ClickFix and HijackLoader: Detecting DeerStealer Attacks

A multi-stage malware campaign leveraging ClickFix social engineering and the HijackLoader framework has been observed targeting Windows environments. By abusing the Windows Run prompt and legitimate system binaries, threat actors deliver DeerStealer, an advanced information stealer designed to harvest credentials, crypto wallets, and sensitive user data while evading traditional detection mechanisms.

This campaign demonstrates a shift toward user-executed attack chains that blend malicious activity with normal system behavior, making detection significantly more challenging for security teams.

Threat Overview

• Malware: DeerStealer (XFiles Spyware)
• Loader Chain: ClickFix → HijackLoader → DeerStealer
• Actors: Distributed via dark web forums by threat actors like “LuciferXfiles”
• Targeted Data:
  • Browser credentials
  • Cryptocurrency wallets
  • VPN access details
  • Messaging and file-sharing applications
• This combination enables attackers to gain both immediate financial access and potential long-term persistence within compromised environments.

Technical Analysis

1. Initial Access (ClickFix)

• Social Engineering Vector: ClickFix leverages phishing or malicious redirection, tricking users into opening the Windows Run Prompt and executing a PowerShell command. This is a classic user-executed attack, but the novelty is using legitimate system features to bypass security alerts.
• Encoded PowerShell Commands: The commands are base64-encoded or obfuscated, which helps evade signature-based detection by antivirus or endpoint security tools.
• Payload Delivery: PowerShell executes a curl-based download of now.msi, a malicious Microsoft Installer file. This MSI acts as the staging container for the loader.
• Operational Security: ClickFix hides artifacts by naming scripts and installers with innocuous names (now.msi) and leveraging legitimate executables to execute commands, reducing detection risk.

2. Loader Execution (HijackLoader)

• File Deployment and Binary Hijacking:
  • MSI installer drops supporting files in C:\ProgramData.
  • Hijacks a legitimate signed COMODO binary (EngineX_Co64.exe) to load cmdres.dll, an unsigned malicious DLL.
• Steganography-Based Configuration:
  • Encrypted configuration data is embedded into PNG images.
• Dynamic API Resolution:
  • HijackLoader doesn’t import APIs statically; it calculates hashes of function names and dynamically resolves them at runtime.
  • This bypasses static analysis and makes reverse engineering harder.
• Subsequent Stage Decryption:
  • Loader decrypts and executes additional components like Bairrout.xd using custom scripts.
• Execution Obfuscation:
  • HijackLoader employs control-flow obfuscation and may leverage virtual machine emulation techniques for string decryption, adding a layer of anti-analysis defense.

3. Payload Deployment (DeerStealer)

• Process Injection:
  • DeerStealer is injected into legitimate processes such as input.dll, with configurations extracted from files such as Kleanmean.py.
  • This makes the malware less detectable, as it runs under trusted processes.
• Capabilities:
  • Browser and Extension Harvesting: Extracts credentials, cookies, crypto wallets, and form autofill data from 50+ browsers and wallet extensions.
  • Application Data Theft: Targets messaging and file-sharing apps like Discord, Telegram, Steam, and FileZilla.
  • Cryptocurrency Theft: Clipboard hijacking supports 14+ cryptocurrencies; attackers replace copied wallet addresses with theirs.
  • Communication Security: Encrypted HTTPS C2 ensures stealthy data exfiltration and command retrieval.
  • Machine Fingerprinting: Uses CPU IDs, registry keys, and system identifiers to create unique victim profiles, aiding targeted campaigns.
• Subscription Model: DeerStealer is sold as malware-as-a-service, providing advanced features like Hidden VNC, custom ClickFix scripts, and security bypasses for Windows Defender and SmartScreen.

Indicators of Compromise

1. Files
   • now.msi
   • big.msi
   • EngineX_Co64.exe (abused binary)
   • cmdres.dll (malicious DLL)
   • Bairrout.xd
2. Paths
   • C:\ProgramData\
   • AppData\Local\Temp\
   • AppData\Roaming\
3. Processes
   • powershell.exe (encoded execution)
   • curl.exe (payload retrieval)
   • msiexec.exe (MSI execution)
   • EngineX_Co64.exe (hijacked execution)
4. Behavioral Indicators
   • PowerShell launched from Explorer (Run prompt)
   • Encoded or Base64 command usage
   • MSI download followed by execution
   • DLL sideloading via signed binaries
   • Suspicious file creation in ProgramData or Temp directories

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Description
Execution	T1204	User Execution	ClickFix relies on user interaction to execute malicious commands via Run prompt
Execution	T1059	Command and Scripting Interpreter	PowerShell used to execute encoded commands and download payloads
Defense Evasion	T1218.007	Msiexec	MSI files executed via msiexec.exe as part of staged deployment
Defense Evasion	T1574	Hijack Execution Flow	DLL sideloading using legitimate signed binaries (e.g., COMODO)
Defense Evasion	T1036.005	Masquerading	Malware mimics legitimate processes and file names
Discovery	T1082	System Information Discovery	Collects system data such as CPU ID, registry values, and OS details
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	Uses HTTPS for communication with C2 servers
Command and Control	T1105	Ingress Tool Transfer	Downloads additional payloads via PowerShell or curl
Collection	T1119	Automated Collection	Harvests browser credentials, cookies, and crypto wallet data
Exfiltration	T1041	Exfiltration Over C2 Channel	Exfiltrates collected data via encrypted communication channels

