ClickFix’s Fake CAPTCHAs Hide a New RAT and a Stripe Back Channel

Same fake “verify you are human” box, very different endings. Flare researchers say they followed five live ClickFix campaigns in late August 2026, all asking victims to paste a command into the Windows Run box, and found a previously unreported remote-access trojan, a second RAT that hides its traffic inside Stripe’s payment API, a Czech-language batch RAT, a Telegram dead drop and one server that, for now, only opens Calculator. The new RAT, which Flare calls CrashHandler RAT, is installed after a Google-signed script switches off Microsoft Defender for the entire C: drive.

lijil[.]icu, 45.13.186[.]129, 2.27.200[.]185 (CrashHandler RAT lure and staging)
95.85.238[.]53:56001 (CrashHandler RAT C2)
login[.]microsoftofice[.]cz, kupujto[.]unas[.]cz/hereissomeinterest/ (Czech RAT)
updates[.]howclens[.]com, 34.89.60[.]35 (Stripe-channel RAT)
193.26.115[.]174, t[.]me/+GxJlJOY5yasyNTI0 (Telegram dead drop)

%APPDATA%\Microsoft\Edge\Core\GoogleCrashHandler.exe, .edge_init
%APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe (stripe.exe copy)
%LOCALAPPDATA%\pre.ps1, %TEMP%\e.ps1, AMD_RS_012.173.zip (password oldkf2026)
Outbound POST body containing —OKOKOK— (Czech RAT exfil marker)

Source article: Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads
Publisher: Flare (author: Assaf Morag)
Published: Nov. 12, 2026
URL: https://flare.io/learn/resources/blog/hunting-clickfix-attacks-deep-dive

Executive Summary

Flare’s research team hunted live ClickFix infrastructure over two days at the end of August 2026 and reverse-engineered five unrelated campaigns; none is attributed to a named actor, and Flare reports no vendor aliases. ClickFix is a social engineering technique, used by many crews, in which a fake Cloudflare check, reCAPTCHA or browser error copies a command to the clipboard and instructs the victim to paste it into the Windows Run dialog or a terminal. In the first campaign a DMarket gaming-marketplace clone (2.27.200[.]185) served the command from /api/command after a POST to /captcha with a Russian-language reply; an XOR-obfuscated PowerShell loader (R.ps1) elevated itself, used a legitimate Google LLC-signed exclusion script from lijil[.]icu to exclude the entire C: drive from Microsoft Defender, downloaded a password-protected archive (AMD_RS_012.173.zip, password oldkf2026), stripped Mark-of-the-Web, slept 10 to 15 seconds and silently installed an MSI that drops 32-bit and 64-bit Go loaders with falsified Go versions and timestamps; the 32-bit loader decrypted a .NET payload in memory, copied itself to %APPDATA%\Microsoft\Edge\Core\GoogleCrashHandler.exe with autorun, and connected over raw TLS to 95.85.238[.]53:56001. Flare names this previously undocumented sample CrashHandler RAT (the article’s summary also calls it RATHandler) and treats an AsyncRAT link as an unconfirmed hypothesis. The second campaign used the Czech Microsoft typosquat login[.]microsoftofice[.]cz to deliver a batch-based RAT staged under kupujto[.]unas[.]cz that marks exfiltrated output with the string —OKOKOK—. The third used updates[.]howclens[.]com, impersonating UK kitchen supplier Howdens, to deliver stripe.exe, an unsigned .NET RAT that hides as %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe and uses Stripe customer-record metadata as a two-way command channel. The fourth served an HTA that only launches Calculator from still-live infrastructure, and the fifth read a payload domain from a Telegram channel description that had already expired. Objectives range from remote control to the credential theft that typically follows ClickFix. Hunt leads, false positive expectations and indicators are detailed below; Flare published SHA-256 hashes and behavioral leads but no YARA or Sigma rules.

