Cybersecurity researchers have identified a sophisticated new malware campaign leveraging the increasingly popular ClickFix technique. This campaign highlights a growing shift toward modular, fileless malware designed to evade traditional detection mechanisms while maintaining powerful remote control capabilities.
In this technical deep dive, we unpack how this campaign operates, what makes it dangerous, and why it signals a broader evolution in cybercrime infrastructure.
What is the ClickFix Attack Vector?
ClickFix emerged in early 2025 as a deceptive social engineering tactic. It tricks users into interacting with fake CAPTCHA prompts or verification steps. Once clicked, these prompts execute malicious scripts silently in the background.
In this latest campaign, attackers use ClickFix to deploy a Node.js-based infostealer via malicious MSI installers. These installers appear legitimate but contain embedded malware payloads that execute without user awareness.
Silent Infection Chain
The infection begins when a victim interacts with a fake CAPTCHA. Behind the scenes, a Base64-encoded PowerShell command executes automatically. This command downloads a malicious installer (NodeServer-Setup-Full.msi) and installs it silently.
Key characteristics of this stage include:
- No visible installation prompts
- Execution in the background
- Deployment into
%LOCALAPPDATA%\LogicOptimizer\
The MSI package is self-contained, bundling a full Node.js runtime along with dependencies. This ensures compatibility across systems without requiring pre-installed environments.
Persistence Through Registry Manipulation
Once installed, the malware ensures persistence by modifying the Windows Registry. It creates a new entry under:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
This guarantees the malware executes every time the user logs in. The persistence mechanism is carefully designed to avoid duplication and detection, checking for existing entries before creating new ones.
Advanced Obfuscation via Multi-Layered Encryption
A standout feature of this malware is its complex configuration protection. Before connecting to its command-and-control (C2) server, the malware decrypts its configuration using multiple layers:
1. Randomized Field Names
The configuration is hidden under dynamically generated JSON keys, making static analysis difficult.
2. Dual Encryption Support
It supports both:
- AES-256-CBC
- XOR encryption
Key derivation uses PBKDF2 with 10,000 iterations, adding computational resistance.
3. Key Shuffling
Each execution reshuffles JSON keys before re-encrypting, ensuring no consistent pattern for analysts to detect.
This layered approach significantly complicates reverse engineering efforts.
Fileless Execution and Modular Design
Unlike traditional malware, this campaign avoids storing its malicious logic on disk. Instead:
- Core modules are delivered dynamically
- Code is executed in-memory using a Node.js VM sandbox
- Functionality is fetched only after C2 connection
This design allows attackers to adapt behavior in real time while bypassing signature-based detection systems.
Command-and-Control via Tor and gRPC
One of the most technically advanced aspects of this malware is its communication method.
- The malware downloads and installs the Tor client
- It routes traffic through a SOCKS5 proxy
- Communication occurs over gRPC (Google Remote Procedure Call)
This enables:
- Encrypted, bidirectional communication
- Real-time command execution
- Infrastructure anonymity
Once connected, the malware sends a detailed victim profile, including:
- System specifications
- OS version and architecture
- Hardware details
- External IP and geolocation
- Installed security software
This profiling helps attackers prioritize high-value targets.
Self-Healing and Resilient Architecture
The malware includes a watchdog mechanism that ensures continuous operation. If the main process crashes:
- It is automatically restarted
- Restart limits and delays are implemented to avoid suspicion
This resilience ensures long-term persistence on infected systems.
Exposure of a Malware-as-a-Service (MaaS) Backend
A critical operational security (OPSEC) failure by the attackers exposed internal protocol definitions (admin.proto and support.proto). This leak revealed a highly organized MaaS platform with features such as:
- Multi-operator management
- Role-based access control
- Campaign tagging and victim tracking
- Cryptocurrency wallet monitoring
- Telegram-based real-time alerts
- Automated attack workflows
This confirms that the campaign is not run by a single actor but operates as a commercial cybercrime service.
Modular Data Theft Capabilities
The malware’s modular framework allows attackers to deploy custom JavaScript payloads dynamically. These modules can:
- Execute shell commands
- Access files and credentials
- Interact with network resources
- Exfiltrate sensitive data
Execution occurs inside a sandboxed Node.js environment, but with enough exposed APIs to perform extensive system manipulation.
This architecture blurs the line between an infostealer and a full-fledged Remote Access Trojan (RAT).
Why This Campaign Matters
This ClickFix campaign represents a significant evolution in malware design:
- Fileless execution reduces forensic evidence
- Dynamic module delivery enables adaptability
- Tor-based communication ensures anonymity
- MaaS infrastructure scales cybercrime operations
It demonstrates how attackers are combining stealth, scalability, and flexibility into a single framework.
Our Opinion on This Threat Landscape
This campaign marks a clear turning point in how modern malware is engineered and deployed. What stands out most is not just the technical sophistication, but the level of operational maturity behind it. The transition toward malware-as-a-service platforms reflects a broader industrialization of cybercrime, where tools are no longer handcrafted but productized, distributed, and monetized at scale.
The use of Node.js is particularly notable. Traditionally associated with web development, its adoption in malware highlights how attackers are leveraging mainstream technologies to blend into legitimate environments. Combined with fileless execution and in-memory payload delivery, this makes detection significantly harder for conventional security tools.
Equally concerning is the focus on cryptocurrency tracking. This suggests attackers are prioritizing financial gain with precision, targeting users based on wallet presence and potential value rather than indiscriminate infection.
From a defensive standpoint, this campaign reinforces the need for behavior-based detection, zero-trust architectures, and user awareness. Traditional antivirus solutions alone are no longer sufficient.
Ultimately, this is not just another malware strain—it’s a blueprint for the future of cyber threats: modular, scalable, stealthy, and commercially driven.
