based ClickFix variants to a multi-action command chaining technique using legitimate system tools (living-off-the-land binaries). No known exploits in the wild or specific threat actors are identified.

Indicators of compromise

IP addresses 1

CC=IR ASN=AS58224 iran telecommunication company pjs

151.245.195.142

Hashes 2

b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108
b2d9a99de44a7cd8faf396d0482268369d14a315edaf18a36fa273ffd5500108

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 23 Apr 2026, 09:21 UTC

MITRE ATT&CK techniques14 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 2

Community reviews

Related threats