Security researchers are warning about a new malware campaign targeting Windows users through a deceptive verification trick known as ClickFix.
The operation uses social engineering and a multi-stage infection chain to install the StealC information stealer quietly. This widely sold cybercrime tool harvests sensitive personal and financial data.
The attack relies heavily on fileless techniques. Instead of dropping obvious malware files, the attackers run code directly in memory. This makes the activity difficult for traditional antivirus programs to detect.
How the Campaign Starts
The infection begins when a victim visits a legitimate website that has been secretly compromised. In observed cases, a restaurant site was injected with a malicious script that loads a fake CAPTCHA page. The page imitates a Cloudflare security check.
Victims are told to complete verification by:
• Pressing Windows + R
• Pasting a command (already copied to the clipboard)
• Pressing Enter
This action launches a hidden PowerShell command. The command contacts a remote server and downloads a loader script directly into memory, without saving it to disk.
The loader allocates memory and executes position-independent shellcode, which reflectsively loads a 64-bit Windows downloader.
That downloader retrieves the final payload and injects it into a trusted Windows process such as svchost.exe.
Because it runs inside a legitimate service, the malware appears normal to the operating system. The final stage installs StealC.
Inside the Multi-Stage Chain and Data Theft
The infection chain follows four stages:
PowerShell → Shellcode → PE Downloader → StealC
The shellcode was generated using a framework that embeds a full executable into memory. The downloader then performs process injection and deletes itself, leaving little forensic evidence.
Once active, StealC communicates with its command server via encrypted HTTP traffic encoded with Base64 and RC4. Researchers say decryption tools and indicators of compromise (IOCs) have been released to help defenders detect the traffic.
StealC is highly capable. It steals:
• Browser passwords, cookies, autofill data
• Cryptocurrency wallets and seed phrases
• Steam gaming accounts
• Outlook email credentials
• System details and hardware fingerprint
• Screenshots of the desktop
• Documents and database files
The malware searches Chrome, Edge, and Firefox-based browsers, as well as over 50 crypto wallet extensions.
It also collects registry-stored email passwords and uploads everything to its control server in structured JSON format. Large files are split into smaller chunks to avoid network detection.
Notably, the malware does not persist on the system. After data theft, it can self-delete to reduce evidence.
IOCs
| Type | Indicator |
|---|---|
| IP | 94.154.35.115 (payloads) |
| IP | 91.92.240.219 (PowerShell) |
| IP | 91.92.240.190 (C2) |
| URL | hxxp://94[.]154[.]35[.]115/user_profiles_photo/cptch[.]bin |
| URL | hxxp://94[.]154[.]35[.]115/user_profiles_photo/cptchbuild[.]bin |
| URL | hxxps://goveanrs[.]org/jsrepo |
| URL | hxxps://madamelam[.]com |
| SHA-256 | 5ad34f3a900ec243355dea4ac0cd668ef69f95abc4a18f5fc67af2599d1893bd (cptch.bin) |
| SHA-256 | dc38f3f3c8d495da8c3b0aca8997498e9e4d19738e1e2a425af635d37d0e06b8 (cptchbuild.bin) |
| User-Agent | Loader |
Level Blue Researchers emphasize that the main weakness exploited is human trust. Users should never run commands suggested by a website verification page.
Organizations are advised to monitor unusual PowerShell activity, injected processes, and outbound encrypted HTTP traffic to unknown servers.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
