Executive summary

ClickFix social engineering attacks are a recurring threat across DefenseStorm’s monitored client base. The typical pattern is well-documented: a user is tricked into pasting a command, a known payload executes, and existing detections catch it. On April 27, 2026, DefenseStorm CTS Ops identified a ClickFix attack that broke from this pattern. The investigation, conducted in the wild and continued in a controlled lab environment, uncovered novel artifacts we had not previously observed or found via OSINT.

The attack directed a user to copy and paste a PowerShell command into the Windows Run dialog to “fix” a fabricated issue. The command downloaded a ZIP archive from Dropbox containing a portable WinPython distribution and two heavily obfuscated Python scripts: collector.py and Pmanager.py. Bundling a full Python runtime ensured the payload could execute on any Windows machine without a prior Python installation.

collector.py runs first. It collects the username, hostname, privilege level, domain membership, Active Directory computer count, running processes, active TCP connections, ARP table, and MAC address. It writes everything to C:\Windows\Temp\configA.json, disguised as a configuration file.

Thirty seconds later, Pmanager.py launches. This file handles data exfiltration and two-way C2 communication with a rotating pool of remote IPs over HTTP POST. It writes to the Run registry key, creates scheduled tasks running as SYSTEM, and abuses rundll32.exe as a living-off-the-land binary.

Both files returned zero detections on VirusTotal at the time of analysis. Three of the five C2 IP addresses fall in the 64.95.0.0/16 block, the same range as confirmed KongTuke C2 infrastructure documented in January 2026 ClickFix campaigns. This overlap, combined with the delivery mechanism and Python-based implant architecture, points to an evolution of the ModeloRAT/KongTuke activity tracked by Huntress, Microsoft, and malware-traffic-analysis.net earlier this year.

At a glance

Indicators of compromise

Network indicators

None of these IPs were flagged as malicious on VirusTotal at time of analysis (April 27, 2026, 9:58 PM EDT).

File system artifacts

File hashes (SHA-256)

Initial infection vector

The infection starts with a PowerShell one-liner encoded as a decimal ASCII array and executed through iex (Invoke-Expression). The user was directed to paste this into the Windows Run dialog as part of the ClickFix social engineering lure.

The encoded command decodes to:

Execution sequence

Stage 1: collector.py (host enumeration)

VirusTotal results

Zero detections at time of analysis. The sample is either novel or sufficiently obfuscated to evade signature-based engines.

Obfuscation

The file is heavily obfuscated. All function and variable names have been replaced with long random strings, consistent with common Python obfuscation tools.

Deobfuscated behavior

After deobfuscation, collector.py is a host enumeration module that fingerprints the victim machine. It collects:

All collected data is aggregated into a dictionary and serialized to C:\Windows\Temp\configA.json, disguised as a benign configuration file.

Stage 2: Pmanager.py (C2 and persistence)

VirusTotal results

Zero detections at time of analysis.

Imports

Pmanager.py is approximately 750 lines of code. Its import list tells us what it does before we read a line of logic:

The combination of ssl, urllib.request, asyncio, zlib, and base64 points to encrypted asynchronous C2 communications with compressed or encoded payloads.

C2 infrastructure

A hardcoded dictionary of IP addresses is embedded in the script. These are the C2 server pool.

C2 communication uses HTTP POST requests. Endpoints are constructed at runtime by randomly selecting from a pool of hardcoded path strings. The randomized URLs are designed to evade pattern-based network detection:

The C2 channel is bidirectional. Evidence of command retrieval was observed: the implant sends host data and receives tasking in return via a JSON response.

Persistence mechanisms

Three persistence mechanisms were identified.

1. Run registry key

The malware writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run, pointing to the malicious pythonw.exe and Pmanager.py. This ensures execution on every user login.

2. Scheduled tasks

schtasks is invoked approximately five times with varying arguments. Observed parameters include /sc daily /st 00:00 /ru SYSTEM /f, which creates a daily execution trigger running as SYSTEM. A secondary schtasks /run /tn call forces immediate execution of the newly created task.

3. RunDll32.exe abuse

rundll32.exe is spawned by the malware. This is a known living-off-the-land binary (LOLBin) technique for executing shellcode or loading additional payloads under a trusted Windows process.

Threat actor attribution: KongTuke

The C2 infrastructure in this sample overlaps with known KongTuke campaign activity from early 2026. KongTuke is a threat actor tracked across multiple ClickFix and CrashFix campaigns that deliver Python-based implants (including ModeloRAT) through social engineering lures. The connection is based on IP address block overlap, not exact IOC matches, which is consistent with KongTuke rotating C2 infrastructure between campaigns.

C2 IPs vs. known KongTuke IOCs

Known KongTuke C2 IPs (public reporting)

Recommendations

How to detect it

Signature-based tools missed this variant entirely. The detection strategies below target the behaviors and artifacts observed during analysis, not the specific hashes or IPs. They will catch this implant and similar tooling that follows the same execution pattern.

Network detection

Endpoint detection

Persistence detection