ClickFix in 2026: PNG Steganography, Domain Controllers, and Developer Paste Habits

ClickFix still begins when someone pastes a command a webpage put on the clipboard—but Huntress says the payloads after that paste are no longer “just an infostealer.” In a November 10, 2026 investigation roundup, analysts document fake Cloudflare turnstiles, terminal windows that mimic security checks, executables rebuilt from PNG pixel data, browser-cache-seeded batch files, and at least one chain that reached a primary domain controller through WinRM and reverse SSH tunnels. If you install Claude Code, Codex, or Cursor by searching the web—or help less technical colleagues do it—you share the same failure mode InstallFix campaigns already exploit.

TL;DR

What Huntress published

Huntress titles the post “Beyond the clipboard” and stresses these are separate investigations, not one monolithic campaign. Key takeaways from the primary source:

• ClickFix now feeds persistence, lateral movement, reconnaissance, and credential theft—not only first-stage downloaders.
• Fake verifications include colored terminal text, animated progress bars, and even a fake Cloudflare Security Challenge UI built entirely in PowerShell.
• Delivery paths include malvertising, SEO poisoning, and compromised legitimate sites (a dental practice site appears in multiple chains).

Delivery still converges on a clipboard PowerShell one-liner after the victim clicks a fake “Verify that you are human” control.

Image: Huntress

Huntress also notes Custom GPT abuse in an earlier MSI campaign—relevant because developers treat ChatGPT properties as trusted—but the November chains emphasize endpoint execution after paste.

For earlier steganography limited to shellcode in pixels, see Huntress’s November 24, 2025 write-up; the 2026 chains differ because they reconstruct complete executables.

Huntress also catalogs delivery creativity since August 2026 in the same post: typosquatted Westlaw ads through Bing, LinkedIn and real-estate SEO lures, Custom GPT funnels, Google Doc “decryption” prompts, and macOS-targeted payloads. None of those are required steps in the PNG or domain-controller chains below, but they explain why ClickFix keeps resurfacing in threat feeds your security team may already watch.

Attack chain 1: steganographic PNG delivery

Huntress describes the sequence as follows:

1. The user pastes ClickFix PowerShell; a fake Cloudflare verification renders in the terminal while work continues silently.
2. The script drops verify_pkg.zip under the user’s Temp directory.
3. A signed Microsoft binary (LockScreenContentServer.exe) lands in C:\ProgramData\7168f7f870a45fbb\ beside a rogue DLL and 1.bat.
4. 1.bat launches a multi-stage PowerShell stager that downloads ordinary-looking PNG files containing executable bytes in pixel data, rebuilds binaries on disk, and executes them.
5. Persistence follows via a scheduled task and a Run key (LockScreenContentServer_qQrRrJiHX in the published IOC table).

The image never requires a double-click; the pasted command is the only user action Huntress highlights. That distinction matters when training developers who assume “I didn’t open the attachment.”

Published SHA256 values in the Huntress IOC section include the signed host binary, malicious dui70.dll, and the staging batch file—useful for threat-intel platforms, though Huntress warns defenders to prioritize behavioral sequences over static names.

Attack chain 2: browser-cache seeding

John Hammond’s investigation of the compromised dental site shows a different cache trick:

1. The site plants a 17,635-byte file into the victim’s browser cache during a normal page load.
2. ClickFix serves a browser-specific cmd one-liner (Chrome, Firefox, or Brave paths differ only by cache directory).
3. The command searches cached files for exactly that byte size, copies the match to %TEMP%\t.bat, and executes it—launching downstream PowerShell and additional payloads.

Huntress pairs this with elaborate fake network “checks” rendered in a PowerShell window so the victim believes verification is still running.

For developers, the lesson is structural: browsing a compromised site can stage malware before any install command, so the paste step only retrieves what is already local.

Attack chain 3: domain controller lateral movement

A September incident in the same post escalates beyond endpoint malware:

1. ClickFix downloads cf_verify.zip, extracts CertEnrollCtrl.exe with a malicious CertEnroll.dll, and runs 1.bat.
2. Persistence uses a Run key and scheduled task named CertEnrollCtrl_Y0db6oZq9.
3. Native tools (nltest.exe, net.exe, whoami.exe, findstr.exe) perform Active Directory reconnaissance.
4. A Base64 blob stages reverse SSH to 23.227.199[.]41 via C:\ProgramData\ShService\r.ps1, with task SysyService.
5. The operator WinRMs to the primary domain controller, creates a user, adds local Administrators, and opens a second SSH tunnel.

Huntress contrasts this with February (Matanbuchus → AstarionRAT → PsExec to two domain controllers) and May (Potemkin loader spreading across 11 hosts via administrative shares). ClickFix is becoming initial access for enterprise movement, not only consumer infostealers.

That overlap should concern teams who let coding agents run on domain-joined laptops with cached corporate credentials—even when the agent itself was not the entry point.

