CrocoRat Adds a New Twist to ClickFix with DNS Payload Delivery
ID: a5c0d3ae-4ba2-55c6-9a54-ba7a81fbc732
STIX ID: report--a5c0d3ae-4ba2-55c6-9a54-ba7a81fbc732
Feed Name: Security Boulevard
CrocoRat is a live ClickFix-driven campaign that converts a browser session into code execution via clipboard injection and DNS TXT staging; a PowerShell dropper retrieves an update.zip that contains a bundled Python runtime and encrypted payloads, installs a scheduled task for persistence, and conditionally deploys a RAT on apparent domain-joined systems or a RAT plus a browser/wallet stealer (including DLL injection and seed-phrase hunting) on standalone machines—operators rotate filenames, keys, and infrastructure and exfiltrate data over HTTP to multiple endpoints.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.