WebDAV rundll32 ordinal ClickFix

Summary

CyberProof published this on 28 July 2026 after several incidents at one organisation, which it reads as a sustained campaign. Each began with a fake CAPTCHA asking for a paste into the Windows Run dialog, fronted in telemetry by pcalua.exe, the signed Program Compatibility Assistant. The command mounts a WebDAV share over HTTPS and has rundll32 load a remote file that is not named like a DLL, calling its first export by number rather than by name, so nothing obvious lands on disk and the traffic resembles ordinary web browsing. The file names changed from incident to incident, and so did the wrapping: WMI process creation in one, caret insertion in another, and in the latest, strings split apart and reassembled at run time, which evaded automated EDR detection and surfaced only through threat hunting. One incident got as far as sending data out.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

7 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.