Security researchers at CyberProof have identified a stealthy new variant of the ClickFix attack that tricks victims into infecting their own devices, unlike older versions that triggered alerts by relying on heavily watched scripting tools like PowerShell or mshta.
This updated method abuses native Windows components. By combining the Windows Run dialog, rundll32.exe, and WebDAV, attackers can easily bypass security defenses that primarily monitor script-based activity.
Attack Execution and Evasion Techniques
The attack chain begins with social engineering, starting when a victim visits a compromised or malicious website. In this campaign, researchers observed a fake CAPTCHA page hosted at “healthybyhillary[.]com”.
This deceptive page prompts the user to open the Windows Run application using the “Win + R” keyboard shortcut, paste a copied command using “Ctrl + V”, and press Enter.
Once the user executes the command, rundll32.exe connects to an external server on port 80. It uses the WebDAV mini-redirector, which tricks the Windows operating system into accessing a remote web address as if it were a local file share.
To further hide its behavior and evade static detection, the command calls an export function using the ordinal number “#1” instead of a recognizable function name.
After the initial command runs, rundll32.exe retrieves a remote DLL file named “verification.google”. This file serves as a secondary loader, SkimokKeep, that operates entirely in the computer’s memory.
The infection chain then transitions to PowerShell using non-interactive flags to download and run additional payloads quietly.
SkimokKeep uses advanced tricks to hide from security analysts and sandbox environments. Instead of listing its required Windows APIs openly, it finds them on the fly using a method called DJB2 hashing.
It also checks the system to ensure it is running on a real victim’s machine rather than in an automated security sandbox.
Indicators Of Compromise and Defense
To address this threat, security teams must look beyond traditional script monitoring and focus on detecting unusual behavior with native Windows tools.
| Type | Indicator / Detail |
|---|---|
| Hashes (SHA256) | a2569c5739bee6c4a18789e2ca42d66e4686b52d1c9d82fc3a543cbc316ccbef 68b9ebbdad21e0b94c958fc1cc1d23dcc43429ea254087c3fb30ad9901d65915 |
| IP Addresses | 178.16.53[.]137, 141.98.234[.]27, 46.149.73[.]60, 91.219.23[.]245 |
| Domains | mer-forgea.sightup[.]in[.]net, data-x7-sync.neurosync[.]in[.]net, ser-fluxa[.]omnifree[.]in[.]net |
| Payload URLs | hxxp://91.219[.]23[.]145/skimokeep, http://darkboll[.]in[.]net/ |
Defenders should watch for rundll32.exe loading davclnt.dll with DavSetCookie, establishing outbound network connections, or using WebDAV syntax like “@80” in command-line arguments.
Restricting unnecessary WebDAV traffic and monitoring for CyberProof unusual user-initiated executions can also help stop the attack early.
Because this entire campaign relies on users running the initial malicious command, educating staff about the dangers of fake CAPTCHA pages is critical.
Security teams can use the following known indicators and MITRE ATT&CK mappings to hunt for this activity in their networks.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
