MalwarePublished 12 Sep 2025Updated 12 Oct 2025

Deconstructing a Cyber Deception: An Analysis of the Clickfix HijackLoader Phishing Campaign

Source AlienVault OTX General

Description

This analysis delves into the HijackLoader malware campaign, which has gained prominence since 2023 for its sophisticated payload delivery and evasion techniques. The campaign initiates with a CAPTCHA-based phishing attack, progressing through multiple stages of obfuscated PowerShell scripts. It employs advanced anti-analysis methods, including anti-VM checks and registry manipulation. The final payload, typically an infostealer like NekoStealer or Lumma, is delivered via a multi-stage process involving packed .NET executables and protected DLLs. The loader's evolution and its role in the broader malware-as-a-service ecosystem underscore the need for organizations to focus on detecting initial access and intermediate stages rather than just final payloads.

Impact

For European organizations, the Clickfix HijackLoader campaign poses a significant risk to confidentiality and operational security. The infostealer payloads can exfiltrate sensitive corporate data, including user credentials, personal identifiable information (PII), and intellectual property, potentially leading to identity theft, financial fraud, and corporate espionage. The multi-stage and obfuscated nature of the attack complicates detection, increasing the likelihood of prolonged undetected presence within networks. This can result in lateral movement, privilege escalation, and further compromise of critical systems. The campaign’s use of phishing as an initial vector exploits human vulnerabilities, which remain a persistent challenge despite technical controls. Given the campaign’s malware-as-a-service nature, it can rapidly adapt and target various sectors, including finance, healthcare, government, and critical infrastructure, all of which are prominent in Europe. The campaign’s evasion techniques may also hinder incident response and forensic investigations, delaying remediation efforts and increasing potential damage. Additionally, the presence of protected DLLs and packed executables complicates signature-based detection, necessitating more advanced behavioral and heuristic analysis methods.

Defensive guidance

European organizations should implement a layered defense strategy focusing on early detection and prevention of initial access and intermediate stages. Specific recommendations include: 1) Enhance phishing defenses by deploying advanced email filtering solutions that incorporate machine learning to detect CAPTCHA-based and obfuscated phishing attempts; 2) Conduct regular user awareness training emphasizing the risks of phishing and the importance of verifying unexpected CAPTCHA challenges or links; 3) Deploy endpoint detection and response (EDR) solutions capable of monitoring and analyzing PowerShell script execution, particularly obfuscated or multi-stage scripts; 4) Implement application whitelisting and restrict execution of unauthorized .NET executables and DLLs; 5) Monitor registry changes and unusual system behaviors indicative of anti-VM or anti-analysis techniques; 6) Utilize network traffic analysis tools to detect anomalous outbound connections, especially to known malicious domains and IPs associated with the campaign; 7) Maintain up-to-date threat intelligence feeds and integrate indicators of compromise (IOCs) such as file hashes, domains, and IP addresses into security monitoring systems; 8) Conduct regular incident response drills simulating multi-stage malware infections to improve detection and containment capabilities; 9) Employ sandbox environments with enhanced evasion detection to analyze suspicious files and scripts; 10) Enforce the principle of least privilege to limit the impact of credential theft and lateral movement.

Indicators of compromise

Domains 3

cosi.com.ar
1h.vuregyy1.ru
rs.mezi.bet

IP addresses 1

91.212.166.51

Hashes 14

86b32049a679b945a803b32e58ba9462
cd0c6cb4807f5266df4c34846e5a3250
b9df6e383de60d6c91d4953face7ba335af78481
d94a15b3585336943154dae4ae5f2b78975b4a74
1b272eb601bd48d296995d73f2cdda54ae5f9fa534efc5a6f1dab3e879014b57
3552b1fded77d4c0ec440f596de12f33be29c5a0b5463fd157c0d27259e5a2df
37fc6016eea22ac5692694835dda5e590dc68412ac3a1523ba2792428053fbf4
50258134199482753e9ba3e04d8265d5f64d73a5099f689abcd1c93b5a1b80ee
52273e057552d886effa29cd2e78836e906ca167f65dd8a6b6a6c1708ffdfcfd
782b07c9af047cdeda6ba036cfc30c5be8edfbbf0d22f2c110fd0eb1a1a8e57d

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 12 Sep 2025, 19:32 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 1

Hashes 14

Community reviews

Related threats