ATT&CK chain: Resource Development → Initial Access → Execution → Privilege Escalation → Defense Evasion → Persistence → Command and Control → Exfiltration

Hunt Lead Grid

ClickFix Lure and Staging Infrastructure Sweep

Flare’s indicator table ties each host to a campaign. CrashHandler RAT: the fake DMarket verification site at 2.27.200[.]185, staging at lijil[.]icu (resolved to 45.13.186[.]129 during the investigation) serving /script.ps1, /takefile/sez/AMD_RS_012.173.zip and /7za.exe, and C2 at 95.85.238[.]53:56001 (ALINDA-AS, Ukraine, on the Spamhaus DROP list per Flare). Czech batch RAT: login[.]microsoftofice[.]cz for the lure and kupujto[.]unas[.]cz/hereissomeinterest/ and /hereissomeinterest/octopuspush/ for staging and C2. Stripe-channel RAT: updates[.]howclens[.]com for the lure and 34.89.60[.]35 as the stripe.exe staging address. Telegram dead drop: 193.26.115[.]174 (port 5000 per Flare’s notes) and the invite t[.]me/+GxJlJOY5yasyNTI0. The detection logic is a retrospective search of DNS, proxy, firewall and EDR network logs for any of these hosts, paths and ports, plus proxy logs for the paths /captcha followed by /api/command from the same client.

Use DNS resolver logs, secure web gateway or proxy logs with full URLs, firewall and NetFlow, and email gateway logs for the howclens lookalike, which arrived as an update email. Sweep back to at least August 2026. Hosts on shared providers (34.89.60[.]35 sits in a large cloud range) should be matched only as exact IPs, never as ranges. Blocking these is fine, but ClickFix operators rotate domains quickly, so treat the sweep as a way to find victims rather than as protection. Any client that reached a lure page should be checked with the Run-dialog lead; any client that reached a staging or C2 host should be isolated and triaged as infected.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1583.001 (Acquire Infrastructure: Domains); Command and Control → T1105 (Ingress Tool Transfer), T1571 (Non-Standard Port)

Sources: “Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads”, Flare, Nov. 12, 2026, https://flare.io/learn/resources/blog/hunting-clickfix-attacks-deep-dive (source article)

Masquerading Implant Paths Under AppData

CrashHandler RAT’s 32-bit loader, delivered as MicrosoftEdge.exe, writes an identical copy of itself to %APPDATA%\Microsoft\Edge\Core\GoogleCrashHandler.exe with a marker file .edge_init beside it, and the sandbox recorded autorun registry changes and launches from a registry key. stripe.exe copies itself to %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe, borrowing the Defender engine’s name inside a fake WinSxS folder. The PowerShell loader leaves %LOCALAPPDATA%\pre.ps1 (the exclusion script), %TEMP%\e.ps1 when it relaunches elevated, and a randomly named folder under %LOCALAPPDATA% that briefly holds AMD_RS_012.173.zip and 7za.exe. The detection logic is a file and autorun sweep for those exact paths, for any executable named MsMpEng.exe outside the Defender platform folder, any GoogleCrashHandler.exe outside the Google Update folder, and any HKCU or HKLM Run value pointing into %APPDATA%\Microsoft\Edge\Core or %APPDATA%\Microsoft\Windows\WinSxS.

Use EDR file-creation and registry telemetry, Sysmon events 11 and 13, and autoruns-style inventory collected across workstations. Sweep the full retention window, since autorun persistence survives reboots. The real MsMpEng.exe and GoogleCrashHandler.exe are signed binaries in fixed locations, so allowlist by signer and full path rather than by name, and never hash-block the names, which would break Defender and Google software. Note that the 32-bit loader runs at medium integrity under explorer.exe, so per-user locations matter more than system ones. Any hit is a confirmed infection: isolate the host and reset the user’s credentials and browser sessions from a clean device.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1036.005 (Masquerading: Match Legitimate Resource Name or Location); Persistence → T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)

Sources: Flare (above), source article

Run-Dialog Paste to Script Execution

Every case ended the same way: the victim pressed Win+R (or opened cmd), pasted a clipboard command and pressed Enter. In the calculator case the visible part of the pasted text was reassuring prose while the command itself sat out of view; in the Telegram case the PowerShell reversed a string at runtime to hide its URL, requested a hidden window and bypassed execution policy; in the CrashHandler case the command fetched an obfuscated loader that prompted for elevation twice; and one case ran an HTA through mshta.exe. The detection logic is to alert when explorer.exe (the parent for commands typed into Run) or a browser directly spawns powershell.exe, pwsh.exe, cmd.exe, mshta.exe or curl.exe with any of: a URL, -w hidden or -WindowStyle Hidden, -ep bypass, -enc, Invoke-Expression or iex, string reversal, or an unusually long command line; and to collect the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU) to see exactly what users pasted.

