Hackers Exploit ClickFix Tactics to Spread NetSupport RAT, Latrodectus, and Lumma Stealer

Attackers are increasingly leveraging the ClickFix social engineering technique to distribute potent malware families, including NetSupport RAT, Latrodectus, and Lumma Stealer.

This method, which emerged prominently in recent months, tricks users into executing malicious commands under the guise of resolving common computer issues like performance glitches or verification prompts.

By hijacking the clipboard through JavaScript injection a tactic known as pastejacking threat actors embed obfuscated PowerShell scripts or commands that victims unwittingly paste into system interfaces such as the Run dialog (Win+R) or terminal (Win+X).

This bypasses traditional security controls, as there’s no direct exploit or malicious download; instead, the user manually triggers the infection via trusted shells like cmd.exe or powershell.exe.

Palo Alto Networks’ Unit 42 has responded to nearly a dozen incidents in 2025 where ClickFix served as the initial access vector, affecting diverse sectors from high technology and financial services to manufacturing, utilities, and government entities.

The technique’s simplicity allows rapid deployment, enabling full organizational takeovers through credential theft, data exfiltration, or ransomware deployment.

Researchers have observed a surge in weekly infections since early 2025, with variants masquerading as legitimate services like DocuSign and Okta to evade detection.

In-Depth Analysis of Malware Campaigns

Delving into specific campaigns, one prolific operation in May 2025 targeted industries such as healthcare, legal services, telecommunications, retail, and mining by distributing NetSupport RAT via fake landing pages on domains like docusign.sa[.]com and oktacheck.it[.]com.

These lures, suspected to utilize ClearFake infrastructure a malicious JavaScript framework embedded in compromised sites inject encoded PowerShell commands that download a ZIP archive containing jp2launcher.exe, a legitimate Java Runtime Environment component.

This sideloads a malicious DLL (msvcp140.dll), which then fetches and executes NetSupport RAT (client32.exe) from encrypted binaries, establishing remote access.

Similarly, Latrodectus campaigns from March to April 2025 shifted to ClickFix, redirecting users from hacked websites to verification pages that paste curl.exe commands downloading JavaScript droppers.

These, obfuscated with junk JSON variables, retrieve MSI payloads that sideload libcef.dll, injecting shellcode for persistence and potential follow-on payloads like infostealers.

In April 2025, Lumma Stealer attacks intensified, using typosquatted domains like iplogger[.]co to deliver MSHTA commands that fetch encoded PowerShell scripts, ultimately deploying PartyContinued.exe.

This extractor unpacks a CAB file (Boat.pst) to construct an AutoIt3 script engine (Slovenia[.]com), executing Lumma as an .a3x file for credential harvesting and exfiltration to C2 servers like sumeriavgv[.]digital.

These chains highlight evolving obfuscation, from Russian-commented scripts to dynamic R2.dev-hosted payloads, impacting automotive, energy, IT, and software sectors.

Mitigation Strategies

To counter these threats, threat hunters can scrutinize artifacts like the RunMRU registry key (HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU) for suspicious entries involving obfuscated commands or downloads from untrusted domains.

For Win+X variants, monitor Event ID 4688 for powershell.exe spawned by explorer.exe, correlated with Event ID 4663 accesses to WinX folders, alongside elevated shell sessions post-login and anomalous child processes like mshta.exe or rundll32.exe.

Clipboard monitoring can flag paste events preceding executions. Palo Alto Networks’ Advanced WildFire, URL Filtering, DNS Security, Cortex XDR, and XSIAM provide robust defenses by detecting clipboard injections and behavioral anomalies.

Organizations should educate users on these lures while implementing proactive monitoring. For suspected compromises, contact Unit 42’s incident response team.

Indicators of Compromise (IOCs)

Get Free Ultimate SOC Requirements Checklist Before you build, buy, or switch your SOC for 2025 - Download Now