MIMICRAT Remote Control Delivered Through Trusted Platforms

Summary

The ClickFix campaign represents a sophisticated shift in cyber-attack methodologies, turning legitimate, trusted websites into silent launchpads for advanced malware delivery. First seen in February 2026, this operation targets the Higher Education and Financial Services sectors globally, specifically focusing on the Windows platform. The attack culminates in the deployment of MIMICRAT (also known as AstarionRAT), a highly evasive Remote Access Trojan (RAT) that conceals its command-and-control (C2) traffic within normal web analytics data to bypass traditional security monitoring.

Attack Details: Multi-Stage Infection Chain and Defense Evasion

The infection begins not with attacker-controlled servers, but by compromising legitimate sites, such as a Bank Identification Number (BIN) validation service and an Indian mutual fund investment platform. These sites are injected with malicious JavaScript that mimics a Cloudflare verification page, tricking users into executing a PowerShell command directly from their clipboard — a technique that bypasses browser security controls as no file is technically downloaded.

The attack follows a rigorous five-stage chain:

1. Obfuscated PowerShell — Rebuilds its C2 domain during execution to leave no readable traces.
2. Defense Neutralization — Disables security defenses by forcing the Antimalware Scan Interface (AMSI) to fail and patching in-memory functions to avoid Event Tracing for Windows (ETW) monitoring.
3. Lua Loader — Extracts a hidden Base64 archive and launches a custom Lua-based loader with a built-in interpreter.
4. Reflective Loading — A shellcode reflective loader deploys the final MIMICRAT payload.
5. Post-Exploitation — MIMICRAT provides 22 commands, including token theft, SOCKS5 proxy tunneling, and interactive shell access. The infrastructure uses Amazon CloudFront as a relay to mask malicious traffic as standard HTTPS activity.

Recommendations: Strategic Defenses and Detection Patterns

• Detect Obfuscated PowerShell — Configure EDR solutions to flag PowerShell execution involving minimized windows, string-slicing, or arithmetic-based string reconstruction.
• Monitor for Tampering — Alert on attempts to patch EventProvider fields or set amsiInitFailed to true, as these are high-fidelity indicators of advanced malware.
• Restrict Execution Environments — Enforce PowerShell Constrained Language Mode and limit execution to signed scripts from trusted publishers.
• Hunt for CloudFront C2 — Monitor for anomalous outbound HTTPS traffic to CloudFront URIs such as /intake/organizations/events or /discover/pcversion/metrics.
• Web Integrity Monitoring — Implement Web Application Firewalls (WAF) and integrity monitoring to detect unauthorized JavaScript injections on their own properties.

MITRE ATT&CK TTPs

Indicators of Compromise (IOCs)

SHA256 Hashes:

• bcc7a0e53ebc62c77b7b6e3585166bfd7164f65a8115e7c8bda568279ab4f6f1
• 5e0a30d8d91d5fd46da73f3e6555936233d870ac789ca7dd64c9d3cc74719f51

IPv4 Addresses:

• 45[.]13[.]212[.]251, 45[.]13[.]212[.]250, 23[.]227[.]202[.]114

Domains:

• xmri[.]network, wexmri[.]cc, d15mawx0xveem1[.]cloudfront[.]net

URLs:

• hxxp[:]//www[.]investonline[.]in/js/jq[.]php

References

• https://www.elastic.co/security-labs/mimicrat-custom-rat-mimics-c2-frameworks
• https://hivepro.com/threat-advisory/clickfix-to-control-matanbuchus-campaign-deploys-astarionrat-in-minutes/