Storm-0249’s ClickFix tradecraft shows why EDR trust breaks

At a glance

What this is: This is a Cybertrust Japan analysis of Storm-0249 ClickFix tradecraft, showing how the campaign used trusted tools, fake Microsoft lures, DLL sideloading and TLS-hidden command-and-control to evade endpoint detection.

Why it matters: It matters because EDR and endpoint governance break down when attackers hide inside legitimate execution paths, forcing IAM, SOC and endpoint teams to treat tool trust and signed code as attack surfaces.

Context

ClickFix attacks matter because they exploit user trust in ordinary-looking prompts and common administrative tools, not just malware families. In this case, the security problem is not a single missed signature but the collapse of assumptions that signed binaries, standard utilities and EDR telemetry will reliably expose malicious execution.

The article is also relevant to identity governance because the campaign turns access into an execution channel, then uses that foothold to preserve persistence and evade controls. For practitioners, the lesson is that endpoint security, identity controls and operational trust boundaries now overlap more tightly than many programmes assume.

Key questions

Q: What breaks when users can run trusted tools in a ClickFix attack?

A: The main failure is that defenders often trust the tool rather than the context. If curl, PowerShell, or a signed installer can execute without strong provenance checks, an attacker can convert normal administration into payload delivery. The control gap is process trust, so teams should baseline expected command chains and investigate deviations immediately.

Q: Why do trusted utilities like PowerShell and curl help attackers evade detection?

A: They help because security tools often expect those binaries to be present and active in normal administration. Attackers abuse that expectation by chaining them together, reducing suspicious file artefacts and making malicious activity look like routine scripting or troubleshooting.

Q: What signs suggest a ClickFix campaign is using DLL sideloading?

A: Look for signed executables loading libraries from user-writable paths, unexpected module names near security software, and process trees where a trusted binary starts behaving like a launcher rather than a defender. Those are the conditions that typically expose sideloading rather than ordinary application use.

Q: How should teams respond when endpoint traffic is hidden inside TLS?

A: They should anchor analysis in process context, certificate trust, destination patterns and host behaviour rather than treating encrypted traffic as opaque. If TLS hides both the command channel and the intended destination, network controls need correlation with endpoint telemetry to restore visibility.

Technical breakdown

How ClickFix turns user trust into execution

ClickFix is a social-engineering pattern that persuades the user to run attacker-controlled commands, often by imitating a legitimate support, update or verification flow. In this campaign, the lure used Microsoft-like web paths and malicious download pages to make the workflow feel normal. Once the user follows the instructions, the attacker no longer needs to break the browser or the operating system directly. They simply inherit the trust the user has already granted to the page, the process and the downloaded content.

Practical implication: Treat user-executed repair or verification prompts as a distinct attack surface and block unsafe copy-and-paste execution paths.

Why curl-to-PowerShell and DLL sideloading bypass detection

curl-to-PowerShell chains reduce visible file artefacts by streaming output directly into an interpreter, which makes traditional file-based inspection less effective. DLL sideloading goes one step further by placing a malicious library beside a legitimate signed executable so the trusted process loads the attacker’s code. In both cases, the malicious action is hidden inside an allowed execution path. That means detection must look at process ancestry, command-line patterns, module loads and trust boundaries, not just hashes or static file reputation.

Practical implication: Instrument process and module telemetry so interpreter chaining and side-loaded libraries are visible before execution completes.

How TLS-hidden C2 weakens endpoint and network visibility

When command-and-control traffic is wrapped in TLS, perimeter tools may see only encrypted sessions, not the command content. The article also notes use of security-product traffic and DLL-based redirection to make the destination appear more legitimate. That combination weakens both network inspection and some endpoint heuristics because the traffic blends into normal enterprise connectivity. Effective defence therefore depends on context, such as certificate, domain, process and destination correlation, rather than assuming encrypted traffic is benign or opaque by default.

Practical implication: Correlate encrypted traffic with process context and certificate trust to spot covert C2 hiding inside normal TLS sessions.

Threat narrative

Attacker objective: The objective was to gain persistent, stealthy access on endpoint environments while avoiding EDR visibility long enough to support broader post-compromise activity.

