ClickFix Keeps Evolving: Rundll32 Ordinal Execution over WebDAV

A sophisticated ClickFix campaign variant uses social engineering to trick victims into executing commands via the Windows Run dialog. The technique leverages rundll32.exe to load remote non-DLL payloads by ordinal export #1 over WebDAV connections tunneled through HTTPS port 443. Multiple incidents at a single organization show evolving obfuscation methods including WMI process spawning, caret insertion, and runtime string assembly to evade detection. The attack chain utilizes trusted Windows binaries like pcalua.exe to break process lineage tracking. No files are dropped to disk, and payloads are invoked by ordinal rather than named functions. Successful attacks exfiltrated browser credentials and sensitive documents totaling 13MB. The most obfuscated variant evaded automated EDR detection entirely, being discovered only through proactive threat hunting focused on ordinal execution patterns rather than keyword detection.

• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• How VBScript Malware Evades Detection Using Trusted Tools CopyMalware2026-10-27
• DarkCore: A Data-Theft RAT With a Session-Hijacking BrowserMalware2026-10-27
• Tricks from the Past deployed via signed ChatGPT and Claude binariesMalware2026-10-27
• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26