Threats Tagged 'lummastealer'

A modular Windows remote access Trojan (RAT) campaign, named ClickFix, targets Windows users via malicious MSI installers. The malware is NodeJS-based and uses dynamic in-memory loading of core modules and communication protocols after connecting to its command-and-control (C2) server. It employs gRPC streaming over the Tor network to maintain persistent and masked bidirectional communication channels. An operational security failure exposed the malware's admin panel protocol, revealing a malware-as-a-service (MaaS) backend that manages multiple operators and automates cryptocurrency asset tracking. The RAT supports full functionality including shell command execution and wallet tracking, while evading static signature detection through dynamic code execution.