ClickFix/HijackLoader Loader Chain

• Malware: DeerStealer (XFiles Spyware)
• Loader Chain: ClickFix → HijackLoader → DeerStealer
• Actors: Distributed via dark web forums by threat actors like “LuciferXfiles”
• Targeted Data:
  • Browser credentials
  • Cryptocurrency wallets
  • VPN access details
  • Messaging and file-sharing applications
• This combination enables attackers to gain both immediate financial access and potential long-term persistence within compromised environments.

1. Initial Access (ClickFix)

• Social Engineering Vector: ClickFix leverages phishing or malicious redirection, tricking users into opening the Windows Run Prompt and executing a PowerShell command. This is a classic user-executed attack, but the novelty is using legitimate system features to bypass security alerts.
• Encoded PowerShell Commands: The commands are base64-encoded or obfuscated, which helps evade signature-based detection by antivirus or endpoint security tools.
• Payload Delivery: PowerShell executes a curl-based download of now.msi, a malicious Microsoft Installer file. This MSI acts as the staging container for the loader.
• Operational Security: ClickFix hides artifacts by naming scripts and installers with innocuous names (now.msi) and leveraging legitimate executables to execute commands, reducing detection risk.

2. Loader Execution (HijackLoader)

• File Deployment and Binary Hijacking:
  • MSI installer drops supporting files in C:\ProgramData.
  • Hijacks a legitimate signed COMODO binary (EngineX_Co64.exe) to load cmdres.dll, an unsigned malicious DLL.
• Steganography-Based Configuration:
  • Encrypted configuration data is embedded into PNG images.
• Dynamic API Resolution:
  • HijackLoader doesn’t import APIs statically; it calculates hashes of function names and dynamically resolves them at runtime.
  • This bypasses static analysis and makes reverse engineering harder.
• Subsequent Stage Decryption:
  • Loader decrypts and executes additional components like Bairrout.xd using custom scripts.
• Execution Obfuscation:
  • HijackLoader employs control-flow obfuscation and may leverage virtual machine emulation techniques for string decryption, adding a layer of anti-analysis defense.

3. Payload Deployment (DeerStealer)

• Process Injection:
  • DeerStealer is injected into legitimate processes such as input.dll, with configurations extracted from files such as Kleanmean.py.
  • This makes the malware less detectable, as it runs under trusted processes.
• Capabilities:
  • Browser and Extension Harvesting: Extracts credentials, cookies, crypto wallets, and form autofill data from 50+ browsers and wallet extensions.
  • Application Data Theft: Targets messaging and file-sharing apps like Discord, Telegram, Steam, and FileZilla.
  • Cryptocurrency Theft: Clipboard hijacking supports 14+ cryptocurrencies; attackers replace copied wallet addresses with theirs.
  • Communication Security: Encrypted HTTPS C2 ensures stealthy data exfiltration and command retrieval.
  • Machine Fingerprinting: Uses CPU IDs, registry keys, and system identifiers to create unique victim profiles, aiding targeted campaigns.
• Subscription Model: DeerStealer is sold as malware-as-a-service, providing advanced features like Hidden VNC, custom ClickFix scripts, and security bypasses for Windows Defender and SmartScreen.

1. Files
   • now.msi
   • big.msi
   • EngineX_Co64.exe (abused binary)
   • cmdres.dll (malicious DLL)
   • Bairrout.xd
2. Paths
   • C:\ProgramData\
   • AppData\Local\Temp\
   • AppData\Roaming\
3. Processes
   • powershell.exe (encoded execution)
   • curl.exe (payload retrieval)
   • msiexec.exe (MSI execution)
   • EngineX_Co64.exe (hijacked execution)
4. Behavioral Indicators
   • PowerShell launched from Explorer (Run prompt)
   • Encoded or Base64 command usage
   • MSI download followed by execution
   • DLL sideloading via signed binaries
   • Suspicious file creation in ProgramData or Temp directories

• Application Control: Implement AppLocker or Windows Defender Application Control to restrict PowerShell and MSI execution.
• Endpoint Hardening: Enable PowerShell Constrained Language Mode and block execution from temp directories.
• User Training: Educate users to avoid running commands from prompts or clicking suspicious links.
• Email & Web Filters: Prevent access to phishing pages hosting ClickFix scripts.
• Network Segmentation & Zero Trust: Apply micro-segmentation and enforce device and user verification before granting access.
• Credential Protection: Enable MFA, regularly rotate financial, VPN, and crypto wallet credentials, and monitor for suspicious access.
• File System Permissions: Audit and restrict write access on sensitive directories using ACLs and disable unnecessary file sharing.
• Advanced Endpoint Protection: Deploy EDR solution capable of detecting obfuscated binaries, DLL sideloading, process injection, and suspicious scheduled task creation.