1. Entry began with phishing pages that mimicked Microsoft URLs and lured the user into downloading a malicious package.
2. Credentialed execution was then obtained through user-driven curl-to-PowerShell activity and DLL sideloading, which let the attacker abuse trusted processes and signed binaries.
3. The campaign then established covert command-and-control over TLS and used security-product camouflage to prolong access and reduce detection.

Breaches seen in the wild

• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

EDR trust is now part of the attack surface. This campaign shows that endpoint controls can fail when they treat signed executables, common utilities and security-product traffic as inherently trustworthy. The attacker did not need to defeat EDR head-on if they could route malicious behaviour through allowed execution paths. Practitioners should treat trust in endpoint tooling as something that must be continuously tested, not assumed.

ClickFix is a governance problem, not just a phishing problem. The real issue is the handoff between user action, interpreter execution and downstream persistence. That handoff crosses security, endpoint and identity responsibilities, which means detection gaps often sit between teams rather than inside a single control. A coordinated operating model is needed because the abuse path depends on stitching together multiple benign components.

Tool trust drift is becoming a named failure mode. The article’s pattern is a clear example of trust in curl, PowerShell, signed binaries and TLS becoming operationally overextended. Once defenders rely on the legitimacy of the tool instead of the legitimacy of the action, attackers can hide in plain sight. The practical conclusion is that trust must be evaluated at execution time and correlated to intent, not just provenance.

Identity governance has to include execution authority. When user interaction or device context can trigger privileged code paths, IAM and endpoint policy can no longer be treated as separate worlds. The relevant control question is who or what is allowed to cause execution, not just who can log in. That broadens governance into the runtime layer where access becomes activity, and activity becomes compromise.

What this signals

Tool trust drift: Attackers are now exploiting the operational habit of trusting common tools, signed binaries and vendor-looking prompts. For practitioners, the lesson is to move from static trust decisions to execution-context verification, because the malicious action often looks like ordinary administration until it is too late.

Endpoint programmes should expect more campaigns that fuse user deception with living-off-the-land execution and module hijacking. The practical response is to join endpoint, identity and network telemetry so a command, the process that launched it and the destination it reaches can be reviewed together.

For practitioners

• Block unsafe copy-and-paste execution paths Restrict or monitor workflows that ask users to paste commands into terminal or Run dialogs, especially where the prompt imitates vendor support or update pages.
• Hunt for interpreter chaining Create detections for curl.exe piping directly into PowerShell, unusual command-line chains, and script execution from download locations or user profile paths.
• Detect DLL sideloading conditions Alert when signed executables load unexpected libraries from AppData or adjacent user-writable directories, especially where the filename mirrors a trusted security product component.
• Correlate TLS sessions with process lineage Join network telemetry to parent process, certificate and domain reputation data so encrypted C2 can be tied back to the initiating binary or script.

Key takeaways

• Storm-0249’s ClickFix tradecraft shows that endpoint defence can be bypassed without exotic malware when attackers can route execution through trusted utilities and signed code.
• The campaign combines phishing, interpreter chaining, DLL sideloading and encrypted C2, which makes trust boundaries more important than individual signatures.
• Teams need to detect the relationship between user action, process lineage and network destination, because the compromise path lives in that linkage.

Key terms

• ClickFix: A browser-delivered social engineering technique that persuades a user to paste and execute a malicious command, usually through clipboard manipulation and a fake instruction sequence. The key risk is that the endpoint may see a normal user action even though the payload originated from a hostile webpage.
• DLL Sideloading: A technique where a legitimate executable loads a malicious library from a location the application checks before the real system path. It works because the program’s trust is inherited by the code it loads, which makes execution control as important as file reputation.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Command-and-control: Command-and-control is the communication channel an attacker uses to issue instructions to malware and receive results back from a compromised host. For XWorm, the channel is encrypted and used for session management, payload delivery, surveillance, and modular expansion of capabilities after compromise.

Deepen your knowledge

Build a stronger identity foundation with the NHI Foundation Level course, the industry's only accredited NHI security programme. It helps practitioners connect access governance, machine identity and operational control across modern environments.