Prevention

• Application Control: Implement AppLocker or Windows Defender Application Control to restrict PowerShell and MSI execution.
• Endpoint Hardening: Enable PowerShell Constrained Language Mode and block execution from temp directories.
• User Training: Educate users to avoid running commands from prompts or clicking suspicious links.
• Email & Web Filters: Prevent access to phishing pages hosting ClickFix scripts.
• Network Segmentation & Zero Trust: Apply micro-segmentation and enforce device and user verification before granting access.
• Credential Protection: Enable MFA, regularly rotate financial, VPN, and crypto wallet credentials, and monitor for suspicious access.
• File System Permissions: Audit and restrict write access on sensitive directories using ACLs and disable unnecessary file sharing.
• Advanced Endpoint Protection: Deploy an EDR solution capable of detecting obfuscated binaries, DLL sideloading, process injection, and suspicious scheduled task creation.

Detection

The threat hunting team developed a detection query to identify activity related to ClickFix and HijackLoader. The corresponding KQL query is listed below.

let timeframe = ago(30d);

let clickfix_exec =
DeviceProcessEvents
| where TimeGenerated >= timeframe
| where FileName =~ "powershell.exe"
| where InitiatingProcessFileName =~ "explorer.exe"
| where ProcessCommandLine has_any (
    "-e ", "-enc", "-encodedcommand",
    "frombase64string", "iwr",
    "invoke-webrequest", "curl",
    "http://", "https://"
)
| project
    DeviceId,
    DeviceName,
    AccountName,
    ClickFixTime=TimeGenerated,
    ClickFixProcess=FileName,
    ClickFixCmd=ProcessCommandLine,
    ClickFixParent=InitiatingProcessFileName;

let curl_download =
DeviceProcessEvents
| where TimeGenerated >= timeframe
| where FileName =~ "curl.exe"
| where ProcessCommandLine has_any (".msi", "http://", "https://")
| project
    DeviceId,
    CurlTime=TimeGenerated,
    CurlCmd=ProcessCommandLine;

let msi_exec =
DeviceProcessEvents
| where TimeGenerated >= timeframe
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any (".msi", "/i")
| project
    DeviceId,
    MsiTime=TimeGenerated,
    MsiCmd=ProcessCommandLine,
    MsiParent=InitiatingProcessFileName;

clickfix_exec
| join kind=leftouter curl_download on DeviceId
| join kind=leftouter msi_exec on DeviceId
| where ChainScore >= 2

Remediation

• Isolate infected systems immediately.
• Remove malicious files from ProgramData, Temp, and user directories.
• Verify and restore any hijacked binaries.
• Rotate credentials and conduct forensic analysis of affected systems.

Trends & Impact

• Increasing use of legitimate Windows features (Run Prompt, signed binaries) to bypass security.
• Malware-as-a-service model allows broad adoption of DeerStealer features by threat actors.
• Planned expansions include macOS support, AI integration, and automated crypto balance theft.

Impacted Technologies

• Windows endpoints
• Desktop apps: Discord, Telegram, Steam, FileZilla
• Web browsers (Chrome, Edge, Firefox)
• Microsoft Entra ID and VPN access systems
• Messaging and collaboration tools
• Cryptocurrency wallets and browser extensions

Why This Is Important

This campaign demonstrates how threat actors increasingly exploit legitimate system functionalities, such as the Windows Run Prompt and signed binaries, to bypass traditional security controls and evade detection. By leveraging a multi-stage loader chain like ClickFix → HijackLoader → DeerStealer, attackers can blend malicious activity with normal system behavior, making it significantly harder for security teams to detect threats based on isolated indicators.

If left undetected, this type of attack can lead to widespread credential compromise, including browser data, VPN access, and cryptocurrency wallets, ultimately resulting in data breaches, financial loss, and account takeovers. Additionally, the use of stealthy techniques such as DLL sideloading, process injection, and encrypted command-and-control communication increases dwell time, giving attackers more opportunity to expand their access and impact.

From a business perspective, such incidents can cause operational disruption, regulatory compliance issues, and reputational damage, especially if sensitive customer or organizational data is exposed. This highlights the need for layered security, behavioral detection, and proactive threat hunting to identify and stop complex, multi-stage attacks before they fully execute.

How Wizard Cyber Can Help

• TTP-driven hunts. We run recurring, behaviour-based hunts designed to catch this kind of activity.
• Monthly unstructured hunts. Each month we investigate emerging campaigns and newly published CVEs, document what we find, and advise on next steps.
• Managed detection and response on Defender XDR. Round-the-clock monitoring and response: we triage alerts, contain affected machines, remove malicious processes, and guide rapid recovery.