Hackers Use ClickFix Prompt to Install MSI Package and Launch Hands-On-Keyboard Attack

Huntress reported a ClickFix social-engineering campaign where a user was tricked into running a command that used pcalua.exe to proxy mshta and silently install an MSI, deploying a Potemkin loader that fetched RMMProject (memory-loaded RAT) and later EtherRAT; the operator performed hands-on-keyboard lateral movement across the network (WMIExec/SMBExec), disabled Windows Defender using AMSI/registry/service techniques, established Cloudflare tunnels and Chisel SOCKS persistence, and compromised over 11 hosts. The report includes detailed IoCs (hashes, IPs, domains, Ethereum contract/storage keys, file paths, registry keys) and recommends auditing endpoint coverage and blocking the Windows Run dialog and suspicious cloudflared binaries.