ClickFix malware turns PowerShell into a fileless stealers chain

At a glance

What this is: This is a Gurucul threat research post on a ClickFix malware chain that uses staged PowerShell and fileless execution to steal browser credentials, Windows Credential Manager secrets, and wallet data.

Why it matters: It matters because the attack crosses endpoint, identity, and NHI control boundaries, so defenders need runtime detection and credential governance rather than reliance on file-based malware controls.

Context

ClickFix is a social-engineering pattern that tricks users into executing a malicious command themselves, often by pasting it into a Windows run prompt or terminal. In this case, the lure is a spoofed licensing site that turns user action into the entry point for a fileless malware chain.

For identity teams, the important issue is not only malware execution but what the chain reaches next: browser session material, saved passwords, Windows Credential Manager data, and other secrets that can be reused beyond the original endpoint. That makes the incident relevant to both human authentication hygiene and NHI credential exposure.

The technique is typical of modern fileless intrusion chains rather than a one-off novelty. Its value to defenders is that it shows how social engineering, PowerShell, and in-memory payloads converge into identity compromise rather than simple endpoint infection.

Key questions

Q: What breaks when users are tricked into running PowerShell commands themselves?

A: The usual assumption that malicious code enters as a file or attachment breaks immediately. User-assisted execution turns a legitimate Windows utility into the delivery mechanism, so static file inspection, hash blocking, and simple download controls miss the initial compromise path. Teams need telemetry that recognises suspicious command-line behaviour and hidden execution.

Q: Why do fileless stealers create a bigger credential risk than ordinary malware?

A: Fileless stealers matter because they target reusable identity material such as browser cookies, session tokens, password manager data, and Windows Credential Manager contents. Once those artefacts are exposed, the attacker may not need the original host again. The compromise can spread into other systems, services, and sessions that trust the stolen material.

Q: What are the signs that a PowerShell loader chain is being abused for stealer deployment?

A: Look for hidden PowerShell windows, IEX or remote script retrieval, RWX memory allocation, thread creation from script hosts, and unusual outbound connections to raw IP addresses. When these signals appear together, the process is acting as a loader rather than an administration script.

Q: What should teams do after a synced browser credential is exposed?

A: Treat the exposure as an account compromise, not a simple password reset event. Revoke active sessions, rotate the affected credentials, review MFA coverage, and check whether extensions or personal profiles may have carried additional access into the environment.

Technical breakdown

How ClickFix turns user execution into initial access

ClickFix works by exploiting user trust in a verification or licensing prompt and redirecting that trust into command execution. Instead of a downloaded executable, the victim pastes a PowerShell command that immediately reaches attacker infrastructure and begins the staged load. That removes the normal file-based choke point and shifts detection toward process creation, command-line inspection, and network telemetry. The technique is effective because the first action is still user driven, but the payload path is already operational before traditional attachment or download controls can intervene.

Practical implication: monitor Win+R and paste-based PowerShell starts as an initial access signal, not just as an endpoint admin pattern.

Why in-memory PowerShell and Donut reduce visibility

The chain uses PowerShell to retrieve shellcode, allocates executable memory with RWX permissions, and launches the next stage directly from memory. Donut then bridges unmanaged shellcode into managed .NET execution by resolving modules dynamically and initializing the CLR without a normal on-disk assembly flow. That combination removes the most common artefacts defenders use for triage: files, static imports, and persistent dropper binaries. The result is a process tree that looks short on disk but rich in runtime behaviour, especially around memory allocation and thread creation.

Practical implication: inspect memory permissions, thread starts, and CLR initialization events from script hosts, not only file creation events.

How PureLogs reaches browser and credential stores

Once the loader chain completes, PureLogs performs host reconnaissance and targets browser profiles, Windows Credential Manager, password managers, SSH-related files, and cryptocurrency wallet artefacts. Those sources matter because they concentrate reusable secrets and session state in places that are easy to export once local code execution exists. The attack is not just theft of saved passwords. It is a broader harvest of identity material that can be replayed elsewhere, including browser session tokens and wallet-related extensions. That expands the impact from a single endpoint compromise into downstream account abuse.

Practical implication: treat browser stores, credential vaults, and wallet directories as high-value secret repositories that need explicit monitoring and protection.

Threat narrative

Attacker objective: The attacker aims to collect reusable credentials and wallet-related secrets that can support account takeover, financial theft, and broader post-compromise access.

