This newly identified ClickFix variant represents an evolution in social engineering and malware delivery tactics. The attack begins by tricking users into pressing Win + R and executing a crafted command that uses 'net use' to map a network drive from an attacker-controlled external server. This mapped drive hosts a malicious batch (.cmd) script that, once executed, downloads a ZIP archive containing a modified version of the legitimate WorkFlowy application. WorkFlowy is an Electron-based app, and the attackers have embedded malicious code within its '.asar' archive, a packaging format used by Electron apps. This embedded code functions as a command-and-control (C2) beacon, enabling communication with attacker infrastructure, and also acts as a dropper to deploy the final malware payload onto the victim's system. The use of Electron app bundling and legitimate software helps the malware evade signature-based detection and behavioral monitoring. The attack chain involves multiple stages: social engineering to initiate execution, network drive mapping to access malicious resources, script execution to download and unpack payloads, and finally, execution of the trojanized Electron app. Indicators of compromise include specific file hashes, IP 144.31.165.173, domains such as cloudflare.report and happyglamper.ro, and URLs linked to the attack. Although no active exploits have been reported in the wild, the technique’s reliance on user execution and its stealthy nature pose a significant risk. The attack leverages several MITRE ATT&CK techniques, including T1204.002 (User Execution), T1059 (Command and Scripting Interpreter), T1140 (Deobfuscate/Decode Files or Information), T1041 (Exfiltration Over C2 Channel), and T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder), among others.

If successfully executed, this malware variant can lead to unauthorized remote control of infected systems, data exfiltration, and deployment of additional malicious payloads. The use of legitimate software with embedded malicious logic complicates detection and response, potentially allowing attackers to maintain persistence and evade security controls for extended periods. Organizations may face data breaches, intellectual property theft, operational disruption, and reputational damage. The attack requires user interaction, which limits automated spread but increases risk in environments with less security awareness or insufficient endpoint protections. The stealthy nature of the Electron app-based payload and the use of network drive mapping can bypass traditional endpoint detection and network monitoring tools, increasing the likelihood of prolonged undetected compromise. This threat is particularly concerning for organizations relying on Windows environments and those that allow execution of scripts and network drive mappings without strict controls.

To mitigate this threat, organizations should implement strict endpoint security policies that restrict execution of scripts and commands via Win + R or other shortcuts, especially those involving network drive mappings. Employ application whitelisting to prevent execution of unauthorized batch files and modified Electron applications. Enhance user awareness training focused on the risks of executing unsolicited commands or scripts, particularly those initiated via social engineering. Monitor and restrict use of 'net use' commands and network drive mappings from untrusted external sources. Deploy advanced endpoint detection and response (EDR) solutions capable of analyzing Electron app behaviors and detecting anomalous '.asar' archive modifications. Regularly audit startup and autostart locations (registry run keys, startup folders) for unauthorized entries. Use network monitoring to detect suspicious communications to known malicious domains and IP addresses such as cloudflare.report and 144.31.165.173. Maintain up-to-date threat intelligence feeds to identify and block indicators of compromise associated with this attack. Finally, restrict user privileges to prevent execution of commands requiring elevated rights and enforce the principle of least privilege.