Cybersecurity researchers from CyberProof have identified a highly evasive variant of the ClickFix malware campaign.
This new iteration abuses native Windows utilities, specifically the cmdkey and regsvr32 tools, to infect systems without dropping traditional malware files to the local disk.
By relying on trusted system applications, the attackers can bypass standard security detections and maintain a stealthy presence on compromised networks.
The attack begins with a clever social engineering tactic that mimics a standard web security check. Victims visit a compromised website that displays a fake CAPTCHA challenge claiming to verify whether the user is human.
The page instructs the user to press the Windows key and “R” to open the Run dialog, paste a provided text string, and hit Enter.
This single action triggers a complex chain of malicious commands while disguising the activity as a routine verification step.
Technical Attack Chain
The pasted command is a tightly chained script that uses cmd.exe to execute multiple actions simultaneously.
First, it uses the cmdkey utility to silently store credentials for remote access to the attacker’s server. Next, it uses regsvr32 to retrieve and execute a malicious remote DLL file from an external IP address using a UNC network path.
The attackers even append a fake “Cloudflare ID” text comment at the end of the script to make the string look legitimate to casual observers.
Once the remote DLL is loaded, it immediately establishes long-term access to the victim’s machine.
It triggers a hidden process to create a Windows Scheduled Task deliberately named “RunNotepadNow” to blend in with normal daily system activity.
Rather than storing the task instructions locally, the malware pulls the configuration directly from an XML file hosted on the attacker’s remote server.
This setup allows threat actors to easily update or replace the second-stage payload at any time without deploying new files to the victim’s computer.
Detection and Mitigations
According to CyberProof research, Because this campaign relies entirely on native system tools to carry out the attack, security teams must monitor for specific behavioral anomalies rather than relying on standard antivirus signatures.
Organizations should implement the following defensive measures to identify and block this threat:
- Monitor cmdkey usage that attempts to store credentials for external IP addresses.
- Flag any instances of regsvr32 loading DLL files from remote UNC network paths.
- Set up alerts for chained command executions in cmd.exe that use operators such as “&&” and “&”.
- Track Windows Task Scheduler activity that builds tasks sourced from remote XML files.
- Restrict or closely audit outbound SMB network traffic to prevent external payload retrieval.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
