[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSMfF0Jywihmu4OUsIBi1yk4R7yOKEwWiDuDf1iEfKtk":3},{"article":4,"iocs":49,"watch_terms":69,"solutions":70,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"126e0036-a1ed-4600-91da-7c1d5e8e1b0f","ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers","clickfix-attacks-evolve-to-hide-malware-in-png-images-and-hijack-windows-domain-372933","ClickFix attacks are moving beyond simple malware downloads, with recent investigations revealing executable payloads hidden inside PNG images and intrusions reaching Windows domain controllers. The activity shows how a fake verification prompt can become the starting point for persistent access, credential theft, and movement across corporate networks. The trick still depends on convincing someone to […] The post ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers appeared first on Cyber Security News.","ClickFix attacks have evolved beyond simple malware downloads to hide executable payloads within PNG images and establish persistent access to Windows domain controllers. Attackers use fake verification prompts, spoofed websites, and social engineering to trick users into running malicious PowerShell commands that extract and execute hidden binaries. Recent investigations show multiple unrelated operators adapting the technique, with intrusions involving credential theft, lateral movement via WinRM and PsExec, and secondary reverse SSH tunnels.","ClickFix attacks hide executable payloads in PNG images and compromise Windows domain controllers.","https:\u002F\u002Fcybersecuritynews.com\u002Fclickfix-attacks-evolve\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FClickFix-Attacks-Evolve-to-Hide-Malware-in-PNG-Images-and-Hijack-Windows-Domain-Controllers.webp","2026-11-11T10:32:40+00:00","2026-11-11T11:00:33.476159+00:00",9,[17,20,23],{"name":18,"type":19},"ClickFix","campaign",{"name":21,"type":22},"Huntress","vendor",{"name":24,"type":25},"Windows Domain Controllers","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60,63,66],{"type":51,"value":52,"context":53},"url","https:\u002F\u002Fvvestalw.ghost.io\u002F","Typosquatted redirector used in ClickFix attack chain",{"type":51,"value":55,"context":56},"https:\u002F\u002Fmoziw.com\u002Fvvestalw\u002F","Intermediate redirector in attack chain",{"type":51,"value":58,"context":59},"https:\u002F\u002Fwestlaw-signon.com\u002F","Fake verification landing page spoofing legitimate service",{"type":30,"value":61,"context":62},"Matanbuchus 3.0","Malware delivered in February ClickFix incident before domain controller compromise",{"type":30,"value":64,"context":65},"AstarionRAT","Remote access trojan delivered in February ClickFix incident",{"type":30,"value":67,"context":68},"DuskDesk","Node.js remote access trojan disguised as management software, used in ClickFix campaigns",[21],{"controls":71,"vendors":158},[72,101,129],{"slug":73,"name":74,"problem":75,"products":76},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":102,"name":103,"problem":104,"products":105},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[106,113,121],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":102,"product_name":110,"url":111,"description":112},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":130,"name":131,"problem":132,"products":133},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[134,142,150],{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[159],{"slug":160,"name":21,"logo_path":161,"roles":162},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":174},"clickfix-social-engineering-evolves-to-hijack-domain-controllers-via-png-hidden-malware","ClickFix Social Engineering Evolves to Hijack Domain Controllers via PNG-Hidden Malware","ClickFix attacks exploit human trust by presenting fake verification prompts and spoofed websites that convince users to manually execute malicious PowerShell commands, bypassing technical defenses entirely. By hiding executable payloads inside PNG images (steganography), attackers evade signature-based detection tools that might otherwise flag suspicious binaries. Once a user is tricked into running the initial command, attackers pivot laterally using WinRM and PsExec to reach Windows domain controllers, establishing persistent reverse SSH tunnels and stealing credentials. This matters because compromising a domain controller effectively hands attackers the keys to an entire organization's identity infrastructure, enabling them to impersonate any user and maintain long-term covert access.",[169,170,171,172,173],"MITRE ATT&CK T1204.002: User Execution: Malicious File","MITRE ATT&CK T1027.003: Obfuscated Files or Information: Steganography","MITRE ATT&CK T1210: Exploitation of Remote Services","NIS2 Article 21(2)(g)","CIS Control 16: Application Software Security (v8)",{"NIS2 Article 21(2)(g)":175,"CIS Control 16: Application Software Security (v8)":176,"MITRE ATT&CK T1210: Exploitation of Remote Services":177,"MITRE ATT&CK T1204.002: User Execution: Malicious File":178,"MITRE ATT&CK T1027.003: Obfuscated Files or Information: Steganography":179},"This point requires organisations to implement basic cyber hygiene and staff training, which would directly reduce susceptibility to the social engineering lures central to ClickFix attacks.","Restricting and hardening how applications — including browsers and scripting engines like PowerShell — can execute code would limit the ability of ClickFix prompts to spawn malicious processes.","Attackers used WinRM and PsExec for lateral movement after the initial compromise, which falls under this technique covering abuse of remote service protocols to move through a network.","This technique covers attackers tricking users into manually executing malicious content — exactly what ClickFix does by prompting users to run PowerShell commands disguised as verification steps.","This technique specifically describes hiding malicious payloads within image files such as PNGs, which is the core evasion method used in this evolved ClickFix campaign."]