MalwarePublished 16 Jun 2025Updated 16 Jul 2025

Fileless AsyncRAT Distributed Via Clickfix Technique Targeting German Speaking Users

Source AlienVault OTX General

Description

A fileless AsyncRAT campaign is targeting German-speaking users through Clickfix-themed websites. The attack uses a fake 'I'm not a robot' prompt to execute malicious PowerShell code, which downloads and runs obfuscated C# code in memory. This technique enables full remote access, credential theft, and data exfiltration without leaving traces on the disk. The malware establishes persistence via registry keys and communicates with a command and control server on port 4444. The campaign has been active since at least April 2025, primarily affecting German-speaking regions. Mitigation strategies include blocking suspicious PowerShell activity, monitoring registry changes, and implementing in-memory scanning for threats.

Impact

European organizations, especially those in German-speaking countries such as Germany, Austria, and parts of Switzerland, face significant risks from this campaign. The fileless nature of the malware reduces the likelihood of detection by conventional antivirus solutions, increasing the chance of prolonged undetected access. Compromise can lead to unauthorized remote control of critical systems, theft of sensitive credentials, and exfiltration of confidential data, potentially impacting business operations, intellectual property, and customer privacy. The persistence mechanism via registry keys means that infected systems may remain compromised even after reboots, complicating remediation efforts. The use of PowerShell and obfuscated C# code in memory also suggests that organizations relying heavily on Windows environments with PowerShell enabled are particularly vulnerable. The campaign’s targeting of German-speaking users indicates a focus on organizations with German language interfaces or localized websites, which may include government agencies, manufacturing, finance, and technology sectors prevalent in these regions. The exploitation of web-based social engineering (fake CAPTCHA) also implies that employees’ security awareness is a critical factor. Overall, the campaign poses a medium to high operational risk, with potential for data breaches, espionage, and disruption of services.

Defensive guidance

To effectively mitigate this threat, European organizations should implement targeted and advanced defensive measures beyond generic best practices. First, enforce strict PowerShell logging and enable PowerShell Constrained Language Mode or Application Control policies (e.g., AppLocker or Windows Defender Application Control) to restrict unauthorized script execution. Deploy endpoint detection and response (EDR) solutions capable of in-memory scanning and behavioral analysis to detect obfuscated code execution and process injection activities. Monitor and alert on suspicious registry modifications, particularly those related to persistence mechanisms (e.g., Run keys). Network defenses should include blocking outbound traffic to known malicious IP addresses and domains associated with the campaign (e.g., the listed 109.250.x.x IP range and namoet.de domain), and restricting or monitoring traffic on non-standard ports such as 4444. Conduct regular phishing and social engineering awareness training tailored to recognize fake CAPTCHA prompts and other web-based lures. Implement multi-factor authentication (MFA) to reduce the impact of credential theft. Regularly audit and harden browser and PowerShell configurations to limit script-based exploitation. Finally, maintain up-to-date threat intelligence feeds to quickly identify and respond to emerging indicators related to this campaign.

Indicators of compromise

Domains 1

namoet.de

URLs 2

http://namoet.de/x
http://namoet.de:80/x'

IP addresses 14

109.250.110.190
109.250.108.183
109.250.109.205
109.250.109.80
109.250.110.140
109.250.110.142
109.250.110.222
109.250.110.228
109.250.110.98
109.250.111.155

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Jun 2025, 15:21 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 1

URLs 2

IP addresses 14

Community reviews

Related threats