ClickFix abuse via msiexec shows how trusted installers are weaponised

At a glance

What this is: Blackpoint Cyber describes a ClickFix-led intrusion in which msiexec was abused to deliver a second-stage MSI and a ChainScript JavaScript RAT.

Why it matters: It matters because the abuse path starts with user action, uses trusted Windows utilities, and can bypass the controls many teams rely on for file-based malware detection.

Context

ClickFix is a social engineering pattern that induces the user to execute attacker instructions themselves, often through a Run dialog or terminal prompt. That changes the trust boundary from a blocked download to a user-approved execution chain, which is harder for endpoint controls to treat as obviously malicious.

This incident combines that lure with a living-off-the-land execution path: msiexec retrieves and launches a second-stage package from attacker infrastructure, then the payload persists through a scheduled task. The identity angle is indirect but real, because the attack depends on the user’s authority to start a trusted process and on administrative controls that may be too permissive.

Key questions

Q: What breaks when users are tricked into running commands from a web page?

A: Browser trust and download controls break first, because the attacker shifts execution from the browser into the local shell. That bypasses reputation checks and makes malicious activity look like user action. Security teams should watch for web-to-shell transitions, especially when the page is impersonating a legitimate software portal.

Q: Why does msiexec abuse increase endpoint compromise risk?

A: msiexec is a trusted Windows installer, so suspicious activity can blend into ordinary software deployment patterns. When it is used to fetch a second-stage package from attacker infrastructure, defenders must inspect process context, source, and parent-child relationships, not just file reputation or attachment scanning.

Q: What are the signs that a ClickFix-style intrusion is underway?

A: Common signs include hidden PowerShell execution, malformed or obfuscated download strings, unusual use of WindowsInstaller, silent MSI installation, and user interaction prompts that look like connection fixes or CAPTCHA traps. Defenders should also watch for files dropped into public writable folders, suspicious DLL sideloading, and outbound connections to unfamiliar domains immediately after the user pastes a command.

Q: Should organisations prioritise endpoint execution controls or user awareness first against ClickFix?

A: They need both, but execution controls should be treated as the immediate limiter because awareness alone will not stop every successful prompt. If users can still launch powerful utilities from a trusted dialog, one mistake can still produce a full compromise chain.

Technical breakdown

How ClickFix turns user execution into initial access

ClickFix works by persuading a person to paste or run a command that the attacker has pre-staged, usually under the guise of a CAPTCHA, update, or troubleshooting step. The malicious action is not the download alone, but the user-initiated execution of an installer, script, or command shell. That matters because many security tools are tuned to inspect files, attachments, or obvious browser-delivered payloads, while the real trigger is the human trusting the prompt. Once the user runs the command, the attacker has an execution path that looks operationally normal. This is why training, UI restrictions, and command execution controls are part of the same defence surface. See the Phishing Guide. See the Phishing Guide.

Practical implication: Treat user-mediated command execution as an initial access vector and control it with training plus execution restrictions.

Why msiexec is attractive for staged payload delivery

msiexec is a trusted Windows installer that can fetch, unpack, and run MSI content while blending into ordinary software deployment activity. Attackers use it because many environments allow it by default and because its network and process behaviour can look like legitimate installation work. In this pattern, the first-stage command tells msiexec to retrieve a second-stage package from attacker-hosted infrastructure, which means the visible file path may never resemble a conventional malware dropper. The security problem is not msiexec itself, but the gap between what is permitted as an installer and what is trusted as an application source. Detection has to look at parent-child process chains, remote retrieval, and unusual invocation context. See the Living off the Land Guide. See the Living off the Land Guide.

Practical implication: Monitor installer abuse by correlating msiexec launches with remote fetches and suspicious parent processes.

How persistence and command-and-control were established

The ChainScript build described here is a JavaScript RAT, which means the payload provides remote operator control rather than a one-shot dropper function. WebSocket C2 lets the malware maintain interactive communication over a protocol that can resemble normal web traffic, while scheduled-task persistence gives the operator a way to regain execution after reboot or logoff. That combination is common in post-exploitation tooling because it separates initial access from durable control. The important technical point is that a single lure can produce both an interactive shell and a recurring foothold without needing a separate exploit chain. Defenders need to see persistence creation as part of the compromise, not a later cleanup detail. See the Persistence Techniques Guide.

Practical implication: Alert on scheduled-task creation by untrusted processes and on WebSocket-based C2 from newly executed binaries.

Threat narrative

Attacker objective: The objective was to gain durable remote control of the host while disguising the intrusion as normal Windows installation activity.

