---
title: Hunt: ClickFix now leads to domain controllers, reverse SSH tunnels, PNG-hidden executables and browser-cache-seeded payloads (Huntress) | ctxsec
url: https://ctxsec.com/items/hunt-huntress-clickfix-evolving-tradecraft-cache-seeded-stego-lateral-movement-nov-10
description: "Huntress rounds up recent ClickFix incidents that go well past a one-shot infostealer. Lures arrive through Bing ads for typosquatted Westlaw and LinkedIn pages and compromised sites, and pasted PowerShell now shows fake 'verification' progress bars while it downloads payloads. Huntress describes a Node.js RAT posing as an RMM tool (DuskDesk), a chain that sideloaded CertEnroll.dll, ran AD recon, opened a reverse SSH tunnel and moved to the domain controller over WinRM, a stager that rebuilt executables from pixel data in PNG files, and a dental-site lure whose command hunts the browser cache for a 17,635-byte file it planted earlier and runs it as a batch file."
status: "vendor research (Huntress blog, Nov 10, 2026, with IOCs)"
published: 2026-11-10
---

> Huntress rounds up recent ClickFix incidents that go well past a one-shot infostealer. Lures arrive through Bing ads for typosquatted Westlaw and LinkedIn pages and compromised sites, and pasted PowerShell now shows fake 'verification' progress bars while it downloads payloads. Huntress describes a Node.js RAT posing as an RMM tool (DuskDesk), a chain that sideloaded CertEnroll.dll, ran AD recon, opened a reverse SSH tunnel and moved to the domain controller over WinRM, a stager that rebuilt executables from pixel data in PNG files, and a dental-site lure whose command hunts the browser cache for a 17,635-byte file it planted earlier and runs it as a batch file.

[← Threat Hunting](/hunting) · [markdown](/items/hunt-huntress-clickfix-evolving-tradecraft-cache-seeded-stego-lateral-movement-nov-10.md)

vendor research (Huntress blog, Nov 10, 2026, with IOCs)

2026-11-10

### Hunt: ClickFix now leads to domain controllers, reverse SSH tunnels, PNG-hidden executables and browser-cache-seeded payloads (Huntress)

- **Process lineage:** explorer.exe (Run dialog) or a browser spawning cmd.exe, powershell.exe or Windows Terminal; encoded commands and execution-policy bypasses.
- **Files:** ZIPs such as `cf_verify.zip` or `verify_pkg.zip` in %TEMP%, extracted into random hex-named folders under C:\ProgramData (e.g. `f8f33b09aed97a47`, `7168f7f870a45fbb`) with a signed Microsoft binary, a rogue DLL and `1.bat`; `C:\ProgramData\ShService` holding an SSH private key.
- **Persistence:** Run keys and scheduled tasks like `CertEnrollCtrl_*`, `SysyService` or a Run key named `DuskDesk` launching node.exe.
- **Cache-seeded variant:** `cmd /c for /r` loops over browser profile cache folders filtering on file size, then copying to `%TEMP%\t.bat`.
- **Network:** unexpected outbound SSH from workstations; Huntress lists 23.227.199[.]41 and 167.148.201[.]104:3861 among its IOCs.
- Huntress advises hunting the sequence of behavior rather than hashes, since names and payloads change.

Sources: [Huntress: Beyond the clipboard: The evolving tradecraft of ClickFix (Nov 10, 2026)](https://www.huntress.com/blog/the-evolving-tradecraft-of-clickfix)