New “Executive Award” Scam Exploits ClickFix to Deliver Stealerium Malware

A sophisticated new phishing campaign is targeting company executives with a double-pronged attack that steals credentials and deploys information-stealing malware in a single coordinated strike.

The “Executive Award” scam, identified by cybersecurity researchers at Trustwave MailMarshal, represents an evolution in social engineering tactics by combining credential harvesting with advanced malware deployment.

The campaign begins with a convincing phishing email impersonating the “Cartier Recognition Program” that presents victims with an executive recognition award.

The email contains a password-protected ZIP file with personalized details designed to appear legitimate, urging recipients to open an attached “secure digital package” to claim their award. This initial lure serves as the gateway to a two-stage attack sequence.

The first stage deploys a standalone HTML phishing page called “Virtual-Gift-Card-Claim.html” that impersonates a webmail login interface for the victim’s own domain.

When unsuspecting executives enter their credentials, the information is immediately exfiltrated to a Telegram command-and-control channel, giving attackers instant access to corporate email accounts and potentially broader network access.

ClickFix Technique Delivers Stealerium

The second stage leverages a deceptive technique known as ClickFix to install the Stealerium infostealer malware.

Victims encounter a malicious SVG file named “account-verification-form.svg” that displays a fake Google Chrome error message reading “Aw, Snap! Something went wrong.”

The fraudulent error instructs users to run a PowerShell “fix” command, a social engineering trick that exploits user trust in browser troubleshooting messages.

When victims execute the suggested command, they unknowingly trigger a sophisticated PowerShell chain that downloads and installs Stealerium through multiple loader stages.

This ClickFix approach transforms a simple image download into user-driven code execution, bypassing traditional security controls that might flag automated malware installation.

Stealerium is an open-source information stealer capable of harvesting browser passwords, cryptocurrency wallets, system information, and other sensitive data from infected machines.

The stolen information is then transmitted to attacker-controlled servers, providing cybercriminals with a comprehensive profile of their victims and potential access to financial accounts.

Researchers have identified the attack infrastructure centered around the IP address 31.57.147.77, which hosts multiple endpoints for delivering various payload stages including CMD scripts, HTA files, executables, DLLs, PowerShell scripts, and batch files.

The campaign uses two separate Telegram bot channels one for exfiltrating phished credentials and another for Stealerium data demonstrating a compartmentalized operational security approach.

Protection Recommendations

The Stealerium command-and-control server uses a hardcoded encryption key “StealeriumC2SecretKey123” to secure communications between infected systems and attacker infrastructure.

Implementing application allowlisting and restricting PowerShell execution can prevent the ClickFix technique from succeeding even if users are socially engineered into attempting the attack.

Organizations should implement multi-layered defenses against this threat. Email security filters should flag suspicious attachments, particularly password-protected archives and HTML files.

Employee security awareness training should emphasize the dangers of unsolicited awards and the red flags of credential harvesting attempts.

Security teams should block the identified indicators of compromise, including the malicious file hashes and the attacker’s IP infrastructure.

This campaign underscores how attackers are increasingly combining multiple techniques to maximize their success, making both credential theft and malware infection objectives of a single operation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.