Public Advisory · SL-ADV-2026-V13
A ClickFix social-engineering campaign staged from AS202412 delivers a multi-stage .NET loader that is recompiled both on the operator's server and again on the victim's own machine. Every infection produces new file hashes. Hash-based detection does not work against it, and this advisory explains what does.
A social-engineering lure served from compromised third-party websites.
Visitors to certain compromised legitimate websites are shown a counterfeit "verify you are human" challenge that imitates a well-known bot-protection service. The page silently places a command into the visitor's clipboard and instructs them to paste and run it. This technique is commonly called ClickFix.
The pasted command is wrapped in comment markers so that the portion visible in the Windows Run dialog resembles a harmless diagnostic reference number. A user who follows the instructions triggers a chain that retrieves and executes a multi-stage payload.
The lure includes instruction text localised into multiple languages, indicating a broad international campaign rather than targeting of any single country or sector.
The counterfeit challenge is a close visual copy of a legitimate one. The reliable distinction is behavioural: a genuine bot-protection challenge never asks the user to copy, paste, or run anything. Any "verification" page that instructs a visitor to open the Run dialog or a terminal is malicious, regardless of appearance.
Two independent layers of per-infection uniqueness.
Most malware campaigns can be partially blocked by known-bad file hashes. This one defeats that approach twice over, through two separate mechanisms operating at different points in the chain.
The loader served to each visitor carries a compilation timestamp that postdates the visitor's own session identifier, by roughly five minutes in observed cases and reproduced across separate sessions. The operator compiles the outer wrapper after the request for it arrives. The internal module name is also regenerated per build, following a consistent short pattern, while the functional core remains constant and is several days older.
After execution begins, the chain invokes the .NET compiler already present on Windows to build a small helper component on the victim host at runtime. This component is a minimal launcher: it allocates memory, starts a thread, and waits. It contains no payload of its own — the executable content is supplied in memory and is never written to disk. Its class and module names are randomised on every execution, so two runs minutes apart on the same machine produce two different files with the same behaviour.
Any detection strategy resting primarily on file hashes will miss this campaign. Hashes of the stable inner components retain some value; hashes of the outer loader and the runtime-built launcher are effectively single-use and should not be deployed as primary signatures.
Ranked by how well each survives the campaign's rebuild mechanisms.
A Windows service host process loading the legacy .NET runtime (version 2.0.50727) is not normal behaviour. This is visible in ordinary .NET runtime binding logs and requires no memory forensics or specialist tooling. Notably, that runtime version predates in-runtime antimalware scanning of loaded assemblies, so its use also frustrates that protection.
The loader begins with a four-byte signature where a standard Windows executable header is expected, while remaining structurally valid further in. This is a byproduct of the packing tool and has stayed constant across many versions of this family. It survives both rebuild layers.
Domains and address ranges in section 04. Durable for as long as the operator retains the infrastructure, and independent of any file-level change.
A browser process writing to the clipboard, followed shortly by a scripting interpreter starting with a network-retrieval command pointed at a bare IP address. Strong behavioural signal, but requires endpoint telemetry to observe.
The generated helper always imports the same small set of memory-allocation and thread-creation functions, in a very small file. The names change every run; the import set does not.
Single-use by design. Useful only for retrospective correlation between samples, never as a blocking signature.
Operator-controlled infrastructure only.
| Indicator | Resolves to | Role |
|---|---|---|
| senterprise2026.com | 158.94.211.92 | Payload staging |
| dntds.shop | 178.16.53.137 | Command and control |
| 158.94.211.92 | AS202412 | Payload staging (HTTP) |
| 178.16.53.137 | AS202412 | Command and control (HTTPS) |
Neither address was observed initiating inbound connections. They are outbound destinations only and will not appear in inbound-facing telemetry.
130.12.180.0/24 146.19.125.0/24 158.94.208.0/24 158.94.209.0/24
158.94.210.0/24 158.94.211.0/24 178.16.52.0/24 178.16.53.0/24
178.16.54.0/24 178.16.55.0/24 193.30.241.0/24 45.132.180.0/24
45.74.7.0/24 91.92.240.0/24 91.92.241.0/24 91.92.242.0/24
91.92.243.0/24 94.154.35.0/24 94.154.46.0/24 94.26.38.0/24Monitoring the full set is recommended. The operator has demonstrated a pattern of announcing ranges before putting them into service.
/std/?sid=<13-digit epoch milliseconds>-<8 alphanumeric characters>| Component | SHA-256 | Signature value |
|---|---|---|
| Core payload assembly | bd38547ca14e76996594f274ee19feaf20dafc4f27309ad4bbcf72ce3088f3bf | Stable — highest value |
| Injector component | 6270f38bdf27aebb108331a484220a8bc0b9a1e6a2c4bba6dad89a2f3665bca5 | Stable — usable |
| Outer loader | b3364defc07f3323fb3e9cda37cdf6c0fe60428512e78c22f7166703f8d17a21 | Single-use — correlation only |
Two categories where over-blocking causes real harm.
The campaign retrieves data from a public smart contract through a legitimate, widely used blockchain RPC service. That service is not malicious and must not be blocklisted. Doing so breaks unrelated legitimate applications for other users. The useful signal is the anomaly of a corporate endpoint contacting a blockchain RPC at all — not the provider's existence. Note also that this retrieval channel cannot be removed by registrar or hosting action, because the data resides on a public distributed ledger.
The lure is served from legitimate websites that have themselves been compromised. Their operators are victims, not participants. They should not be blocklisted, named in public threat feeds, or reported as malicious infrastructure. Several such sites provide public-interest information, and blocking them harms the people who rely on them while doing nothing to inconvenience the operator, who simply compromises another host.
The appropriate response on discovering such a site is private notification to its operator and to the relevant national or sectoral CERT, allowing a remediation window before any public reference.
In order of effort against benefit.
Stated explicitly so the gaps are not filled in by inference.
The final objective of the campaign is unresolved. The payload delivered from the command-and-control server is loaded directly into managed memory and does not appear in conventional memory captures of suspicious regions. Its configuration is encrypted and has not been recovered. This advisory therefore makes no claim as to whether the final stage is a credential stealer, a remote access tool, or a loader for further payloads.
No claim is made regarding theft of any specific category of data. No claim is made that any named organisation was breached beyond the website compromise described in general terms. Where evidence was insufficient to support a conclusion, no conclusion is offered.
Findings here are drawn from static analysis of samples and observation of network behaviour. Assessments described as reproduced were confirmed across more than one independent execution. Anything not so described should be treated as a single-observation finding. This advisory will be revised if the final-stage objective is established, and corrections will be marked rather than silently applied.
Mapped to MITRE ATT&CK for coverage assessment.
| ID | Technique | Use in this campaign |
|---|---|---|
| T1189 | Drive-by Compromise | Lure served from compromised legitimate sites |
| T1204.004 | Malicious Copy and Paste | Clipboard-delivered command, user-executed |
| T1059.001 | PowerShell | Staging and execution |
| T1027 | Obfuscated Files or Information | Encrypted configuration; per-request rebuild |
| T1027.004 | Compile After Delivery | Runtime compilation on the victim host |
| T1055 | Process Injection | Injection into standard system processes |
| T1620 | Reflective Code Loading | Final stage loaded into managed memory |
| T1102.001 | Dead Drop Resolver | Data staged in a public smart contract |
| T1562.001 | Impair Defenses | Legacy runtime avoids assembly scanning |