Full Report
Poisoned PNGs contain malicious code A fresh wave of ClickFix attacks is using fake Windows update screens to trick victims into downloading infostealer malware.…
Analysis Summary
# Tool/Technique: ClickFix Attack Campaigns Utilizing Poisoned PNGs and Rhadamanthys Malware
## Overview
This describes a fresh wave of ClickFix attacks that use highly convincing, fake Windows update screens as a social engineering lure to trick victims into executing malicious commands. The final payload delivered is the Rhadamanthys infostealer malware, often loaded through a multi-stage process involving a steganographic loader hidden within PNG images.
## Technical Details
- Type: Technique/Campaign (Utilizing Malware: Rhadamanthys)
- Platform: Windows
- Capabilities: Social engineering via fake update screens, execution via Run prompt command, file-less delivery using steganography, credential theft.
- First Seen: The article details a recent wave investigated between September 29, 2025, and October 30, 2025.
## MITRE ATT&CK Mapping
- **T1566 - Phishing**
- T1566.001 - Spearphishing Attachment (The initial lure acts as a malicious attachment/vector)
- **T1204 - User Execution**
- T1204.002 - Malicious File
- **T1059 - Command and Scripting Interpreter**
- T1059.003 - Windows Command Shell (Use of `cmd.exe` via Run prompt)
- **T1027 - Obfuscated Files or Information**
- T1027.004 - Steganography (Hiding malware in PNG pixel data)
- **T1574 - Hijack Execution Flow**
- T1574.012 - DLL Search Order Hijacking (Implied through reflective loading)
- **T1105 - Ingress Tool Transfer**
- T1105 - Ingress Tool Transfer (Retrieving subsequent stages via network)
- **T1036 - Masquerading**
- T1036.005 - Match Legitimate Name or Location (Impersonating a Windows Update process)
- **T1071 - Application Layer Protocol**
- T1071.001 - Web Protocols (Use of HTTP/HTTPS to deliver payloads)
- **T1083 - File and Directory Discovery** (Implied as part of infostealer activity)
- **T1555 - Credentials from Local System**
- T1555.003 - Credentials from Password Stores (Rhadamanthys's primary function)
## Functionality
### Core Capabilities
- **Social Engineering Lure:** Displaying highly convincing, full-screen blue Windows Update screens to coerce users.
- **Execution via Run Prompt:** Tricking users into pasting and executing a malicious command via the Win+R prompt.
- **Multi-Stage Execution Chain:** Initial execution via `mshta.exe` leading to PowerShell script execution.
- **Credential Theft:** The final payload, Rhadamanthys, is designed to steal user login credentials.
### Advanced Features
- **Steganographic Loader:** Malicious code (Donut-packed shellcode) is hidden within the pixel data of PNG images, using specific color channels to reconstruct and decrypt the payload in memory. This significantly aids in evading signature-based detection.
- **Hex-Encoded URL Structure:** Initial payloads reference URLs where the second octet of the IP address is hex-encoded, serving as a form of simple obfuscation/detection evasion.
- **Reflective Loading:** A .NET assembly is downloaded, decrypted, and reflectively loaded into memory.
## Indicators of Compromise
- File Hashes: Not provided in the text.
- File Names: Not specifically mentioned for dropper/loader, but the final malware is Rhadamanthys.
- Registry Keys: Not provided in the text.
- Network Indicators:
- Traffic originating from IP address: `141.98.80[.]175` (Defanged: `141.98.80.175`)
- Initial stage command references a URL with a hex-encoded second octet.
- Behavioral Indicators:
- `explorer.exe` spawning `mshta.exe` or `powershell.exe` with unexpected command lines.
- Execution chain: `Win+R` input -> command execution -> `mshta.exe` execution.
- Detection of attempts to reconstruct data from PNG pixel arrays in memory.
## Associated Threat Actors
- Unconfirmed, though source code comments contained Russian language hints.
- Associated with widely deployed ClickFix techniques used by cybercriminal gangs and government-sponsored spies.
## Detection Methods
- **Signature-based detection:** Hindered by the use of steganography and in-memory loading/decryption.
- **Behavioral detection:** Monitor for `explorer.exe` spawning execution tools (`mshta.exe`, `powershell.exe`) with unusual command lines.
- **YARA rules:** Could potentially be developed for the structure of the hex-encoded URLs or specific shellcode patterns extracted from PNGs if analyzed offline.
## Mitigation Strategies
- **Block Run Box:** Disable or restrict the Windows Run box (`Win+R`) capability for standard users.
- **Employee Training:** Train users explicitly on ClickFix techniques, emphasizing that legitimate security updates or CAPTCHAs never require pasting and running commands.
- **Endpoint Detection and Response (EDR):** Deploy EDR solutions to monitor process lineage and command-line arguments for anomalous activity (e.g., `mshta.exe` invocation).
## Related Tools/Techniques
- **Rhadamanthys:** The final-stage infostealer malware deployed.
- **ClickFix:** The overarching social engineering technique involving fake fixes or prompts executed via the Run dialog.
- **Steganographic Loading:** The technique used to hide and deliver the initial loader shellcode.