Cybersecurity researchers at Netskope Threat Labs have uncovered a sophisticated new phishing campaign utilizing the ClickFix delivery vector.
Initially gaining prominence in early 2025 for distributing malware like LegionLoader and LummaStealer, the ClickFix technique now delivers a highly adaptable Node. js-based remote access Trojan (RAT) to Windows users.
The attackers use fake CAPTCHA prompts to trick victims into executing a hidden, base64-encoded PowerShell command.
This command silently downloads a self-contained MSI installer from a remote server, equipping the malware with a complete Node.js runtime environment.
Stealthy Execution and Persistence
Once the fake CAPTCHA triggers the background download, the payload establishes a resilient foothold on the infected machine. The MSI installer writes itself to the local application data folder.
It invokes a bootstrap script without displaying any visible windows or alerts to the user. To survive system reboots, the malware automatically adds a registry value named “LogicOptimizer” under the current user’s run settings.
By nesting its execution command within this registry key, the malicious payload is automatically triggered whenever the victim logs in to their computer.
After securing persistence and profiling the system, the malware establishes its command-and-control (C2) connection.
It downloads the Tor Expert Bundle directly from the official Tor Project website and creates a local SOCKS5 proxy.
Through this proxy, the malware routes bidirectional gRPC streaming traffic over the Tor network. This setup completely masks the attacker’s infrastructure while allowing operators to push real-time commands and stream stolen data back.
The malware operates entirely in memory, meaning its core data-stealing modules never touch the victim’s hard drive. Instead, the C2 server sends JavaScript code as strings, which the malware executes within a Node.js virtual machine sandbox.
This modular approach bypasses traditional signature-based detection and enables attackers to dynamically load capabilities such as shell command execution and credential harvesting.
Remarkably, an operational security failure by the threat actors gave researchers a rare look into the backend infrastructure.
| Message Type | Description |
|---|---|
| AuthPayload | Initial victim profile containing machine ID, hostname, OS info, campaign, tag, operator ID, and ECDH public key. |
| Ping/Pong | Mechanism to maintain communication. |
| EncryptedPayload | Wrapper for all sensitive messages. |
| SysInfo | System reconnaissance data. |
According to Netskope research, the leaked files expose a professional platform equipped with automated rules, execution logging, and multi-operator support.
The dashboard allows cybercriminals to filter infected machines, track cryptocurrency wallets across browser extensions and desktop apps, and receive real-time notifications via Telegram when new victims are compromised.
This level of organization indicates a mature criminal enterprise actively selling targeted cryptocurrency theft capabilities to multiple affiliates, solidifying this Node.js payload as a highly adaptable threat.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
