ClickFix malware combines PowerShell, persistence and dead drops

At a glance

What this is: Blackpoint Cyber describes a ClickFix-style intrusion that combined user-executed PowerShell, registry-based persistence, and image-based command and control.

Why it matters: It matters because SOC and identity teams need to correlate execution, persistence, and post-compromise behaviour across the full chain, not just hunt for obvious malware binaries.

Context

ClickFix-style attacks rely on a user being persuaded to paste or run a command, which turns a helpdesk-like action into an execution path for malware. In this case, the initial PowerShell command opened the door to a ZIP download, hidden folder creation, and registry-based persistence, showing how social engineering and endpoint abuse meet in one chain.

The broader governance problem is visibility across execution, persistence, and command and control. When malware uses dead drop infrastructure and image-based tasking, defenders lose the comfort of simple IOC matching and must instead connect runtime behaviour, registry changes, and suspicious outbound communication patterns. That is especially relevant where managed endpoints and identity-bound sessions can be abused as the delivery layer.

Key questions

Q: What breaks when users are tricked into running PowerShell commands themselves?

A: The usual assumption that malicious code enters as a file or attachment breaks immediately. User-assisted execution turns a legitimate Windows utility into the delivery mechanism, so static file inspection, hash blocking, and simple download controls miss the initial compromise path. Teams need telemetry that recognises suspicious command-line behaviour and hidden execution.

Q: Why do registry Run keys make post-compromise persistence so effective?

A: Registry Run keys matter because they convert a one-time execution event into a repeatable startup path that survives reboots and user logins. Once the payload is placed there, the attacker no longer depends on repeated social engineering or fresh exploitation. That is why persistence monitoring should be one of the first containment checks.

Q: How can security teams detect image-based command and control?

A: Teams should look for strange combinations of web retrievals, image files that behave like tasking containers, and short-lived endpoint activity that follows unusual script execution. The key is correlation. A single BMP download may look harmless, but when it lines up with memory-resident shellcode and outbound beacons, it becomes a C2 signal.

Q: What should SOC teams do after a host is isolated in a ClickFix intrusion?

A: After isolation, teams should preserve volatile evidence, inspect persistence points, and reconstruct the process tree before killing tools or cleaning files. The objective is to determine whether tasking, staging, or memory-only payloads were already present. That sequence gives responders a reliable view of what the attacker could have done next.

Technical breakdown

ClickFix execution through Windows Run and PowerShell

ClickFix attacks trick a user into executing attacker-controlled code through a legitimate interface such as the Windows Run dialog. In this incident, the PowerShell command downloaded a ZIP archive from attacker infrastructure, which means the initial access mechanism depended on social engineering plus native tooling rather than a dropped executable. That matters because PowerShell inherits the user context and often blends into routine administrative activity, especially when scripts are encoded, staged, or launched from expected shell paths. Security teams should think of the initial command as an execution primitive, not just a file download.

Practical implication: Treat native shell execution as a control point and restrict script invocation paths for standard users.

Registry Run keys and hidden folders as persistence

A registry Run key creates persistence by ensuring code starts automatically when the user logs in or the system boots, while hiding the payload folder reduces casual discovery. These techniques do not require kernel exploits or driver abuse, only write access in a context that can modify user startup behaviour. The result is a low-noise foothold that survives reboots and can remain active long enough for operators to task the host further. In practical terms, persistence is often the point where an intrusion stops being a one-time compromise and becomes an operational beachhead.

Practical implication: Monitor startup locations and user-writable persistence paths for unexpected changes, especially after script execution.

Dead drop resolution and image-based command and control

A dead drop resolver uses a public location to store or retrieve the next-stage command or infrastructure reference, allowing operators to change C2 targets without shipping a new payload. Here, the shellcode used a public WebMasterSun profile and victim-specific BMP tasking, which makes the traffic harder to classify because the malware can fetch instructions from objects that look like ordinary content. This is a classic concealment pattern: the payload avoids a single fixed beacon and instead relies on a mutable, layered communications path. That complicates detection because network teams may see benign-looking web or image traffic while the malware maintains active control.

Practical implication: Correlate unusual image retrievals, profile-based lookups, and post-execution beaconing instead of relying on static destination lists.

Threat narrative

Attacker objective: The objective was to establish a stealthy, persistent foothold that could receive tasking, communicate with attacker infrastructure, and support follow-on compromise without immediate detection.

1. Entry occurred when the user was tricked into running a PowerShell command through the Windows Run dialog.
2. Credential or access abuse was not the primary feature here, but the malware gained execution authority in the user context and used that access to download and stage payloads.
3. Escalation and persistence followed when the malware hid its folder, established a registry Run key, and loaded shellcode into memory for further control.
4. Impact included victim-specific tasking and post-compromise communication through dead drop and image-based command and control, while Blackpoint SOC contained the host before lateral movement was observed.

