OBSCURE#BAT via a Discord lure

Summary

OBSCURE#BAT is the name Securonix gave to activity that installs an altered build of r77, an open-source rootkit whose value to an operator is staying hidden and staying put. Microsoft attributes one of the lure pages it pulls apart in this write-up to that same cluster. The page presents itself as a Discord server that wants a visitor identified before letting them join, and borrows the platform's own logo to sell the idea. Its script waits for the verify button and then uses the browser's clipboard interface to load a command, with no hidden frame and no message from another document involved — plainer than the other example Microsoft dissects, where a concealed frame signals the parent page. Recorded alongside it are a landing page, a batch file on a public file host, and two addresses used for control between February and March 2025.

Cross-vendor timeline

2 published accounts. Securonix Threat Research was first, on 2025-03-12. The most recent is Microsoft Threat Intelligence, 162 days later.

1. 2025-03-12Securonix Threat Research

   Analyzing OBSCURE#BAT: Threat Actors Lure Victims into Executing Malicious Batch Scripts to Deploy Stealthy Rootkits

2. 2025-08-21Microsoft Threat Intelligence+162 days

   Think before you Click(Fix): Analyzing the ClickFix social engineering technique

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

179 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.