Topic starter
09/07/2026 3:32 pm
TL;DR: A ClickFix campaign used a spoofed licensing site, staged PowerShell, Donut shellcode, and in-memory .NET execution to deliver PureLogs stealer, targeting browser credentials, Windows Credential Manager, and cryptocurrency wallets, according to Gurucul. The case shows how fileless delivery blurs endpoint and identity boundaries, making credential exposure and runtime telemetry the real control points.
Editorial analysis by NHI Mgmt Group, based on content published by Gurucul: “Canndelta ClickFix Campaign Abusing Donut Shellcode to Deploy PureLogs Stealer”.
Key questions
Q: What breaks when users are tricked into running PowerShell commands themselves?
A: The usual assumption that malicious code enters as a file or attachment breaks immediately.
Q: Why do fileless stealers create a bigger credential risk than ordinary malware?
A: Fileless stealers matter because they target reusable identity material such as browser cookies, session tokens, password manager data, and Windows Credential Manager contents.
Q: What are the signs that a PowerShell loader chain is being abused for stealer deployment?
A: Look for hidden PowerShell windows, IEX or remote script retrieval, RWX memory allocation, thread creation from script hosts, and unusual outbound connections to raw IP addresses.
Practitioner guidance
- Instrument PowerShell execution paths Capture hidden-window PowerShell, paste-triggered command lines, IEX use, and raw IP connections from script hosts so ClickFix-style entry points are visible in telemetry.
- Watch for memory-resident loader behaviour Alert on RWX memory allocation, CreateThread from script hosts, and CLR initialization from unmanaged contexts because those are the execution markers used by this chain.
- Harden browser and vault secret exposure Reduce the number of reusable secrets stored in Chromium profiles, password managers, and Windows Credential Manager, and isolate them from casual endpoint access.
Bottom line: ClickFix-style delivery turns user trust into code execution and moves the attack surface from downloaded files to live process behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 3:53 pm
Fileless malware collapses the difference between endpoint compromise and identity compromise: once PowerShell, shellcode, and in-memory CLR execution are chained together, the real target becomes the secret store, not the file system. Browser profiles, Windows Credential Manager, and wallet extensions are all identity repositories in practice, even when defenders still treat them as application artefacts. That means detection strategy has to follow secret movement, not just malicious binaries.
A few things that frame the scale:
- Voice phishing was the most common initial infection vector in cloud intrusions in 2025 (23%) and the second most common across all intrusions (11%), according to Mandiant's M-Trends 2026.
A question worth separating out:
Q: What should teams do after a synced browser credential is exposed?
A: Treat the exposure as an account compromise, not a simple password reset event. Revoke active sessions, rotate the affected credentials, review MFA coverage, and check whether extensions or personal profiles may have carried additional access into the environment.
👉 Read our full editorial: ClickFix malware turns PowerShell into a fileless stealers chain