New ClickFix Attack Uses Node.js Malware via Tor to Steal Crypto
ClickFix campaign uses fake CAPTCHAs to deploy Node.js RAT malware via Tor to steal crypto.
Netskope Threat Labs uncovered a professional Malware-as-a-Service (MaaS) operation called ClickFix that tricks Windows users via fake CAPTCHA prompts into downloading a Node.js-based Remote Access Trojan (RAT). The malware uses Tor for C2 communication, stays hidden in memory, and targets cryptocurrency wallets by checking for 30+ security products before executing theft operations. Researchers discovered the attackers' exposed admin panel, revealing the use of gRPC protocol for real-time wallet tracking and Telegram-based alerts to affiliate scammers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Netskope?
Get an email when a new story names Netskope, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ClickFix campaign demonstrates how sophisticated social engineering can bypass technical security controls by exploiting user trust in familiar web elements like CAPTCHA prompts. Users were tricked into manually downloading and executing malicious Node.js payloads that appeared to be legitimate security verification steps. The malware's use of Tor for command and control communication, memory-only persistence, and reconnaissance of security products shows the evolution of crypto-focused threats. This attack highlights the critical importance of user education in recognizing deceptive interfaces and the need for robust endpoint protection against fileless malware.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — NodeServer-Setup-Full.msi
- malware — LogicOptimizer
- malware — ClickFix