1. Entry began when the user was tricked by a ClickFix lure into running a command from the Windows Run dialog.
2. Credential or execution abuse followed when msiexec fetched a second-stage MSI package from attacker-hosted infrastructure and launched it as if it were a normal installer.
3. Escalation and persistence followed as the ChainScript JavaScript RAT established WebSocket C2, interactive shell access, file operations, payload deployment, and a scheduled task for recurrence.
4. Impact was limited in this case because the SOC isolated the host before lateral movement or broader business disruption occurred.

Breaches seen in the wild

• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ClickFix has become a control bypass pattern, not just a lure. The significance is that the attacker no longer needs to win a file reputation contest when the user is persuaded to run the payload directly. That shifts the governance question from attachment inspection to execution authority, especially on endpoints where standard users still have access to powerful system utilities. Practitioners should treat the human prompt as part of the attack path, not a prelude to it.

Trusted installer abuse creates a false sense of benign activity. msiexec is valuable to attackers precisely because it sits inside normal operating behaviour and can mask the retrieval of a second-stage package. That means security programmes need to classify installer abuse as an execution and trust problem, not merely a malware family problem. Living off the Land Guide is the right conceptual lens when the tool itself is legitimate but the source and context are not.

Persistence through scheduled tasks shows how quickly a user-driven intrusion can become operationally durable. The critical failure mode is not just that malware ran, but that it converted one user action into a repeatable foothold. This is the kind of chain that exposes weak separation between user workflows and administrative capability. The practitioner conclusion is that endpoint control has to start before launch, not after detection.

Windowed control over NHI-style execution paths matters even in human-led incidents. When the attack chain depends on a trusted process, the real security boundary is the execution authority granted to the session, not just the file system. That is where IAM thinking intersects with endpoint defence: privileged utilities, elevation paths, and task creation rights become part of the access model. Teams should treat delegated execution as governable access, not just local OS behaviour.

ChainScript illustrates how modern commodity malware now bundles multiple operator capabilities into one build. WebSocket C2, shell access, file operations, and payload deployment reduce the need for separate tooling and make post-compromise response more time-sensitive. The field implication is that defenders should track payload capability, not only signature lineage. Practitioners need to map behaviour to persistence, control channel, and execution scope simultaneously.

What this signals

Execution authority is now part of the endpoint trust model. When attackers can convert a human prompt into a trusted installer launch, the programme gap is no longer just malware detection. Teams should prepare for controls that govern who can invoke installers, shell paths, and task creation from ordinary user workflows.

The presence of a scheduled task after the initial lure is the clearest signal that the compromise is trying to outlive the session. That should shift response planning toward containment of execution primitives and faster correlation between social engineering and persistence creation.

For practitioners

• Train users on ClickFix execution traps Teach staff that no legitimate site or CAPTCHA should ask them to paste commands into Run or Terminal, and make reporting suspicious prompts easy. See the Phishing Guide.
• Disable or restrict the Windows Run dialog Use Group Policy or Intune to remove Run access where business workflows do not require it, and validate that exception paths are documented.
• Limit access to administrative utilities Apply least privilege so standard users cannot reach command-line interfaces or installer pathways that are not needed for their role.
• Block native binary launch from Run Enforce application control policies that prohibit launching native Windows binaries from the Run dialog, especially for installer and scripting paths.
• Watch for installer-led persistence Correlate msiexec activity with remote retrieval, scheduled-task creation, and new WebSocket sessions from recently executed processes.

Key takeaways

• The incident shows how a user-driven lure can bypass file-based detection by turning the victim into the execution vector.
• The payload combined trusted Windows tooling with a JavaScript RAT, WebSocket C2, and scheduled-task persistence, which increases the chance of blending into normal activity.
• Endpoint control must focus on execution authority, installer abuse, and persistence creation, not just on malware files and signatures.

Related NHI Mgmt Group resources: Phishing Guide · Living off the Land Guide · Application Allowlisting Guide · Persistence Techniques Guide

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Remote Access Trojan: A remote access trojan is malware that gives an attacker interactive control over a compromised system after execution. It usually combines a loader, persistence and a command channel so the attacker can issue instructions, exfiltrate data or deploy additional payloads without repeatedly exploiting the target.
• Scheduled-Task Persistence: A condition where an AI agent creates or modifies recurring automation that continues after the original interaction. It matters because a one-time injection can become durable influence, making later actions look legitimate even though the underlying instruction was attacker-shaped.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity governance to the broader control problems that modern security programmes have to manage.