Omegatech ClickFix → Donut infostealer

01 Summary

This wave was delivered via ClickFix social engineering from the compromised WordPress host verrerie-farinelli.com, which previously appeared in the V14.x line. The page presents a fake Cloudflare Turnstile "verify" widget that plants a clipboard PowerShell one-liner. That one-liner fetches a script from a rotating verification-themed host, which pulls a password-protected ZIP stager containing build.exe — a .NET Donut loader that injects a CLR-hosted infostealer into Chrome and Edge, harvests browser credentials, cookies and wallet data, and establishes persistence through a signed-binary sideload.

02 Kill chain

03 Network IOCs — active infrastructure

All domains below were confirmed live-resolving in behavioral capture 260811-1ec5vayzdt on 2026-08-11 (SNI + resolved IP observed on the wire). Domains rotate per wave — treat as time-bounded IOCs and re-validate before production alerting.

04 Host IOCs — dropped files

Host artifacts

• Staging directory: C:\ProgramData\c295b490e63c1a9d\ (16-hex name)
• Run key: HKCU\…\CurrentVersion\Run\LockScreenContentServer_BXxzxoJf0
• Scheduled task: LockScreenContentServer_BXxzxoJf0 (/sc minute /mo 60)
• Injection API: NtCreateProcessExOtherParentProcess → Chrome / Edge

05 Durable C2 key

The RSA-1024 CAPI handshake public key remains the cluster's most stable pivot. The client RSA-wraps its AES session key with this public key before exfil. Reused unchanged across every tracked wave.

# CAPI PUBLICKEYBLOB
bType        06        (PUBLICKEYBLOB)
bVersion     02
aiKeyAlg     00 A4 00 00  (CALG_RSA_KEYX)
magic        "RSA1"
bitlen       1024
pubexp       65537

# SHA-256 of big-endian modulus (the durable anchor)
dc4cb85885ffcf7bfa6f37c8ac4a8334a9504c06df0307a599c67ee2febfac6f

Recovery this wave: 34 blob instances in PID 4688 (injected .NET infostealer), all matching. Verified by carving the blob, reversing the little-endian modulus to big-endian, and hashing — no eyeballing of digits.

06 MITRE ATT&CK

07 Wave delta vs. prior V14.x

Read: same durable key, new delivery infrastructure — the expected rotation profile (cheap layer churns, expensive layer frozen).

08 Detection & response

• Hunt the behavioral Sigma rules (ClickFix one-liner, ProgramData 16-hex sideload, Run+task pair, build.exe from .zip_x) — these survive infrastructure rotation.
• Scan memory and files with the YARA C2-key rule; a match is high-confidence cluster attribution.
• Block the active lure/stage domains in §03 as time-bounded IOCs; do not block the RPC nodes in §03.
• Remove persistence: C:\ProgramData\c295b490e63c1a9d\, the Run key, and the scheduled task.
• Treat any browser-cred exposure on affected hosts as compromised — rotate credentials and sessions.
• User guidance: never paste-and-run clipboard commands from a "verify you are human" prompt.

09 Companion machine-readable artifacts

• SL-ADV-2026-WP-001_V14_9.stix.json — STIX 2.1 bundle (indicators, malware, relationships)
• SL-ADV-2026-WP-001_V14_9.sigma.yml — Sigma ruleset (5 rules, behavioral + IOC)
• SL-ADV-2026-WP-001_V14_9.yar — YARA ruleset (C2 key, MZER, persistence, stager)