The Threat Hunting team developed a detection query to identify activity related to ClickFix/HijackLoader. The corresponding KQL query is listed below.

let timeframe = ago(30d); 

let clickfix_exec = 

DeviceProcessEvents 
| where TimeGenerated >= timeframe 
| where FileName =~ "powershell.exe" 
| where InitiatingProcessFileName =~ "explorer.exe" 
| where ProcessCommandLine has_any (
"-e ", "-enc", "-encodedcommand", 
"frombase64string", "iwr", 
"invoke-webrequest", "curl", 
"http://", "https://"
)
| project 
DeviceId, 
DeviceName, 
AccountName, 
ClickFixTime=TimeGenerated, 
ClickFixProcess=FileName, 
ClickFixCmd=ProcessCommandLine, 
ClickFixParent=InitiatingProcessFileName; 

let curl_download = 

DeviceProcessEvents 
| where TimeGenerated >= timeframe 
| where FileName =~ "curl.exe" 
| where ProcessCommandLine has_any (".msi", "http://", "https://") 
| project 
DeviceId, 
CurlTime=TimeGenerated, 
CurlCmd=ProcessCommandLine; 

let msi_exec = 

DeviceProcessEvents 
| where TimeGenerated >= timeframe 
| where FileName =~ "msiexec.exe" 
| where ProcessCommandLine has_any (".msi", "/i") 
| project 
DeviceId, 
MsiTime=TimeGenerated, 
MsiCmd=ProcessCommandLine, 
MsiParent=InitiatingProcessFileName; 

clickfix_exec 
| join kind=leftouter curl_download on DeviceId 
| join kind=leftouter msi_exec on DeviceId 
| where ChainScore >= 2 

• Isolate infected systems immediately.
• Remove malicious files from ProgramData, Temp, and user directories.
• Verify and restore any hijacked binaries.
• Rotate credentials and conduct forensic analysis of affected systems.

• Increasing use of legitimate Windows features (Run Prompt, signed binaries) to bypass security.
• Malware-as-a-service model allows broad adoption of DeerStealer features by threat actors.
• Planned expansions include macOS support, AI integration, and automated crypto balance theft.

• Windows endpoints
• Desktop apps: Discord, Telegram, Steam, FileZilla
• Web browsers (Chrome, Edge, Firefox)
• Microsoft Entra ID and VPN access systems
• Messaging and collaboration tools
• Cryptocurrency wallets and browser extensions

This campaign demonstrates how threat actors increasingly exploit legitimate system functionalities, such as the Windows Run Prompt and signed binaries, to bypass traditional security controls and evade detection. By leveraging a multi-stage loader chain like ClickFix → HijackLoader → DeerStealer, attackers can blend malicious activity with normal system behavior, making it significantly harder for security teams to detect threats based on isolated indicators.

If left undetected, this type of attack can lead to widespread credential compromise, including browser data, VPN access, and cryptocurrency wallets, ultimately resulting in data breaches, financial loss, and account takeovers. Additionally, the use of stealthy techniques such as DLL sideloading, process injection, and encrypted command-and-control communication increases dwell time, giving attackers more opportunity to expand their access and impact.

From a business perspective, such incidents can cause operational disruption, regulatory compliance issues, and reputational damage, especially if sensitive customer or organizational data is exposed. This highlights the need for layered security, behavioral detection, and proactive threat hunting to identify and stop complex, multi-stage attacks before they fully execute.

• TTP-Driven Hunts
  • We run recurring, behavior-based hunts designed to catch malicious activity.
• Unstructured Monthly Hunts
  • Each month we investigate emerging campaigns and emerging CVE frameworks, document what we find, and advise on next steps.
• Managed Detection & Response (Defender XDR)
  • 24/7 monitoring and response: we triage alerts, contain affected machines, remove malicious processes, and guide rapid recovery.