ClickFix-to-PureHVNC shows how social engineering bypasses control gaps

At a glance

What this is: This Gurucul threat research shows a ClickFix-to-PureHVNC infection chain that turns fake verification prompts into malicious PowerShell execution, staged payload delivery, persistence, and remote access.

Why it matters: It matters because identity and endpoint teams must account for user-assisted execution paths that bypass conventional trust assumptions, not just malware delivered through obvious files or blocked binaries.

Context

ClickFix is a social-engineering pattern that persuades the victim to run commands themselves, which means the first control failure is behavioural rather than technical. In this case, the fake Booking-themed portal was the lure, and the malicious action was hidden inside a seemingly routine verification step.

For identity security teams, the important point is that the attack did not need an exposed service account or stolen token to begin. It exploited a human execution path to trigger PowerShell, then moved into staged payload delivery, persistence, and process abuse that most perimeter controls do not see clearly.

That makes the campaign relevant to human IAM, endpoint hardening, and identity threat detection as much as to malware analysis. The starting position is increasingly common: social engineering creates the execution context, and the malware exploits the trust already granted to the user session.

Key questions

Q: What breaks when users are tricked into running PowerShell commands themselves?

A: The usual assumption that malicious code enters as a file or attachment breaks immediately. User-assisted execution turns a legitimate Windows utility into the delivery mechanism, so static file inspection, hash blocking, and simple download controls miss the initial compromise path. Teams need telemetry that recognises suspicious command-line behaviour and hidden execution.

Q: Why do staged malware frameworks increase operational risk compared with a single payload?

A: Staged frameworks let operators separate delivery, loader, and core capabilities, which makes detection harder and response slower. Each stage can change transport, persistence, or payload content independently. That modularity also supports rapid updates and task-specific plugins, so defenders must treat a small initial download as the start of a broader intrusion rather than a contained event.

Q: How can security teams detect DLL sideloading before it becomes a long-dwell intrusion?

A: Watch for signed executables loading libraries from user-writable or unusual directories, especially when the library name matches a legitimate dependency. Pair that with allowlisting, hash validation, and endpoint telemetry that highlights unexpected module loads. The goal is to detect the mismatch between trusted binary and untrusted library.

Q: Should organisations prioritise behaviour analytics over signatures for ClickFix-style attacks?

A: Yes, because the attack is designed to hide the malicious code behind legitimate utilities, transient files, and in-memory execution. Signatures still help with known indicators, but they are not enough when the payload changes shape, moves into memory, or rides on trusted binaries. Behavioural analytics gives defenders the earlier and broader view.

Technical breakdown

User-assisted execution turns trust into the initial access path

ClickFix attacks depend on the victim executing commands that appear routine, such as opening the Run dialog and pasting a PowerShell line. In this campaign, that command used execution-policy bypass and in-memory retrieval with iex(irm ...), which avoids creating a normal file artefact on disk. Because the code is pulled and run inside a hidden process, conventional file inspection and simple hash-based blocking lose much of their value. The real control boundary is not the malware binary but the user action that initiates PowerShell with elevated trust in a normal Windows utility.

Practical implication: treat user-driven command execution as an entry vector and add controls that detect suspicious PowerShell invocation patterns, not just payload hashes.

Staged ZIP delivery and DLL side-loading extend the attack chain

The campaign uses a second-stage ZIP download to separate initial execution from final payload delivery. That staging reduces immediate detection because the first command retrieves a small loader while the actual malicious components arrive later, often into a temporary or disguised directory. The use of psl.exe to load libpsl-5.dll is DLL side-loading, where a trusted executable is abused to load an attacker-controlled library from an expected path. This is a classic defence-evasion pattern because the process name looks legitimate while the loaded code is not.

Practical implication: correlate archive downloads, trusted-binary launches, and unexpected DLL load paths as one chain instead of analysing each event in isolation.

Persistence and in-memory injection minimise visibility after compromise

Once the payload is running, the operators establish persistence with registry Run keys and scheduled tasks so the malware survives user logon. The PureHVNC component is then mapped into memory and injected into AddInProcess32.exe, which lets the attacker run code under a legitimate process and reduce forensic residue. This combination matters because it shifts the detection challenge from static malware identification to runtime behaviour. When payloads are injected and temporary files are removed, post-event investigation becomes far harder unless telemetry captures the sequence in real time.

Practical implication: monitor persistence creation, process injection, and anomalous child-process chains as linked behaviours, not separate alerts.

Threat narrative

Attacker objective: The attacker’s objective is persistent interactive control of the victim workstation through a stealthy remote access trojan.

