Case 002: ClickFix → Python RAT

A complete four-stage malware delivery chain was discovered and fully decoded starting from the phishing domain mgmntss-www.com, registered only 2 days before this investigation (2026-08-14). The attack uses a technique called ClickFix: a fake browser verification page that silently injects a malicious PowerShell command into the user's clipboard using JavaScript. The victim is then instructed to press Win+R, paste, and press Enter — unknowingly running a malware installer.

All four layers of obfuscation were successfully broken: char-array encoding, AMSI bypass, XOR decryption, and UTF-16 encoding. The final payload is a Python Remote Access Trojan (RAT) with full remote shell execution, self-update capability, and C2 beaconing. The C2 server naiu5zvmnc.update34587.com was confirmed live and operational (HTTP 401 — authentication wall protecting the API) during investigation.

All three payload/C2 domains are registered through Cloudflare — a pattern of systematic Cloudflare registrar abuse documented across multiple recent malware campaigns. The phishing lure domain is on Alibaba Cloud.

ClickFix is a social engineering technique that has surged in 2025-2026 precisely because it bypasses all browser security controls. There is no vulnerability being exploited — the victim runs the malware themselves.

The attack flow: the victim visits a webpage that looks like a Google reCAPTCHA, a Cloudflare DDoS check, or a Microsoft browser warning. The page uses JavaScript to write a PowerShell command into the OS clipboard silently via navigator.clipboard.writeText(). It then displays fake UI elements showing a "Windows" dialog telling the user to press Win+R, then Ctrl+V (paste), then Enter. The victim thinks they are completing a routine verification. They are actually executing malware.

No browser warning fires. No download dialog appears. No file is saved to disk first (until the PS1 downloads its stages). Antivirus sees nothing unusual. The user ran it themselves.