Hackers Use ClickFix Prompt to Install MSI Package and Launch Hands-On-Keyboard Attack

A single deceptive prompt. That is all it took for attackers to gain a foothold inside an organization, spread to over 11 systems, and deploy two separate remote access tools before anyone noticed.

A new campaign using the ClickFix technique has shown how far one unguarded moment can go. ClickFix is a social engineering trick that presents users with a fake troubleshooting instruction on a compromised website.

The prompt tells the user to press Win+R, paste a command into the Windows Run dialog, and hit Enter. It looks like a legitimate fix, and that is the point. People follow clear, authoritative directions, and attackers count on exactly that.

Researchers at Huntress identified this ClickFix attack in May 2026, tracing it from a single unmonitored endpoint through a full hands-on-keyboard intrusion across the victim’s network.

The attacker had already been active for some time before anyone could see what was happening, because the machine where it started had no endpoint agent installed.

The infection began when a user visited a compromised website and ran a command that used pcalua.exe, a legitimate Windows utility, to silently fetch and run a remote script.

That script downloaded and installed an MSI package in the background with no visible indication to the user.

The MSI dropped a custom loader the researchers named Potemkin, which connected to a command-and-control server and loaded a fully featured remote access tool called RMMProject entirely in memory.

Separately, the attacker deployed EtherRAT, a Node.js backdoor that retrieves its server address from the Ethereum blockchain, making it hard to disrupt through traditional domain takedowns. 

Huntress said in a report shared with Cyber Security News (CSN) that the intrusion escalated quickly, with the operator moving across the network using WMIExec and SMBExec, fighting through Windows Defender, and eventually killing the antivirus service before EtherRAT reached over 11 hosts.

Hackers Use ClickFix Prompt

The attack started with a ClickFix command that abused pcalua.exe to proxy mshta.exe, fetching a remote HTA file from cl.distritovagas[.]com.

That HTA payload silently downloaded the MSI installer, inst24.msi, from an attacker-controlled server and executed it without any prompt.

The MSI deployed Potemkin into the user’s AppData folder and registered a startup registry key so it would survive every reboot.

Potemkin is a lean, purpose-built loader with a Domain Generation Algorithm that produces 10,000 candidate domains from a built-in word list and probes each one until it finds a live server.

Once connected, its only job is to fetch and reflectively load RMMProject, a 4.4 MB DLL with 15 task types covering browser credential theft, cookie stealing across Chrome, Firefox, and Edge, a hidden remote desktop module, and process injection.

Five hours later, the attacker dropped EtherRAT and set up a Cloudflare tunnel using a renamed copy of cloudflared, securing persistent internet-reachable access inside the network.

Hands-On Intrusion and Defender Evasion

Once inside, a human operator took direct control and began working through the network manually.

They used compromised Administrator credentials, ran reconnaissance consistent with the Impacket toolkit, and moved laterally to the domain controller via WMIExec and SMBExec.

The goal was to spread EtherRAT across as many hosts as possible while establishing multiple fallback paths.

The attacker worked hard to silence Windows Defender throughout the session. They cycled through AMSI patches, registry policy writes, reflective in-memory loading, and exclusion path abuse before stopping the Defender service outright.

A reverse shell on port 43301 and multiple Chisel SOCKS tunnels gave them layered persistence that could survive individual detections.

Huntress recommended that organizations immediately audit endpoint coverage, since the whole intrusion started on a machine with no monitoring agent.

Disabling the Windows Run dialog through Group Policy removes the ClickFix entry point, as the attack depends on the user pasting a command into that dialog.

Teams should alert on cloudflared or renamed copies on endpoints, and treat Stop-Service WinDefend alongside bulk Add-MpPreference exclusion commands as high-confidence threat signals.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.