Breaches seen in the wild

• Salt Typhoon telecom intrusions 2025: Salt Typhoon breached US telecoms mainly with stolen logins, then harvested SNMP strings and TACACS/RADIUS keys to spread and persist for years.
• Massive Docker Hub Secrets Leak: 10,000+ Docker Hub container images expose hardcoded secrets and authentication keys.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

ClickFix has become an execution-layer trust exploit: the attacker does not need a zero-day when a user can be manipulated into launching PowerShell from a familiar interface. That shifts the defence problem from simple malware blocking to controlling how native admin-capable tooling can be invoked. For SOC teams, the important question is not only what ran, but why a legitimate shell was allowed to become an untrusted execution channel.

Registry persistence remains a governance failure, not just a malware technique: a Run key is effective because many environments still treat user-level startup changes as low priority noise. This incident shows that persistence is often the first durable sign that the intrusion has moved beyond a one-off payload execution. The practical implication is that persistence monitoring must be tied to behavioural triage, not left as an afterthought.

Dead drop C2 creates a detection gap that static IOC models do not close: when malware resolves tasking through public profiles and image-based payloads, the control problem becomes correlation across web, endpoint, and memory artefacts. That is a broader challenge for modern SOC design because the same evasion logic can mask credential theft, post-compromise tooling, or staged ransomware activity. The right response is to hunt for control-plane behaviour, not just known bad destinations.

Machine-driven tasking increasingly blurs the boundary between malware and routine cloud-like delivery patterns: disguising payloads as legitimate AWS disaster recovery software is not just camouflage, it is an abuse of brand trust to lower analyst suspicion. That is relevant to identity governance because attackers increasingly use trusted labels, scripted delivery, and legitimate tooling to impersonate normal operational workflows. Practitioners should assume that trust signals can be fabricated at runtime.

Behaviour-first detection is now the minimum standard for resilient response: the article’s core lesson is that the chain matters more than any single stage. Execution, persistence, memory shellcode, and victim-specific tasking are all separate opportunities for control, but only if they are linked analytically. Teams that still operate in isolated alert categories will miss the larger intrusion pattern.

What this signals

ClickFix attacks are best understood as execution-chain abuse, not simple phishing: the user becomes the delivery mechanism, and that means endpoint policy must control native shell launch paths as tightly as browser downloads. Once script execution is the entry point, the response model has to move from blocklists to behaviour correlation.

Persistent user-context footholds are still under-monitored in many environments: registry startup locations, hidden payload directories, and memory-resident loaders provide the attacker with a durable operating base even when the host is quickly isolated. That is where behavioural detection and containment discipline pay off, because the compromise has already moved beyond the initial click.

For practitioners

• Harden native script execution paths Restrict PowerShell usage for standard users, apply constrained language modes where appropriate, and alert on Run dialog launches that spawn networked script activity.
• Monitor persistence locations continuously Track registry Run keys, startup folders, and other user-writable persistence points as high-signal changes after any suspicious script execution or archive download.
• Correlate endpoint and memory artefacts Look beyond file hashes by collecting process trees, in-memory shellcode indicators, and child network connections when shell activity precedes beaconing.
• Investigate dead drop and image-based C2 patterns Flag profile-based lookups, unusual BMP retrievals, and content that serves as tasking rather than media, then tie those events back to host behaviour.

Key takeaways

• This incident shows how a simple user-run PowerShell command can become a full intrusion path when the attacker combines social engineering, payload staging, and startup persistence.
• The malicious chain relied on dead drop infrastructure and image-based tasking, which makes static destination-blocking much less effective than behavioural correlation.
• The most effective containment point was early host isolation, but prevention depends on controlling native script execution and watching persistence locations closely.

Key terms

• ClickFix-Style Attack: A ClickFix-style attack uses social engineering to persuade a user to copy and paste malicious content into a browser or application workflow. The danger is not the prompt alone but the execution path it triggers, which can bypass traditional email and login controls.
• Registry Run Key Persistence: Registry Run Key Persistence is a Windows persistence technique where malware or an unauthorized program adds itself to registry locations that launch automatically at logon or startup. Technically, attackers modify keys such as Run or RunOnce so code executes when a user signs in, helping the threat survive reboots and maintain access.
• Dead Drop Resolver: A dead drop resolver is a technique where malware stores its command or destination in an external location that can be updated without changing the malware itself. That makes the control plane harder to detect and block because the payload is decoupled from a fixed server address.
• Image-Based Command And Control: Image-based command and control uses image files or image-like content to carry instructions or hide communications between malware and the operator. It is designed to camouflage malicious traffic as ordinary web activity, forcing defenders to rely on context and behaviour rather than file type alone.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security programme they run every day.