The threat campaign begins with a social engineering chain mimicking ClickFix, resulting in MSI execution and PowerShell staging. It installs and uses Deno to execute attacker-controlled JavaScript, followed by downloading a portable Python runtime, an install.pyc script, and an encrypted .MOa container. Decryption of the container reveals a 64-bit Windows PE payload that uses Steam Community profiles as a dead-drop resolver for C2 communications, with the profile title resolving to smokeenew.com. The malware also uses ip-api.com for network and geolocation profiling of victims. Functionalities include browser and cryptocurrency wallet data collection, clipboard and keylogging capabilities, Defender exclusion, UAC bypass and relaunch via ComputerDefaults.exe, and a mechanism to receive and install additional payload components named Krutyak.zip / usbmmidd_v2. The campaign is ongoing with no known exploits in the wild and no official patches, but blocking identified artifacts is advised.

The campaign enables attackers to execute arbitrary code on victim systems, collect sensitive browser and wallet data, perform clipboard and keylogging activities, evade detection by excluding itself from Defender scans, bypass User Account Control (UAC), and maintain persistent command and control via Steam Community dead-drop profiles. This can lead to credential theft, financial loss, and further system compromise. There are no known exploits in the wild reported, and no direct patch is available as this is a multi-stage attack leveraging social engineering and malware components.

No official patch or fix is available for this campaign as it relies on social engineering and multi-stage malware deployment. The vendor advisory does not indicate any 'no action required' or 'already mitigated' status. Recommended mitigations include blocking known malicious domains, URLs, IP addresses, and file hashes associated with this campaign. Monitoring for and preventing execution of MSI installers and PowerShell scripts from untrusted sources can reduce risk. Implementing endpoint detection rules to identify Deno usage for suspicious JavaScript execution and monitoring for UAC bypass attempts via ComputerDefaults.exe may help detect related activity.