MalwarePublished 18 Jun 2025Updated 29 Aug 2025

From ClickFix deception to information stealer deployment

Source AlienVault OTX General

Description

The article describes a surge in ClickFix campaigns using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware. It analyzes a multi-stage attack that begins with ClickFix social engineering, deploys GHOSTPULSE loader, and ultimately delivers ARECHCLIENT2, a potent remote access trojan and infostealer. The campaign exploits user psychology, bypasses traditional defenses, and has seen increased activity in 2025. The analysis covers the infection chain, technical details of GHOSTPULSE and ARECHCLIENT2, and the associated infrastructure. The attack targets a wide range of sensitive user data and system information, including cryptocurrency wallets, browser data, and system details.

Impact

For European organizations, the impact of this threat can be significant due to the sensitive nature of the data targeted and the stealthy infection chain. The theft of cryptocurrency wallets can lead to direct financial losses, while the exfiltration of browser data and system information can facilitate further attacks, including identity theft, corporate espionage, and unauthorized access to critical systems. The deployment of a RAT like ARECHCLIENT2 enables persistent remote access, allowing attackers to move laterally within networks, escalate privileges, and potentially disrupt operations. Given the campaign's reliance on social engineering, employees across various sectors are at risk, especially those with access to sensitive financial or personal data. The multi-stage attack complicates detection and mitigation, increasing the likelihood of prolonged undetected presence within networks. This can lead to regulatory compliance issues under GDPR due to data breaches, reputational damage, and financial penalties. Additionally, the targeting of cryptocurrency wallets is particularly relevant in Europe, where digital asset adoption is growing. The campaign's ability to bypass traditional defenses means that organizations relying solely on signature-based detection or basic endpoint protection may be insufficiently protected.

Defensive guidance

To effectively mitigate this threat, European organizations should implement a layered defense strategy that addresses both the social engineering vector and the technical malware components. Specific recommendations include: 1) Conduct targeted security awareness training focusing on the ClickFix social engineering tactics, emphasizing skepticism of unsolicited requests and verification procedures before executing any links or attachments. 2) Deploy advanced endpoint detection and response (EDR) solutions capable of detecting anomalous behaviors associated with GHOSTPULSE loader activities and ARECHCLIENT2 RAT operations, such as unusual PowerShell usage, DLL side-loading, and unauthorized ingress tool transfers. 3) Implement strict application control policies to prevent execution of unauthorized scripts and binaries, including PowerShell constrained language mode and script block logging to detect obfuscated or malicious scripts. 4) Utilize network segmentation to limit lateral movement opportunities for attackers who gain initial access. 5) Monitor network traffic for indicators of compromise related to known infrastructure associated with this campaign, leveraging threat intelligence feeds and indicators from sources like AlienVault and Elastic Security Labs. 6) Enforce multi-factor authentication (MFA) across all critical systems to reduce the impact of credential theft. 7) Regularly back up critical data and verify the integrity and restorability of backups to mitigate the risk of data loss or ransomware follow-on attacks. 8) Conduct regular vulnerability assessments and penetration testing to identify and remediate potential weaknesses that could be exploited in conjunction with social engineering attacks. 9) Establish incident response plans that include procedures for detecting and responding to multi-stage malware infections, ensuring rapid containment and eradication.

Indicators of compromise

Domains 2

contology.com
koonenmagaziner.click

URLs 3

https://clients.contology.com/captcha/
https://koonenmagaziner.click/counter/<IP_address
https://shorter.me/XOWyT'

IP addresses 38

45.141.87.249
185.156.72.80
45.141.86.159
45.141.87.212
107.189.18.56
107.189.24.67
143.110.230.167
144.172.101.228
144.172.94.120
144.172.97.2

Hashes 9

2d4fdba00b7f7b02408a8ea6c199037e
82cddf3a9bff315d8fc708e5f5f85f20
deb5bd989c9fdd5fe7f78f00a1216eb0
515af087591021580b0c6131cfbc21e2a98153e2
88cbe81096581d6ec1a060853a250c9a08d710b4
2ec47cbe6d03e6bdcccc63c936d1c8310c261755ae5485295fecac4836d7e56a
4dc5ba5014628ad0c85f6e8903de4dd3b49fed65796978988df8c128ba7e7de9
a8ba1e14249cdd9d806ef2d56bedd5fb09de920b6f78082d1af3634f4c136b90
f92b491d63bb77ed3b4c7741c8c15bdb7c44409f1f850c08dce170f5c8712d55

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2025, 12:49 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details