ClickFix campaigns are once again turning an ordinary user action into the opening move of a serious intrusion.
A newly documented chain uses a fake fix prompt to lead victims toward CNCMachineRMS, a previously undocumented remote access trojan that gives an attacker lasting control of a Windows device.
The campaign stands out because it hides behind software that is both legitimate and signed.
After the ClickFix lure, attackers launch IBM SPSS WinWrap Basic IDE and steer its scripting function toward malicious files, allowing the activity to blend in with trusted software rather than an obviously hostile program.
LevelBlue said in a report shared with Cyber Security News (CSN) that the chain also uses four decoy DLLs and a normal Windows date-formatting feature to start its shellcode.
That combination makes the early stages harder to spot and delays the moment when the final payload becomes visible.
The final result is not a simple downloader. CNCMachineRMS can give an operator a command shell, file browsing, screenshots, new local accounts, persistence, and the ability to bring in more tools.
A detection should therefore be treated as possible hands-on access, not merely as a single malware alert.
ClickFix Attack Abuses Signed IBM SPSS IDE
The infection begins with a ClickFix lure, a tactic that persuades someone to run a command presented as a routine solution.
Similar campaigns have used a fake prompt to install an MSI package, showing how one pasted command can quickly develop into a wider compromise.
Hackers use ClickFix prompts provides a useful example of that familiar social-engineering path.
In this case, WinWrapIDE.exe is clean and legitimately signed. The attackers exploit its ability to activate a scripting engine through COM, directing it to a dropped DLL.
The decoy DLLs then load through normal import handling, avoiding the unusual application calls that many security products watch most closely.
The last decoy fills a buffer with random data, places shellcode inside it, and makes the memory executable.
It passes the shellcode through EnumTimeFormatsEx, a harmless Windows date-formatting interface, so Windows itself calls the code.
This technique resembles the wider move toward native tools seen when ClickFix chains avoid PowerShell, reducing obvious warning signs.
.webp)
The BabaDeda shellcode does little by itself. It needs a separate configuration file, HelperStandardizationApplication.bin, which contains an obscured configuration tree, a script, and the embedded 1.14 MB CNCMachineRMS payload.
That dependency can make a partial sample look harmless during quick automated analysis.
RAT Capabilities Raise Incident Stakes
CNCMachineRMS is designed for flexible remote administration rather than one fixed theft task.
Its built-in functions include an interactive shell, file manager, screen capture, local account backdoor, seven persistence methods, and 20 typed commands for retrieving and running further payloads.
That breadth lets an operator adapt after reaching a host. On first contact, the RAT takes a screenshot and gathers details including the domain, SID, privilege status, motherboard and BIOS serials, and installed antivirus products.
It then beacons every 600 seconds. Its custom scripting language also lets the attacker change behavior without rebuilding the implant.
.webp)
One script can re-establish registry persistence every 150 seconds, while local state and command traffic use the same custom container.
The state file is padded with random data and changes regularly, which means hash-only hunting may miss it.
The pattern echoes other RATs where persistence supports silent access through registry entries and scheduled tasks.
Defenders should investigate an affected machine as a potential second-stage incident.
Hunt for the listed network and host traces, review creation of local accounts and privileged-group changes, and check scheduled tasks or Run keys masquerading as IBM SPSS WinWrap Basic IDE.
Monitoring outbound traffic, including DNS-over-HTTPS use, can help expose activity that bypasses internal DNS logs.
Teams should isolate suspect hosts, preserve volatile evidence, reset exposed credentials, and search neighboring systems before removing files, because follow-on payloads can carry the real damage. Containment must come before routine cleanup or reimaging.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| Domain | notepadreleased[.]com |
CNCMachineRMS command-and-control host over TCP/443 |
| IP address | 85[.]158[.]110[.]78 |
CNCMachineRMS command-and-control host over TCP/443 |
| Domain | dns.google |
DNS-over-HTTPS resolver used by the malware |
| Domain | cloudflare-dns[.]com |
DNS-over-HTTPS resolver used by the malware |
| Domain | dns.quad9[.]net |
DNS-over-HTTPS resolver used by the malware |
| File path | %TEMP%\CNCMachineRMS\tasks\*\task_payload.bin |
Staged task payload location |
| File path | %LOCALAPPDATA%\SProject\sp.bin |
Random-sized local state database |
| Registry Run key or scheduled task | IBM SPSS WinWrap Basic IDE |
Persistence name used by the malware |
| Directory | C:\Intel |
Empty directory that disables the virtual-machine check |
| Windows event IDs | 4720, 4732 |
Potential evidence of local account creation and privileged-group changes |
| Scheduled-task command | /SC ONLOGON /RU SYSTEM /F /RL HIGHEST |
Task creation parameters associated with persistence |
| SHA-256 | 0562c588997fa9961d55c6ab1db2656344324bca8db9ea7b64fe309132b2399f |
WinWrapIDE.exe, signed IBM SPSS IDE binary abused in the chain |
| SHA-256 | 5b71b49bad415643ff3e291ee3ba550e5edfd584eb913859dadb81634450e7e7 |
wwide9.dll |
| SHA-256 | 3d4e7187f74de912f9d52f5ba6a95bd41868348b16583d72957d732c0ed8f0e7 |
ClLoca.dll |
| SHA-256 | b804b9dd2726e69fb4f496a6872f90edf9146ad8044c6d3a592040ce1074a5d0 |
Xceed.Wpf.DataGrid.dll |
| SHA-256 | 3466c3524f13cb3b7c87819e619bdb482ec9034a57bcdbe0240af6a9a530b02a |
ComPDFKit.Viewer.dll |
| SHA-256 | 3b9b86feb3b789dda9cdfe5425ccb7e1feae9fde2cc158ff962991218a98f53f |
model.dat |
| SHA-256 | 2922837a8d049bf0b51f0f9b27340a377b27dd1912675e2cd82056db83ec7a19 |
HelperStandardizationApplication.bin |
| SHA-256 | 744b8165b6161cbd1d5ecc423ecfdb8306485afdc80262000ab3c6908881ef9e |
BabaDeda stage extracted from model.dat, memory-only |
| SHA-256 | bb81786286be437b3ec6d562055767097c9277054e1d09172caa96376451481c |
CNCMachineRMS payload, memory-only |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.