DuskDesk: Node.js RAT dressed as RMM

Two incidents delivered an MSI from apirequestaccess[.]com, installing a Node.js runtime that launches LimeMint.js via launch.js, with configuration in UmberOceanTan.dat. Persistence uses a Run key branded DuskDesk, evoking legitimate remote-management tools.

Huntress observed node.exe connecting to 167.148.201[.]104:3861, characterizing it as command-and-control. For JavaScript-heavy engineering teams, unexpected node.exe outside dev projects is a hunting lead—similar to why Aur0ra operators abused Cursor agents on already-compromised estates.

What this means if you run AI coding agents

Paste discipline beats product filters

InstallFix already showed that search ads can swap curl | bash or PowerShell install lines. Huntress proves the post-paste stage can now own domain infrastructure. Training rules stay blunt:

• Legitimate CAPTCHAs never require Run, cmd, or PowerShell pastes.
• Install Claude Code, Codex, and Cursor only from vendor documentation reached by typing the official domain—not from sponsored results.

Assume the dev laptop is high value

Agents store OAuth tokens, API keys, and MCP configs on disk—exactly what WardenStealer and Aoki harvest after unrelated infections. A ClickFix foothold on the same machine may precede repo access and CI secret theft even when no AI product was spoofed.

Detection Huntress recommends

The vendor advises correlating:

• Browser or user processes spawning cmd, PowerShell, or Windows Terminal
• Encoded PowerShell and execution-policy bypasses
• Archives or binaries under user-writable paths
• New scheduled tasks, Run keys, or outbound SSH shortly after browser activity

Hash-only rules miss rotating names; sequence-based detections match how operation-scale agent attacks also chain small footholds into secrets.

Corporate controls

Huntress suggests blocking execution from Temp, restricting unsigned binaries, limiting local admin, and controlling access to Run dialogs via policy. Those controls also reduce what a compromised coding agent can do—but only if the agent runs under the same restricted principal.

Huntress “stop the paste” guidance (verbatim themes)

The primary source groups defenses into three buckets defenders can map to runbooks:

1. User training — emphasize that real CAPTCHAs never ask for shell commands; reporting suspicious pages is part of the control, not an optional nicety.
2. Execution control — allowlisting, blocking launches from user-writable directories, and tightening who may open cmd or PowerShell interactively.
3. Behavioral detection — treat browser → shell → encoded PowerShell → archive in Temp → new task or Run key → outbound SSH as one story, even when filenames rotate.

That third bucket is where SOCs catch ClickFix after paste, which is why developer laptops enrolled in shallow EDR policies remain a gap: the initial action looks like self-inflicted administration.

Why this overlaps AI-tool lures

Graphika and CSA InstallFix reporting showed attackers do not need fake CAPTCHAs when the user already intends to run an install command. Huntress shows the same psychology inverted: elaborate fake security theater in the terminal convinces users the paste is defensive. Both abuse developer comfort with copying one-liners—a habit coding agents reinforce when they suggest curl | bash, npx, or winget snippets. The mitigation is cultural: treat every clipboard command like a production deploy approval.

IOC hygiene

Huntress publishes defanged domains and IPs in its tables (bracketed dots) so casual readers do not resolve live infrastructure. Re-fang only inside controlled intel platforms. If you ingest their Westlaw malvertising chain, expect redirectors such as vvestalw.ghost[.]io, landing pages like westlaw-signon[.]com, and staging folders under C:\ProgramData\ with random hex names—patterns that matter more than any single hash when operators rotate payloads weekly.

What Beam can and cannot do here

Beam helps after an agent is already running on a machine: it records tool activity, scans skills and MCP configs heuristically, redacts known secret shapes before storage, and can deny selected PreToolUse actions on Claude Code and Codex when local policy is cached (how Beam watches).

ClickFix wins before any agent hook fires, by convincing a human to paste attacker-controlled shell. Beam does not:

• Inspect arbitrary PowerShell sessions you open manually
• Replace EDR or application control
• Guarantee deny when cached workspace policy is missing (fail-open documented behavior)

Where Beam still adds value on a hardened machine: if malware or a second-stage script tries to drive Codex or Claude Code to exfiltrate keys through tool calls, you get an on-device audit trail and optional denies—not prevention of the initial paste.

Frequently asked questions

See front matter FAQ entries for concise answers mirroring the sections above.

Related reading

• DOJ FaceStealer: fake video meetings targeting open-source maintainers (November 12, 2026)
• TypoPrompting: 186 AI typosquat domains to ClickFix, Net Guard, and search hijacks (Island, November 12, 2026)
• Fake Claude Code installers: InstallFix explained
• WardenStealer and Aoki target Claude Code and Codex tokens
• Aur0ra ransomware and Cursor agents to domain admin
• Operation Ghost Campus: API key harvesting
• November 2026 attacks timeline
• Primary source: Huntress — Beyond the clipboard (November 10, 2026)

Incident details and IOCs are accurate as of November 11, 2026, per Huntress publishing. Separate operators reuse ClickFix; your environment may see subsets of these chains only.