MalwarePublished 11 Aug 2025

From ClickFix to Command: A Full PowerShell Attack Chain

Source AlienVault OTX General

Description

A targeted intrusion campaign impacting Israeli organizations has been identified, leveraging compromised internal email infrastructure to distribute phishing messages. The attack uses a multi-stage, PowerShell-based infection chain, culminating in the delivery of a remote access trojan (RAT). Key characteristics include a full PowerShell-based delivery chain, obfuscated payloads, evidence of lateral movement, and potential overlap with MuddyWater campaigns. The attack begins with phishing emails, progresses through a spoofed Microsoft Teams page, and uses social engineering to execute malicious PowerShell commands. The payload retrieves additional data, deploys a RAT, and establishes communication with a command and control server. The campaign demonstrates the effectiveness of living-off-the-land techniques, layered evasion, and adaptive C2 communication.

Impact

For European organizations, this threat poses a significant risk especially to entities with business or strategic ties to Israeli organizations or those with similar email infrastructure and collaboration platforms like Microsoft Teams. The use of phishing and social engineering to initiate the attack chain means that human factors remain a critical vulnerability. Once inside the network, the PowerShell-based infection chain and RAT deployment can lead to unauthorized data access, espionage, disruption of operations, and potential lateral movement to critical systems. The living-off-the-land approach complicates detection and response, increasing the dwell time of attackers. European organizations with insufficient email security, weak endpoint protection, or limited monitoring of PowerShell activity could be vulnerable to similar campaigns, particularly if threat actors adapt the campaign to local targets. The impact includes potential confidentiality breaches, integrity compromise of data, and availability disruptions due to malware activity or subsequent attacker actions. Given the medium severity rating, the threat is serious but may require specific conditions such as successful phishing and user interaction to fully exploit.

Defensive guidance

1. Enhance email security by deploying advanced anti-phishing solutions that include URL rewriting, attachment sandboxing, and anomaly detection to identify and block phishing attempts leveraging internal email infrastructure. 2. Implement strict PowerShell execution policies and enable logging of all PowerShell commands and scripts, with real-time monitoring and alerting for suspicious or obfuscated commands. 3. Conduct regular user awareness training focused on recognizing phishing emails, especially those impersonating trusted collaboration platforms like Microsoft Teams. 4. Employ endpoint detection and response (EDR) solutions capable of detecting living-off-the-land techniques and lateral movement behaviors. 5. Restrict the use of PowerShell to only authorized administrators and enforce application whitelisting to prevent unauthorized script execution. 6. Monitor network traffic for unusual outbound connections to suspicious domains such as pharmacynod.com and block known malicious indicators. 7. Regularly review and harden internal email infrastructure configurations to prevent compromise and unauthorized use. 8. Conduct threat hunting exercises focusing on the MITRE ATT&CK techniques identified in this campaign to proactively detect early signs of compromise. 9. Maintain up-to-date backups and incident response plans tailored to malware and RAT infections to enable rapid recovery.

Indicators of compromise

Domains 1

pharmacynod.com

Hashes 1

46a76b3c7851f30d68ebc6a5584bc099435b0544d8707fff7a9178f46046708b

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 11 Aug 2025, 16:03 UTC

MITRE ATT&CK techniques18 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 1

Community reviews

Related threats