Hackers Use Potemkin Loader to Deliver RMMProject RAT in ClickFix Intrusion

## Executive summary A ClickFix campaign using social-engineered Run-dialog commands dropped the Potemkin loader which used a DGA to fetch modules and deployed RMMProject (a Lua-scriptable RAT with credential-theft and browser ABE bypass capabilities) and EtherRAT (a Node.js backdoor that retrieves C2 from an Ethereum smart contract). Operators used Cloudflare tunnels for persistence, disabled Windows Defender via PowerShell and registry changes, and moved laterally with WMIExec/SMBExec to compromise 11 hosts including the domain controller.