ClickFix Lures Push Trojanized Apps, Starland RAT

How the Attack Worked

This campaign, attributed by Cisco Talos to a financially motivated actor tracked as UAT-11795, relies on a ClickFix style lure. Victims encounter a prompt that entices them to execute a command in order to "fix" a supposed problem. That command stealthily downloads and executes a remotely hosted weaponized HTA file through mshta.exe, Microsoft's HTML Application Host. From there, the infection chain installs trojanized versions of legitimate, familiar software, including MobaXterm, WebEx, Zoom, DBeaver, and FACEIT. Once run, these installers deploy Starland RAT and other payloads that steal credentials and cryptocurrency wallet assets while maintaining remote access for the attacker.

Why It Succeeded

The attack succeeds by exploiting trust in two ways. First, ClickFix prompts frame malicious command execution as a routine troubleshooting step, something many users are conditioned to do without question. Second, the trojanized installers mimic tools that employees and developers already expect to download and run regularly, such as WebEx or Zoom. This combination lowers suspicion at both the initial command stage and the software installation stage, letting the malware slip past casual scrutiny.

What to Watch For

• Any prompt asking you to run a command or script to "fix" a problem, especially outside of IT-led troubleshooting.
• Unexpected use of mshta.exe or other scripting utilities triggered from a website or installer.
• Installers for common tools (WebEx, Zoom, MobaXterm, DBeaver, FACEIT) obtained from a source other than the official vendor.
• Unusual persistence entries or repeated prompts after reboot or login following a software install.
• Any unexpected network beaconing activity following installation, which may indicate the malware confirming execution to its operator.

How to Build Resistance

Organizations can reduce exposure to this style of attack with a few practical habits:

• Train employees to treat any "fix" that requires running a command as suspicious, and to verify through known IT channels before acting.
• Reinforce that software should only be downloaded from official vendor sites, never from links in prompts or unsolicited messages.
• Encourage extra caution among developers and IT staff, who are often targeted with installer lures for tools they use daily, such as MobaXterm or DBeaver.
• Remind users who manage cryptocurrency wallets that these assets, along with browser-stored credentials, are explicit targets in campaigns like this one, warranting additional verification before installing any new tool.

Because this campaign blends a believable troubleshooting pretext with trojanized versions of everyday software, awareness of both stages, the command prompt and the installer itself, is key to catching it early.

What is a ClickFix social engineering technique?

It is a lure that convinces a user to execute a command, believing it will fix an issue, which instead stealthily downloads and runs a weaponized HTA file via mshta.exe.

What software was trojanized in this campaign?

Talos observed trojanized installers masquerading as common tools including MobaXterm, WebEx, Zoom, DBeaver, and FACEIT.

What does Starland RAT do once installed?

Starland RAT steals victims' credentials and cryptocurrency wallet assets and can download and execute additional payloads on the infected machine.

Who should be most concerned about this attack?

General employees, IT/helpdesk staff, developers, and anyone who manages cryptocurrency wallets are all targeted by these lures.