MIMICRAT via compromised websites

Summary

Elastic Security Labs first described this operation, in which a copy-and-paste prompt on compromised websites leads the visitor to run a command that installs a RAT called MIMICRAT. Stormshield found the campaign still running and, on 3 March 2026, pivoted from the two payload servers Elastic had named. Passive DNS on those addresses returned a large estate of look-alike service names - variations on 'avservice', 'msmanager', 'winservice' and similar - spread across the .network, .cc, .lat, .info, .wiki, .live and .pics top-level domains. Almost all were registered through the same registrar, most in early January 2026, and some on the day the report was written. Stormshield notes it expects more to appear. A second pivot, on a 'hosting is blocked' banner returned by one server, produced five further addresses. The report adds thirty-one file hashes, most of them TLS certificates rather than malware.

Cross-vendor timeline

2 published accounts. Elastic Security Labs was first, on 2026-02-20. The most recent is Stormshield Customer Security Lab, 21 days later.

1. 2026-02-20Elastic Security Labs

   MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

2. 2026-03-13Stormshield Customer Security Lab+21 days

   Investigations into the MIMICRAT ClickFix campaign

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 8 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

193 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.