CampaignPublished 20 Feb 2026Updated 22 Mar 2026

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

Source AlienVault OTX General

Description

A sophisticated ClickFix campaign has been uncovered, compromising legitimate websites to deliver a multi-stage malware chain. The attack culminates in MIMICRAT, a custom remote access trojan with advanced capabilities. The campaign uses compromised sites across industries and geographies for delivery, employing a five-stage PowerShell chain that bypasses security measures before deploying a Lua-scripted shellcode loader. MIMICRAT, the final payload, is a native C++ RAT featuring malleable C2 profiles, Windows token theft, and SOCKS5 proxy functionality. The attack chain involves multiple compromised websites, obfuscated scripts, and sophisticated evasion techniques, demonstrating a high level of operational sophistication.

Impact

Organizations worldwide face risks including unauthorized remote access, credential and token theft, and the potential for attackers to use infected systems as proxies for further attacks. The Windows token theft capability enables privilege escalation and lateral movement within networks, increasing the potential for data breaches and system compromise. The SOCKS5 proxy feature allows attackers to anonymize their traffic and pivot within victim environments, complicating incident response and forensic investigations. The use of compromised legitimate websites as infection vectors increases the risk of widespread exposure, especially to organizations that rely on these sites or have users who visit them. This campaign could disrupt business operations, lead to data exfiltration, and facilitate further malware deployment or espionage activities. The multi-stage nature and obfuscation techniques may delay detection, allowing attackers prolonged access and control. Industries with high reliance on web services and those with less mature endpoint detection capabilities are particularly vulnerable.

Defensive guidance

Organizations should implement advanced PowerShell logging and monitoring to detect suspicious multi-stage script execution chains. Deploy endpoint detection and response (EDR) solutions capable of identifying obfuscated scripts and unusual process injection behaviors. Regularly audit and harden web-facing assets to prevent compromise, including timely patching and use of web application firewalls (WAFs). Monitor network traffic for anomalous SOCKS5 proxy connections or unusual outbound communications to known malicious domains or IPs such as those identified in this campaign. Employ strict application whitelisting and restrict PowerShell execution policies to limit unauthorized script execution. Conduct threat hunting using the provided indicators of compromise (IOCs) including domains, IP addresses, and file hashes. Educate users about risks of visiting compromised legitimate websites and enforce least privilege principles to minimize token theft impact. Incident response teams should prepare to investigate token theft and lateral movement scenarios. Collaboration with threat intelligence providers to stay updated on campaign developments is also recommended.

Indicators of compromise

Domains 5

xmri.network
investonline.in
wexmri.cc
www.investonline.in
www.ndibstersoft.com

IP addresses 1

45.13.212.250

Hashes 16

5d14aa8bbfb6c505800a5fe17769334a
9c48d9bf0b48260ce529156069eeb88d
472d725ae60c4ae141ff53fe175abb80f6f1d7af
5dc6a659001d320f42ed06401d15770c7c159031
5e0a30d8d91d5fd46da73f3e6555936233d870ac789ca7dd64c9d3cc74719f51
a508d0bb583dc6e5f97b6094f8f910b5b6f2b9d5528c04e4dee62c343fce6f4b
85eda483941b11ddcdad3d8b0cdfd702
c55a38222841ccdaa943c289ece55701
672da4a2fb54964ea52eba5e5e35b8e244f8567a
e2ac078090bb66be60344c5d0e74eb621d88d8de

Yara 1

a4ce2eaeb144328c973e99614662a772b998faf6

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 20 Feb 2026, 22:01 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details