Use EDR process-creation telemetry with full command lines (Sysmon event 1 or Security 4688), PowerShell script block logging (event 4104) to see the deobfuscated loader, and registry collection for RunMRU. Sweep 30 to 90 days across all user workstations. IT staff do launch PowerShell from Run, so scope out admin accounts or require a second signal such as a network download in the same command; Flare’s own advice is to disable the Run dialog for standard users and restrict mshta.exe and monitor curl.exe for non-technical users. Blocking individual lure domains is the wrong primary control because the lure changes weekly while this process pattern does not. A match should be triaged immediately by decoding the command and following its downloads; this lead generalizes to every ClickFix campaign regardless of payload.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.004 (User Execution: Malicious Copy and Paste), T1059.001 (Command and Scripting Interpreter: PowerShell); Defense Evasion → T1218.005 (System Binary Proxy Execution: Mshta), T1027.010 (Obfuscated Files or Information: Command Obfuscation)

Sources: Flare (above), source article

Whole-Drive Defender Exclusion by a Script

In the CrashHandler chain the loader downloads hxxps://lijil[.]icu/script.ps1 to %LOCALAPPDATA%\pre.ps1 and runs it with “C:\” as its argument. The script is not malware: it is a legitimate utility signed by Google LLC (DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, serial 0B50CF246B263EFD85A729315158F3FF) whose purpose is to add folders to Defender’s exclusion list, and the attacker uses it to exclude the whole system drive. The loader then runs Unblock-File on the downloaded archive, extracts it with a dropped 7za.exe and installs the MSI with msiexec /i “<path>” /qn /norestart, elevated and hidden, before deleting the archive and 7za.exe. The detection logic is to alert on Microsoft Defender configuration change event 5007 (and EDR registry events under HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths) that add an exclusion when the writing process is PowerShell or another interactive process rather than your management agent, with a critical rating for any exclusion equal to a drive root; and to correlate it with an msiexec /qn install from a randomly named folder under %LOCALAPPDATA% in the following minutes.

Use Defender operational logs (event 5007), EDR registry and process telemetry, and MSI installer events (Application log 1033 and 11707). Sweep 90 days. Exclusions pushed by Intune, Group Policy or your EDR console appear with the management service as the writer, so allowlist by the writing process and by the expected exclusion list rather than by user. Blocking or distrusting the Google signing certificate would be the wrong response, since it signs legitimate Google software; the anchor is who added the exclusion and how broad it is. Any whole-drive exclusion outside change control should be reverted and the host treated as compromised, and Flare notes this is the single check that would have caught case one.

Hunt Lead Level: 2 (Pro)

ATT&CK: Defense Evasion → T1685 (Disable or Modify Tools), T1218.007 (System Binary Proxy Execution: Msiexec), T1553.005 (Subvert Trust Controls: Mark-of-the-Web Bypass), T1497.003 (Virtualization/Sandbox Evasion: Time Based Checks)

Sources: Flare (above), source article

Legitimate Web Services as C2: Stripe and Telegram

After infection, stripe.exe creates a Stripe customer object holding a unique victim ID and basic system details, then polls that record’s metadata; the operator writes commands into a pending_cmd field, the implant returns encoded output in another field, splits screenshots and files across several customer objects tied together by total_objects, obj_ids and xfer_id, and updates last_seen as a heartbeat, all over valid TLS to api.stripe.com. The Telegram case fetches a channel page, reads two values from its description, treats the first as a domain and pipes https://<domain>/download/install into Invoke-Expression. Separately, the Czech batch RAT marks exfiltrated command output with —OKOKOK— in outbound POST bodies, which Flare calls the best single network indicator in the set. The detection logic is to inventory which hosts and processes legitimately talk to api.stripe.com and Telegram, alert on any workstation without a billing or payments role (or any unsigned process from a user-writable path) that connects to api.stripe.com, alert on non-browser processes fetching t.me pages followed by a download to a new domain, and inspect decrypted or plaintext POST bodies for the OKOKOK marker.

This needs EDR process-to-network attribution, TLS-inspecting proxy logs where policy allows (SNI alone shows only api.stripe.com), and an asset inventory that marks finance and e-commerce systems, joined over windows of a day or more and baselined for two to four weeks. Do not block api.stripe.com or Telegram outright: payment systems and staff rely on them, and Flare explicitly says api.stripe.com is not a malicious domain. The anchor is the process making the call (stripe.exe or a fake MsMpEng.exe from %APPDATA%) and the host’s role. A match should be escalated to incident response; if your organisation uses Stripe, also review the account’s API keys, since the implant needs a key to create customer records. The pattern generalizes to any malware that uses a SaaS API as a dead drop.

