From Fake Amazon Security Alert to HarborWatch Agent: ClickFix Delivery of a Custom Monitoring RAT

A sophisticated phishing campaign exploits Amazon's brand reputation through spoofed security alerts to deliver HarborWatch Agent, a custom remote access trojan. The attack chain begins with emails impersonating Amazon security notifications about suspicious account activity, directing victims to lookalike domains. Users are presented with fake CAPTCHA verification pages that employ ClickFix social engineering techniques, instructing them to execute PowerShell commands on their own systems. The multi-stage infection downloads mysql.exe from compromised infrastructure, which communicates with a Chinese-language command and control panel branded Harbor Sentinel. The RAT collects extensive system information including OS details, architecture, CPU count, disk usage, memory status, and network configurations, exfiltrating data through API endpoints to the threat actor's monitoring infrastructure.

• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• third-party.com Placeholder Domain Now Serves ClickFixCampaign2026-09-24
• Disposable Domains, Durable HostingMalware2026-09-23
• Beware of the LegionLoader malware being distributed via the ClickFix methodMalware2026-09-11
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21