A new custom remote access trojan (RAT) named MIMICRAT has been identified in a highly sophisticated campaign leveraging the deceptive ClickFix method.
Unlike typical malware attacks, this campaign targets trusted websites to deliver payloads, relying on social engineering instead of software exploits.
Elastic researchers observed a five-stage infection process, designed for long-term stealth and global reach across multiple industries and 17 localized languages.
For CISOs, SOC analysts, and security teams, this threat highlights the growing importance of defending against fileless, user-driven malware campaigns.
How the ClickFix Campaign Works
- Website Compromise:
Legitimate sites, such as financial tools, are silently injected with malicious JavaScript. - Social Engineering Lure:
Visitors encounter a fake Cloudflare verification popup asking them to copy and execute a PowerShell command to “fix a browser error.” - Initial Execution:
The PowerShell command triggers highly obfuscated scripts, bypassing browser protections and antivirus tools. - Security Bypass:
Secondary scripts disable Windows Event Tracing and the Antimalware Scan Interface (AMSI), blinding endpoint security. - Final Payload Deployment:
A Lua-based loader decrypts and executes the final MIMICRAT shellcode in memory, maintaining a fileless footprint.
This multi-stage process allows the malware to operate without leaving traditional artifacts, making forensic analysis extremely challenging.
MIMICRAT Capabilities
The malware is a versatile, native C++ implant with the following functions:
- Windows token theft for privilege escalation
- File system manipulation
- SOCKS5 tunneling for anonymized network communications
- Persistent command-and-control (C2) via malleable HTTP profiles
- Memory-only execution to avoid disk detection
These features enable attackers to exfiltrate sensitive data and maintain stealthy long-term access.
Infection and Stealth Mechanisms
- Obfuscated PowerShell commands: Initial execution and download scripts are heavily obfuscated.
- AMSI and Event Tracing bypass: Prevents detection by modern security tools.
- Lua-based memory loader: Executes shellcode directly in RAM, leaving no files on disk.
- Malleable HTTP C2 traffic: Blends with legitimate web analytics traffic, hiding network indicators.
The modular design allows attackers to rapidly adapt lures, scripts, and C2 behavior, making each campaign iteration harder to detect.
Global Reach
- Targets multiple industries worldwide
- Lures dynamically localized into 17 languages
- Uses legitimate website infrastructure to circumvent traditional endpoint defenses
This demonstrates a highly coordinated and professionalized threat actor, capable of launching broad, stealthy operations.
Mitigation and Defense Strategies
Organizations can reduce exposure by implementing the following measures:
1. User Awareness
- Train employees to recognize fake browser verification prompts
- Avoid copy-pasting unknown commands into PowerShell
2. Endpoint Controls
- Enforce strict PowerShell execution policies
- Monitor for obfuscated command lines and suspicious scripts
3. Network Monitoring
- Block known malicious domains associated with MIMICRAT
- Inspect network traffic for unusual HTTP patterns or SOCKS5 tunnels
4. Incident Readiness
- Deploy memory analysis tools for fileless malware detection
- Conduct regular threat hunting exercises focusing on multi-stage campaigns
Key Takeaways
- MIMICRAT is a fileless, multi-stage RAT leveraging social engineering and ClickFix tactics.
- Trusted websites are being abused to deliver malware, bypassing traditional protections.
- The malware operates entirely in memory and uses obfuscation to evade detection.
- User training, endpoint policies, and network monitoring are critical for defense.
- Organizations must anticipate multi-stage, globally coordinated campaigns targeting multiple industries.
Conclusion
The discovery of MIMICRAT illustrates a shift in malware campaigns toward fileless, socially-engineered attacks that exploit human trust.
For SOC teams and enterprise security leaders:
The defense is as much about user awareness and procedural controls as it is about technology.
Rapid detection, proactive monitoring, and coordinated incident response are key to mitigating the MIMICRAT threat chain.