1. Entry occurs when the victim visits a spoofed licensing site and is socially engineered into running a PowerShell command through ClickFix-style instructions.
2. Credential access begins as staged PowerShell retrieves shellcode and transitions into in-memory .NET execution that avoids normal on-disk detection.
3. Escalation happens through unmanaged-to-managed execution, RWX memory allocation, and hidden loaders that expand the malware's runtime control.
4. Impact follows when PureLogs harvests browser credentials, Windows Credential Manager secrets, wallet data, and session tokens for exfiltration over attacker C2.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fileless malware collapses the difference between endpoint compromise and identity compromise: once PowerShell, shellcode, and in-memory CLR execution are chained together, the real target becomes the secret store, not the file system. Browser profiles, Windows Credential Manager, and wallet extensions are all identity repositories in practice, even when defenders still treat them as application artefacts. That means detection strategy has to follow secret movement, not just malicious binaries.

ClickFix is a governance failure as much as a malware delivery technique: it weaponizes user-initiated execution against controls that assume downloaded code is the main risk. The article shows that the first malicious action is often a trusted user gesture, which means social engineering, execution policy, and PowerShell governance need to be analysed together. The practitioner conclusion is that user-mediated execution paths now sit inside the identity attack surface.

Identity blast radius is the right concept for this attack pattern: the malware does not need privileged system control to create disproportionate damage because it collects credentials, session tokens, and wallet data in one chain. That combination widens the blast radius from a single host to cloud apps, browser sessions, and downstream services. Organisations should judge controls by how much identity replay they prevent after local code execution succeeds.

Windows Credential Manager is no longer a local convenience store, it is a high-value secret dependency: this campaign shows how quickly a stealer can convert local storage into remote account risk. The same logic applies to browser password stores and extension data, which are often overlooked in identity governance conversations. Practitioners should treat secret repositories on endpoints as part of NHI and human identity lifecycle governance, not just endpoint hardening.

Runtime telemetry now matters more than artefact recovery for this class of intrusions: the chain is designed to leave minimal files while maximising in-memory behaviour, hidden processes, and suspicious network activity. That reduces the value of traditional retrospective hunting if runtime signals were not captured at the time. The field implication is clear: detection must move toward execution context, memory behaviour, and secret access patterns.

From our research library:

• Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.

What this signals

Identity blast radius: this campaign shows why browser profiles, credential vaults, and wallet extensions have to be governed as reusable identity assets. Once local code execution is achieved, the defender's task is to limit how far stolen secrets can travel, not just to remove the loader that collected them.

The practical shift is toward runtime visibility and secret governance at the endpoint. If teams cannot see PowerShell paste execution, memory allocation anomalies, and credential-store access together, they will miss the bridge from social engineering to account takeover.

For practitioners

• Instrument PowerShell execution paths Capture hidden-window PowerShell, paste-triggered command lines, IEX use, and raw IP connections from script hosts so ClickFix-style entry points are visible in telemetry.
• Watch for memory-resident loader behaviour Alert on RWX memory allocation, CreateThread from script hosts, and CLR initialization from unmanaged contexts because those are the execution markers used by this chain.
• Harden browser and vault secret exposure Reduce the number of reusable secrets stored in Chromium profiles, password managers, and Windows Credential Manager, and isolate them from casual endpoint access.
• Correlate identity artefacts with endpoint telemetry Join browser credential access, wallet extension reads, and suspicious outbound TCP activity so secret theft is detected as an identity event, not only as malware activity.
• Tune controls for ClickFix social engineering Train users to treat Win+R paste instructions and fake verification pages as execution prompts, then reinforce that with browser and endpoint controls that block command relay behaviour.

Key takeaways

• ClickFix-style delivery turns user trust into code execution and moves the attack surface from downloaded files to live process behaviour.
• The campaign's impact is credential-centric, with browser stores, Windows Credential Manager, and wallet-related data all exposed to theft.
• Defenders need runtime telemetry, browser and vault monitoring, and secret governance to reduce the blast radius after fileless execution succeeds.

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• Payloadless Malware: Payloadless malware is a malicious campaign that relies on links, redirection, or staged interaction instead of a traditional attached file. It often evades file-centric detection because the harm depends on user action, web delivery, or credential capture rather than a visible binary on disk.
• Windows Credential Manager: A Windows feature that stores reusable login material for websites, applications, and network resources. It reduces user friction by caching credentials locally, but that same convenience creates a persistent secret store that must be protected as part of the endpoint security model.
• RWX Memory Allocation: RWX memory allocation means memory is marked readable, writable, and executable at the same time. Attackers use it to place shellcode or loaders directly into memory and run them without writing a normal file, which reduces artefacts and complicates host-based detection.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.