MalwarePublished 16 Mar 2026Updated 15 Apr 2026

Investigating a new Click-fix variant

Source AlienVault OTX General

Description

A new variant of the ClickFix technique has been identified, where attackers convince users to execute malicious commands on their devices through the Win + R shortcut. This variation uses a 'net use' command to map a network drive from an external server, followed by executing a '.cmd' batch file. The script downloads a ZIP archive, unpacks it, and executes a legitimate WorkFlowy application with modified, malicious logic hidden inside an '.asar' archive. This acts as a C2 beacon and a dropper for the final malware payload. The attack bypasses typical detection methods and utilizes Electron application bundling to hide malicious code.

Impact

If successfully executed, this malware variant can lead to unauthorized remote control of infected systems, data exfiltration, and deployment of additional malicious payloads. The use of legitimate software with embedded malicious logic complicates detection and response, potentially allowing attackers to maintain persistence and evade security controls for extended periods. Organizations may face data breaches, intellectual property theft, operational disruption, and reputational damage. The attack requires user interaction, which limits automated spread but increases risk in environments with less security awareness or insufficient endpoint protections. The stealthy nature of the Electron app-based payload and the use of network drive mapping can bypass traditional endpoint detection and network monitoring tools, increasing the likelihood of prolonged undetected compromise. This threat is particularly concerning for organizations relying on Windows environments and those that allow execution of scripts and network drive mappings without strict controls.

Defensive guidance

To mitigate this threat, organizations should implement strict endpoint security policies that restrict execution of scripts and commands via Win + R or other shortcuts, especially those involving network drive mappings. Employ application whitelisting to prevent execution of unauthorized batch files and modified Electron applications. Enhance user awareness training focused on the risks of executing unsolicited commands or scripts, particularly those initiated via social engineering. Monitor and restrict use of 'net use' commands and network drive mappings from untrusted external sources. Deploy advanced endpoint detection and response (EDR) solutions capable of analyzing Electron app behaviors and detecting anomalous '.asar' archive modifications. Regularly audit startup and autostart locations (registry run keys, startup folders) for unauthorized entries. Use network monitoring to detect suspicious communications to known malicious domains and IP addresses such as cloudflare.report and 144.31.165.173. Maintain up-to-date threat intelligence feeds to identify and block indicators of compromise associated with this attack. Finally, restrict user privileges to prevent execution of commands requiring elevated rights and enforce the principle of least privilege.

Indicators of compromise

Domains 2

cloudflare.report
happyglamper.ro

URLs 2

http://cloudflare.report/forever/e/
https://cloudflare.report/forever/e/

IP addresses 1

144.31.165.173

Hashes 3

9ee58eb59e337c06429ff3f0afd0ee6886b0644ddd4531305b269e97ad2b8d42
a390fe045f50a0697b14160132dfa124c7f92d85c18fba07df351c2fcfc11063
dc95f7c7fb98ec30d3cb03963865a11d1b7b696e34f163b8de45f828b62ec829

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Mar 2026, 11:21 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details