ClickFix Attack Deploys Potemkin Loader, RMMProject RAT, and EtherRAT Across 11 Hosts

A sophisticated ClickFix social engineering campaign in May 2026 triggered a full hands-on-keyboard intrusion spanning 11 hosts, deploying a novel trio of malicious tools: Potemkin loader, RMMProject RAT, and EtherRAT.

The attack chain began when the user visited a compromised website and pasted a base64-encoded PowerShell command into Win+R.

This command abused pcalua.exe as a LOLBIN to proxy mshta.exe execution, fetching a remote HTA payload that silently downloaded and installed an MSI package containing Potemkin loader.

Potemkin is a custom x64 Windows loader that uses a deterministic Domain Generation Algorithm (DGA) with seed 151678 to generate 10,000 candidate domains, probing each until finding its command-and-control server.

The loader employes reflectively loaded follow-on modules entirely in memory, avoiding disk writes for its primary payloads.

The module served through Potemkin was RMMProject, a 4.4 MB Lua-scriptable DLL with extensive post-exploitation capabilities.

Huntress researchers documented this multi-stage attack originating from an unmonitored endpoint where a victim was tricked into executing a malicious command via the Windows Run dialog.

This RAT features browser credential theft with a sophisticated Chrome App-Bound Encryption bypass via embedded DLL injection, a hidden-desktop remote control module (RTSC), and 15 distinct task types including password theft (task 1001), cookie stealing (task 1002), and autofill data extraction (task 1013).

ClickFix Attack Deploys Potemkin Loader

The RTSC module creates a hidden Windows desktop where attackers interact with an authenticated browser session invisible to the victim a capability commonly used for banking fraud.

Different strings have different data_op, key_op, and starting key byte values baked into their structs at compile time, so each string has its own unique decryption recipe despite all of them running through the same cipher code.

RMMProject embeds LuaJIT scripting engine and native modules for HTTP client operations, SQLite database access, Windows registry manipulation, and ASN.1 decoding for NSS certificate formats.

Separately, attackers deployed EtherRAT, a known Node.js backdoor that resolves its C2 address from the Ethereum blockchain using EtherHiding evasion.

The RAT reads its C2 from smart contract 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831, issuing eth_call requests across seven public Ethereum RPC providers including Tenderly, Flashbots, and MEV Blocker.

This blockchain-based C2 resolution allows operators to update the botnet’s destination via a single transaction, with every infected host picking up the change on its next poll.

With these footholds established, the operator engaged in sustained hands-on-keyboard activity, fighting Windows Defender while deploying Chisel reverse SOCKS tunnels for lateral movement.

The attacker spread across the network via WMIExec and SMBExec, ultimately reaching the domain controller and spraying EtherRAT across over 11 hosts.

Persistence was maintained through the per-user Run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run under the benign-sounding value WindowsHost, executing Node.js via conhost --headless to suppress console windows.

ClickFix remains effective because it exploits human nature users naturally follow authoritative-looking instructions like “press Win+R, paste this, hit Enter” without questioning.

This case demonstrates why endpoint coverage matters: the initial infection originated from an unmonitored endpoint, giving attackers an unchallenged foothold before lateral movement occurred.

Security experts recommend disabling the Run prompt via Group Policy, blocking unapproved remote management tools, and implementing robust security awareness training.

The campaign targets education and financial sectors through social engineering, utilizing PowerShell commands with DLL side-loading and in-memory execution to evade detection.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.