A new wave of ClickFix infections has been discovered, exploiting social engineering to deliver a custom malware loader known as Potemkin.
In a recent intrusion in May 2026 spanning 11 network hosts, threat actors bypassed modern security controls to deploy the RMMProject remote access trojan (RAT) and a blockchain-enabled backdoor called EtherRAT.
The attack begins on unmonitored endpoints when victims are tricked into copying and executing a malicious command in the Windows Run dialog.
This command abuses legitimate system binaries, specifically utilizing pcalua.exe to proxy execution and quietly download an MSI package.
This social engineering tactic remains highly effective because it mimics a legitimate troubleshooting step.
Potemkin Loader Deploys RAT
Once executed, the installer drops the Potemkin loader, a customized 64-bit Windows malware designed to establish a foothold. Potemkin avoids using a hardcoded Command and Control (C2) server address, which defenders could easily block.
Instead, it utilizes a deterministic Domain Generation Algorithm (DGA) fueled by a built-in 1,000-word dictionary. The algorithm generates up to 10,000 candidate domains and probes them sequentially until a live C2 server responds.
Potemkin’s primary function is to fetch follow-on modules from the C2 and reflectively load them directly into system memory, successfully evading traditional file-based detection mechanisms.
The primary module delivered by Potemkin is RMMProject, a massive 4.4 MB Lua-scriptable RAT equipped with 15 distinct task capabilities.
This malware specializes in credential theft and features a sophisticated bypass for Google Chrome’s modern App-Bound Encryption (ABE).
It achieves this by injecting a helper DLL into a hidden, debugged browser process, enabling attackers to steal sensitive cookies and passwords without detection.
Furthermore, RMMProject includes a hidden-desktop module that grants attackers real-time, interactive control over a victim’s browser session, with no visible indicators on the screen, huntress said.
Alongside RMMProject, the threat actors deployed EtherRAT, a Node.js backdoor that utilizes “EtherHiding” for evasion.
Rather than storing a static C2 address, EtherRAT retrieves its active C2 infrastructure dynamically from an Ethereum smart contract.
To secure persistent access, the attackers established disguised Cloudflare tunnels that exposed internal services to the public internet.
Once inside, the operators engaged in intensive hands-on-keyboard activity, fighting a running battle to forcefully disable Windows Defender using multiple PowerShell scripts and registry overrides.
After successfully neutering the security controls, the attackers utilized WMIExec and SMBExec to spread the infection laterally, ultimately compromising the domain controller and infecting 11 separate hosts before being detected.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
