Overview of the Threat

The CyberProof Threat Research Team has identified a new variant of ClickFix that leverages trusted Windows components to bypass traditional defenses. By embedding malicious code deep within the operating system’s core utilities, attackers force victims into executing single commands via the Run dialog, which then connect over WebDAV and invoke rundll32.exe with an ordinal export (ordinal #1) to load a non‑DLL payload from a remote source.

Actor Group & Motive

The attack chain is orchestrated by a sophisticated actor group that demonstrates advanced persistence tactics. While the report does not disclose an explicit name, analysis indicates a focus on high‑value corporate targets where social engineering is feasible. The repeated use of different payload names (e.g., gc.key, j.pm, goog.ct) suggests an intent to obfuscate and evade detection across multiple incidents.

Execution Flow

• Victim receives a spear‑phishing email containing a link or attachment that, when opened, displays a Run dialog prompt.
• The user pastes the command “rundll32.exe /c /payload” expecting a benign operation.
• The command initiates an HTTP/WebDAV request to a controlled server.
• Payload is retrieved and loaded using rundll32’s ordinal export #1, bypassing DLL import restrictions.

This approach exploits the trust Windows places in rundll32.exe and WebDAV protocol, allowing the attacker to execute arbitrary code without requiring a legitimate DLL file.

TTPs & Indicators of Compromise

1. Unusual use of rundll32.exe with non‑standard arguments or ordinal calls.
2. Outbound traffic over HTTP/WebDAV to obscure IP addresses (sanitized IPs are not listed in the report).
3. Downloaded files with uncommon extensions such as .key, .pm, or custom names like goog.ct.
4. Simplistic Run dialog prompts that are easy to social engineer.

These indicators should be incorporated into endpoint detection and response (EDR) rule sets for early warning.

Detection & Hardening Recommendations

• Application Control: Block rundll32.exe from executing non‑trusted arguments unless explicitly whitelisted.
• WebDAV Monitoring: Inspect outbound HTTP/WebDAV connections to unfamiliar domains, especially those that return executable payloads.
• Command-Line Logging: Enable detailed logging of Run dialog commands and monitor for suspicious patterns.
• User Awareness Training: Reinforce safe handling of emails and the dangers of pasting arbitrary commands into system utilities.

Vendor & Community Resources

For deeper analysis, refer to the detailed write‑up available on CyberProof’s blog. The report also cites additional context in the AlienVault Pulse entry:

• AlienVault Observation

and CyberProof’s own article provides actionable mitigation steps:

• CyberProof Blog Post

Conclusion

The evolution of ClickFix demonstrates how threat actors continually refine delivery mechanisms to exploit high‑privilege Windows components. By combining social engineering, trusted utilities, and obscure protocols like WebDAV, attackers achieve stealthy persistence with minimal footprint.

Security teams should prioritize the detection rules outlined above, enforce strict application whitelisting, and maintain robust user education programs to mitigate this emerging threat landscape.