Threat Summary
Arctic Wolf has observed a ClickFix-style intrusion pattern in which a user-executed PowerShell command downloads and runs remote content directly in memory. In the observed activity, first identified on July 14 at 18:37:13 UTC, the command used runtime string substitution to indirectly construct irm (Invoke-RestMethod) and then passed the response to iex, allowing the retrieved content to execute without being written to disk first. This is a simple but effective defense evasion technique because it avoids more recognizable download syntax that defenders often key on.
The observed command retrieved staged content from attacker-controlled infrastructure hosted on a malicious domain (refer to the Indicators of Compromise section). Additional analysis identified related staged content and a follow-on payload download workflow for a Windows executable named RutimaConsole.exe (8faec93f8a26ed271f4a55571d1e9caf215408818d77bc8ff5e9dbf9678499c5). The decoded stage also attempted to send execution status or error messages to a separate external endpoint, suggesting a basic command-and-control or execution tracking mechanism.
While this activity builds on familiar ClickFix tradecraft rather than introducing a new delivery method, the updated loader syntax may bypass existing detections focused on direct invocations such as Invoke-RestMethod, DownloadString, or other obvious PowerShell download patterns. The primary risk remains social engineering: users are convinced to paste or run malicious commands from fake verification prompts, browser content, or similar lures.
Any organization with Windows endpoints where users can launch PowerShell from the Run dialog, Command Prompt, browser-assisted prompts, or copied clipboard commands may be exposed to this threat. Environments without strong restrictions on PowerShell, script execution, child process monitoring, and outbound traffic to newly observed domains may face elevated risk.
Recommendations
Please follow your organization’s change management, testing, and security operations procedures when implementing the recommendations below.
Reinforce User Awareness Around ClickFix-style Lures
- Educate users that legitimate websites, CAPTCHA pages, application prompts, and account verification flows should never require them to copy and paste commands into Windows Run, PowerShell, Command Prompt, or File Explorer. Encourage users to report any page or prompt that asks them to run a command locally.
Restrict and Harden PowerShell Usage
- Where feasible, reduce unnecessary PowerShell access and apply hardening controls such as constrained language mode, execution policy enforcement, script block logging, and centralized command-line monitoring. Consider restricting PowerShell execution for users or systems that do not require it for business operations.
Indicators of Compromise (IOCs)
| Type | Indicator | Notes |
|---|---|---|
| Domain | ghliczx[.]com | Malicious domain associated with staged ClickFix content |
| URL | hxxp://ghliczx[.]com/2[.]txt | Staged content |
| URL | hxxp://ghliczx[.]com/1[.]txt | Staged content |
| URL | hxxps://ghliczx[.]com/RutimaConsole.exe | Follow-on payload download URL |
| IP Address | 147[.]45[.]221[.]17 | Observed beacon endpoint |
| SHA-256 | 8faec93f8a26ed271f4a55571d1e9caf215408818d77bc8ff5e9dbf9678499c5 | Hash for RutimaConsole.exe |
References:
- https://www.fortinet.com/blog/threat-research/clickfix-to-command-a-full-powershell-attack-chain – Related reporting describes similar ClickFix tradecraft; the activity covered in this security bulletin is a slight variation that uses identifier obfuscation.
