The phishing campaign leverages evolved ClickFix techniques involving victim-assisted execution to evade modern endpoint defenses. It uses social engineering to convince targets to open malicious ZIP attachments containing LNK shortcuts that redirect to attacker-controlled landing pages. These pages silently place PowerShell commands into the victim's clipboard, which victims then manually execute via the Windows Run dialog (Win+R), bypassing automated detection. The attackers stage payloads using DNS TXT records to avoid HTTP-based detection mechanisms. The threat infrastructure includes obfuscated scripts, fake MSI installers posing as legitimate Remote Monitoring and Management (RMM) tools like ConnectWise, and ISO images containing spyware to maintain persistent access. This campaign focuses on establishing full environmental control post-compromise, indicating a strategic shift to long-term intrusion.

The campaign enables attackers to bypass endpoint security by leveraging victim interaction to execute malicious commands, leading to credential harvesting, spyware installation, and persistent access. The use of DNS TXT records for payload staging helps evade network detection. The presence of fake MSI installers and obfuscated scripts increases the difficulty of detection and removal. Overall, the campaign facilitates long-term control over compromised environments, posing significant risk to affected organizations.

No official patch or fix is available as this is a phishing campaign relying on social engineering and victim-assisted execution. Mitigation should focus on user awareness training to recognize phishing emails and suspicious attachments. Endpoint security solutions should be configured to detect and block LNK shortcut abuse and monitor for unusual PowerShell activity. Network defenses should consider monitoring DNS TXT record queries for suspicious activity. Since this campaign bypasses traditional filters through manual execution, educating users on the risks of executing unsolicited commands is critical.