A phishing campaign exploits Amazon's brand by sending spoofed security alert emails directing victims to lookalike domains with fake CAPTCHA pages. These pages use ClickFix social engineering techniques to convince users to execute PowerShell commands, which download and run a custom RAT named HarborWatch Agent. The RAT downloads a component named mysql.exe from compromised infrastructure and communicates with a Chinese-language command and control panel called Harbor Sentinel. It collects extensive system information including OS details, CPU count, disk usage, memory status, and network configurations, then exfiltrates this data via API endpoints to the attacker’s monitoring infrastructure. No CVE or specific vulnerable software versions are associated with this threat.

The impact includes unauthorized remote access to infected systems, extensive system reconnaissance, and data exfiltration to attacker-controlled infrastructure. This compromises confidentiality and potentially enables further malicious activities. The threat actor gains persistent monitoring capabilities over victim systems through the HarborWatch Agent RAT.

No official patch or remediation is available as this is a phishing and social engineering attack delivering malware. Mitigation focuses on user awareness to recognize phishing emails and avoid executing unsolicited PowerShell commands. Organizations should block and monitor access to the identified malicious domains and URLs. Endpoint detection and response solutions should be updated to detect the HarborWatch Agent and associated indicators of compromise. Since this is not a software vulnerability, patching is not applicable.