1. Entry occurred when the victim was lured through a fake Booking-themed portal into running a malicious PowerShell command from the Windows Run dialog.
2. Credential access was not the primary mechanism here; instead, the attacker used legitimate user execution and PowerShell to retrieve staged code in memory and begin control of the host.
3. Escalation and persistence followed through ZIP delivery, DLL side-loading with psl.exe, Run-key persistence, scheduled tasks, and in-memory injection into AddInProcess32.exe.
4. Impact was achieved when the PureHVNC RAT provided persistent remote access and attacker control while minimising disk artefacts and reducing forensic visibility.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

User-assisted execution is now a first-class identity risk: This campaign shows that the initial trust boundary is the human session, not the malware payload. When a user can be manipulated into executing PowerShell, the programme is no longer defending only against delivered code, it is defending against induced execution. The practical conclusion is that human IAM and endpoint telemetry must be joined at the point of action, because the compromise starts when the user becomes the execution channel.

Trusted binaries are becoming the attacker’s identity layer: The abuse of psl.exe and AddInProcess32.exe shows how legitimate processes can be used as trusted execution wrappers. That matters because many controls still assume a suspicious file or unsigned binary will be visible at the point of execution. The result is an identity-blind spot where the process identity is trusted even when the code inside it is not.

Static inspection is no longer the right control plane for ClickFix chains: The campaign’s use of in-memory retrieval, staged ZIP delivery, DLL side-loading, and process injection means the malicious artefact is often transient or disguised. That breaks the assumption that detection will see a stable file long enough to quarantine it. Security programmes need to evaluate whether they are still optimised for files, when the attack path now moves through commands, processes, and memory.

Behavioural correlation is the only reliable control narrative here: The article’s own mitigation recommendations point to the same conclusion: host profiling, beaconing, persistence, and injection only become visible when telemetry is correlated across stages. That is not a tooling preference, it is a governance requirement for campaigns built to fragment their own evidence. Practitioners should treat multi-stage behavioural correlation as a baseline requirement for modern intrusion detection.

ClickFix creates an identity-through-action model that traditional IAM does not model: The named concept here is the trust inversion created when a user is convinced to perform attacker-driven actions inside a legitimate session. In that model, identity assurance is no longer about authenticating a principal once, but about detecting when a trusted principal becomes the delivery mechanism for malicious code. Teams should reframe the problem as trust abuse inside the authenticated session.

What this signals

ClickFix changes the governance question from 'did a file arrive?' to 'did a user become the execution path?': That distinction matters because the attack is successful before the malware is fully visible. Programmes that still centre on attachment filtering will miss the trust inversion that happens inside the authenticated desktop session.

Trusted-binary abuse deserves its own detection logic: When psl.exe, AddInProcess32.exe, or other legitimate processes become carriers for attacker code, allowlists stop being sufficient on their own. The programme response is to treat abnormal child-process and DLL-load behaviour as a control gap in runtime identity assurance, not just an endpoint issue.

For practitioners

• Detect user-assisted PowerShell execution Flag hidden PowerShell windows, execution-policy bypasses, and iex(irm ...) command patterns initiated from the Run dialog or similar user-driven paths.
• Correlate staged payload delivery Join archive downloads, temporary directory writes, ZIP extraction, and follow-on DLL loads so the second-stage chain is visible as one incident.
• Monitor trusted-binary abuse Watch for signed or legitimate executables loading unexpected DLLs from abnormal paths, especially when the executable normally should not side-load libraries.
• Track persistence creation in the user profile Alert on HKCU Run key changes and scheduled task creation that appear after suspicious script execution or archive staging.
• Prioritise process-injection telemetry Inspect section mapping, remote thread creation, and legitimate-process injection into applications such as AddInProcess32.exe as indicators of in-memory execution.

Key takeaways

• This campaign shows that social engineering can convert a normal user session into the attacker’s initial access path without stealing a credential first.
• The chain combines staged downloads, DLL side-loading, persistence, and in-memory injection to reduce the value of static detections and file-based inspection.
• Defenders need behaviour-first telemetry that correlates command execution, archive staging, trusted-binary abuse, and process injection into one incident timeline.

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• DLL side-loading: A technique where a legitimate application loads a malicious library because of how Windows searches for DLL dependencies. The attacker borrows the trust of signed software to execute code, which can bypass simple reputation checks and make malicious activity look like normal program behaviour.
• Workflow Injection: Workflow injection is a technique where attacker-controlled input is placed into a CI/CD workflow so it executes unwanted commands. It often appears through pull requests, comments, issue fields, or dispatch events. The risk is remote code execution inside the build environment with access to sensitive tokens and artifacts.
• In-memory Execution: Execution that happens inside RAM without writing a durable file to disk. Security teams care about it because it reduces common forensic artefacts and can bypass controls that rely on file visibility, stable hashes, or persistent process indicators.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.