Investigating a new Click-fix variant

The report

Atos Researchers identified a new variant of popular ClickFix technique, where attackers convince the user to execute a malicious command on their own device through the Win + R shortcut. In this variation, a “net use” command is used to map a network drive from an external server, after which a “.cmd” batch file hosted on that drive is executed. Script downloads ZIP archive, unpacks it and executes legitimate WorkFlowy application with modified, malicious logic hidden inside “.asar” archive. This acts as a C2 beacon and a dropper for the final malware payload.

Read the full analysis: Investigating a new Click-fix variant (atos.ai).

Indicators

Malware C

• cloudflare[.]report

Defanged so they cannot be clicked by mistake: replace [.] with a dot. Shared hosting and CDN addresses named in the report are left out on purpose, so blocking these does not break legitimate sites.

How this is tracked

EncryptLayer intelligence, A.R.P. Syndicate’s open threat feed, reviews each indicator against the published report before adding it (#29). This page is generated from that record and the report’s own title and summary; nothing is rewritten.