ClickFix campaigns are once again turning an ordinary user action into the opening move of a serious intrusion.
A newly documented chain uses a fake fix prompt to lead victims toward CNCMachineRMS, a previously undocumented remote access trojan that gives an attacker lasting control of a Windows device.
The campaign stands out because it hides behind software that is both legitimate and signed.
After the ClickFix lure, attackers launch IBM SPSS WinWrap Basic IDE and steer its scripting function toward malicious files, allowing the activity to blend in with trusted software rather than an obviously hostile program.
LevelBlue said in a report shared with Cyber Security News (CSN) that the chain also uses four decoy DLLs and a normal Windows date-formatting feature to start its shellcode.
That combination makes the early stages harder to spot and delays the moment when the final payload becomes visible.
The final result is not a simple downloader. CNCMachineRMS can give an operator a command shell, file browsing, screenshots, new local accounts, persistence, and the ability to bring in more tools.
A detection should therefore be treated as possible hands-on access, not merely as a single malware alert.
ClickFix Attack Abuses Signed IBM SPSS IDE
The infection begins with a ClickFix lure, a tactic that persuades someone to run a command presented as a routine solution.
Similar campaigns have used a fake prompt to install an MSI package, showing how one pasted command can quickly develop into a wider compromise.
The loader attack chain from the ClickFix lure to the final implant (Source – LevelBlue)
Hackers use ClickFix prompts provides a useful example of that familiar social-engineering path.
In this case, WinWrapIDE.exe is clean and legitimately signed. The attackers exploit its ability to activate a scripting engine through COM, directing it to a dropped DLL.
The decoy DLLs then load through normal import handling, avoiding the unusual application calls that many security products watch most closely.
The last decoy fills a buffer with random data, places shellcode inside it, and makes the memory executable.
It passes the shellcode through EnumTimeFormatsEx, a harmless Windows date-formatting interface, so Windows itself calls the code.
This technique resembles the wider move toward native tools seen when ClickFix chains avoid PowerShell, reducing obvious warning signs.
Part 2 loader attack chain from the ClickFix lure to the final implant (Source – LevelBlue)
The BabaDeda shellcode does little by itself. It needs a separate configuration file, HelperStandardizationApplication.bin, which contains an obscured configuration tree, a script, and the embedded 1.14 MB CNCMachineRMS payload.
That dependency can make a partial sample look harmless during quick automated analysis.
RAT Capabilities Raise Incident Stakes
CNCMachineRMS is designed for flexible remote administration rather than one fixed theft task.
Its built-in functions include an interactive shell, file manager, screen capture, local account backdoor, seven persistence methods, and 20 typed commands for retrieving and running further payloads.
That breadth lets an operator adapt after reaching a host. On first contact, the RAT takes a screenshot and gathers details including the domain, SID, privilege status, motherboard and BIOS serials, and installed antivirus products.
It then beacons every 600 seconds. Its custom scripting language also lets the attacker change behavior without rebuilding the implant.
Part 3 loader attack chain from the ClickFix lure to the final implant (Source – LevelBlue)
One script can re-establish registry persistence every 150 seconds, while local state and command traffic use the same custom container.
The state file is padded with random data and changes regularly, which means hash-only hunting may miss it.
The pattern echoes other RATs where persistence supports silent access through registry entries and scheduled tasks.
Defenders should investigate an affected machine as a potential second-stage incident.
Hunt for the listed network and host traces, review creation of local accounts and privileged-group changes, and check scheduled tasks or Run keys masquerading as IBM SPSS WinWrap Basic IDE.
Monitoring outbound traffic, including DNS-over-HTTPS use, can help expose activity that bypasses internal DNS logs.
Teams should isolate suspect hosts, preserve volatile evidence, reset exposed credentials, and search neighboring systems before removing files, because follow-on payloads can carry the real damage. Containment must come before routine cleanup or reimaging.
Indicators of compromise (IoCs):-
TypeIndicatorDescriptionDomainnotepadreleased[.]comCNCMachineRMS command-and-control host over TCP/443IP address85[.]158[.]110[.]78CNCMachineRMS command-and-control host over TCP/443Domaindns.googleDNS-over-HTTPS resolver used by the malwareDomaincloudflare-dns[.]comDNS-over-HTTPS resolver used by the malwareDomaindns.quad9[.]netDNS-over-HTTPS resolver used by the malwareFile path%TEMP%\CNCMachineRMS\tasks\*\task_payload.binStaged task payload locationFile path%LOCALAPPDATA%\SProject\sp.binRandom-sized local state databaseRegistry Run key or scheduled taskIBM SPSS WinWrap Basic IDEPersistence name used by the malwareDirectoryC:\IntelEmpty directory that disables the virtual-machine checkWindows event IDs4720, 4732Potential evidence of local account creation and privileged-group changesScheduled-task command/SC ONLOGON /RU SYSTEM /F /RL HIGHESTTask creation parameters associated with persistenceSHA-2560562c588997fa9961d55c6ab1db2656344324bca8db9ea7b64fe309132b2399fWinWrapIDE.exe, signed IBM SPSS IDE binary abused in the chainSHA-2565b71b49bad415643ff3e291ee3ba550e5edfd584eb913859dadb81634450e7e7wwide9.dllSHA-2563d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7ClLoca.dllSHA-256b804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0Xceed.Wpf.DataGrid.dllSHA-2563466c3524f13cb3b7c87819e619bdb482ec9034a57bcdbe0240af6a9a530b02aComPDFKit.Viewer.dllSHA-2563b9b86feb3b789dda9cdfe5425ccb7e1feae9fde2cc158ff962991218a98f53fmodel.datSHA-2562922837a8d049bf0b51f0f9b27340a377b27dd1912675e2cd82056db83ec7a19HelperStandardizationApplication.binSHA-256744b8165b6161cbd1d5ecc423ecfdb8306485afdc80262000ab3c6908881ef9eBabaDeda stage extracted from model.dat, memory-onlySHA-256bb81786286be437b3ec6d562055767097c9277054e1d09172caa96376451481cCNCMachineRMS payload, memory-only
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
The post ClickFix Attack Abuses Signed IBM SPSS IDE to Deploy New CNCMachineRMS RAT appeared first on Cyber Security News.
