NetSupport RAT via IClickFix

Summary

Sekoia.io's TDR team traced a JavaScript framework it calls IClickFix, planted in more than 3,800 breached WordPress sites across 82 countries. The injected tag pulls a script from a registered domain, and that request passes through a filter built on the YOURLS open-source shortener, which screens out scanners before forwarding selected visitors. Two further scripts follow, the second parked on a separate hacked site, after which the page is swapped for a counterfeit Cloudflare Turnstile check. A visitor who works through the on-screen steps pastes a concealed instruction into the Run box, fetching a PowerShell stage served with a .json extension. That stage unpacks fifteen files beneath ProgramData, adds a Run key and starts a NetSupport RAT client reporting to registered gateway domains. Sekoia dates the cluster to December 2024 and judges it capable of thousands of infections daily.

Overlap with other campaigns

We compared the 111 indicators in this record — covering 83 distinct registrable domains — against the 43 other published campaigns in this corpus.

• XFiles Stealer via early IClickFix

  2026-08-07

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • short[.]gydomain, shown defanged for safety: short dot gy

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

19 of 111

Checks recorded

38

Checks since publication

38

Never checked

92

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 92 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 10 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

111 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.