The ClickFix campaign delivers a NodeJS-based infostealer and RAT to Windows systems via malicious MSI installers. Its modular architecture loads core stealing modules and communication protocols dynamically in-memory only after establishing a C2 connection, minimizing forensic footprints. Communication is routed over Tor using gRPC streaming to maintain stealthy, persistent channels. An operational security lapse exposed the server-side admin panel protocol definitions, revealing a MaaS backend designed to support multiple operators and automate cryptocurrency theft tracking. The malware executes malicious logic dynamically as strings in-memory, bypassing static detection and enabling full RAT capabilities such as shell command execution and wallet tracking.

This malware enables attackers to remotely control infected Windows systems with full RAT functionality, including executing shell commands and stealing cryptocurrency wallet information. Its use of dynamic in-memory loading and Tor-based communication channels complicates detection and forensic analysis. The MaaS backend allows multiple operators to leverage the malware, potentially increasing the scale and automation of attacks targeting cryptocurrency assets.

No official patch or remediation is currently available for this malware. Mitigation should focus on preventing infection by blocking delivery vectors such as malicious MSI installers and monitoring for indicators of compromise including the provided domains, URLs, and file hashes. Network defenses should consider blocking or monitoring Tor network traffic and gRPC streaming connections associated with this threat. Since the malware uses dynamic in-memory execution, traditional signature-based detection may be insufficient; behavioral and heuristic detection methods are recommended. Review and strengthen operational security to prevent exposure of backend infrastructure.