TLDR Tech / InfoSec
New ClickFix Attack Uses Node.js Malware via Tor to Steal Crypto
Netskope Threat Labs identified a MaaS-supported ClickFix campaign that has been active since early 2025. It targets Windows users with a fake CAPTCHA, prompting them to execute a PowerShell command that silently downloads NodeServerSetup-Full.msi. This RAT includes its own Node.js runtime, installs in a "LogicOptimizer" folder, maintains Registry persistence, and reroutes all C2 communications through Tor. The malware scans the host against over 30 security solutions before dynamically loading infostealer modules into memory at runtime, avoiding disk-based detection. An OPSEC oversight exposing its admin panel uncovered a gRPC-based C2 infrastructure, with affiliate groups receiving real-time Telegram alerts about successful crypto wallet thefts. It is recommended that defenders block outbound Tor traffic, monitor msiexec processes initiated by PowerShell, and treat any browser prompt instructing to "fix" via clipboard as an immediate IOC.
Read the full story