Hunt Lead Level: 3 (Elite)

ATT&CK: Command and Control → T1102.002 (Web Service: Bidirectional Communication), T1102.001 (Web Service: Dead Drop Resolver); Exfiltration → T1041 (Exfiltration Over C2 Channel)

Sources: Flare (above), source article

Hash Appendix

CrashHandler RAT chain (case one)

SHA-256 values come from the source article; Flare did not publish MD5 or SHA1 values, and OTX AlienVault and VirusTotal were not queried for this report. GoogleCrashHandler.exe has the same hash as MicrosoftEdge.exe. The Google-signed exclusion script is a legitimate utility and Flare published no hash for it; do not block the Google certificate.

MD5s

(not available)  # MicrosoftEdge.exe -> 32-bit Go loader, copied to %APPDATA%\Microsoft\Edge\Core\GoogleCrashHandler.exe
(not available)  # ElevationChrome.exe -> 64-bit Go loader
(not available)  # Windows_Repair.zip -> payload archive
(not available)  # RuntimeBroker.exe -> packed as delivered
(not available)  # Microsoft Aggregator SubHost.exe -> packed as delivered
(not available)  # .edge_init -> marker file beside GoogleCrashHandler.exe

SHA1s

(not available)  # MicrosoftEdge.exe -> 32-bit Go loader, copied to %APPDATA%\Microsoft\Edge\Core\GoogleCrashHandler.exe
(not available)  # ElevationChrome.exe -> 64-bit Go loader
(not available)  # Windows_Repair.zip -> payload archive
(not available)  # RuntimeBroker.exe -> packed as delivered
(not available)  # Microsoft Aggregator SubHost.exe -> packed as delivered
(not available)  # .edge_init -> marker file beside GoogleCrashHandler.exe

SHA256s

be8be8a567070e4bba1de3e685e588ef65ff0bf796f8720769b6c70eaba99855  # MicrosoftEdge.exe -> 32-bit Go loader, copied to %APPDATA%\Microsoft\Edge\Core\GoogleCrashHandler.exe
5efa21cf88471bc55dce800674fb1105de6a4c01d23a947934f97cd0de226135  # ElevationChrome.exe -> 64-bit Go loader
bcd389ba3926c573a8002c2cc8cc8d07a38c346928d7322f5e080b5c2c447bee  # Windows_Repair.zip -> payload archive
89faee1d3450c2e373f5f8ccd4736650fa23495c2fdaff0ec94654516fb04fcd  # RuntimeBroker.exe -> packed as delivered
ebb9192b3bcf2a921b3be719f82fb669157ea1929f74334208d4c0b5294941f9  # Microsoft Aggregator SubHost.exe -> packed as delivered
ab81755c362ff86d90b9e3529ab7bb527c7fdce7a29cedf57c53ae0102747cac  # .edge_init -> marker file beside GoogleCrashHandler.exe

Stripe-channel RAT (case three)

SHA-256 values come from the source article; MD5 and SHA1 were not published and OTX AlienVault and VirusTotal were not queried.

MD5s

(not available)  # stripe.exe -> .NET RAT, copied to %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe
(not available)  # stripe.dll -> internal assembly inside stripe.exe

SHA1s

(not available)  # stripe.exe -> .NET RAT, copied to %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe
(not available)  # stripe.dll -> internal assembly inside stripe.exe

SHA256s

ed7c64b489f4a79c7be217ae6bed6f2f4aa5f03dc74e20c546f5caa9c680bfdf  # stripe.exe -> .NET RAT, copied to %APPDATA%\Microsoft\Windows\WinSxS\MsMpEng.exe
a1d4e4a7ada48e1980f06c1f4d58ab16a3edf30eeb8f92a5381680c790c8f381  # stripe.dll -> internal assembly inside stripe.exe

Calculator HTA (case four)

SHA-256 from the source article; MD5 and SHA1 not published, OTX and VirusTotal not queried. The current payload only launches calc.exe, but Flare notes the infrastructure is live and could change.

MD5s / SHA1s: (not available) # recaptcha-verify.hta

SHA256s

4f2678fa0f90074ae304f8fdb9174d0c577f1a0587af44a4e8e756a547e5c2e4  # recaptcha-verify.hta -> HTA launching calc.exe via mshta

References Appendix

• “Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads”, Flare (Assaf Morag), Nov. 12, 2026, https://flare.io/learn/resources/blog/hunting-clickfix-attacks-deep-dive (source article; five case studies, Appendix 1 CrashHandler RAT analysis, Appendix 2 indicators, hashes and behavioral leads)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/