WallStealer and a miner via ClickFix

Summary

CtrlAltIntel published this bulletin on 12 September 2026, following an open directory found through Hunt.io in July 2026 on a server that held a ClickFix kit alongside its payloads. The kit's main script draws a fake Cloudflare checkbox, tries to copy an obfuscated PowerShell command, and a few seconds later tells the visitor to paste it into Windows Run; the command fetches an executable from the same server into the temp folder and starts it. Two other scripts in the set contain errors that leave their delivery unconfirmed. Three droppers built on one Rust framework unwrap to WallStealer, which reads its C2 address from Steam profile names and takes browser passwords, cookies, card data, screenshots and messaging and wallet files, and to an XMRig-based miner reporting to the same server. The bulletin separates the indicators it verified from those it inherited.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 61 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

All 3 of these mechanisms appear together in 15 of the 61 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

23 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.