From Fake Amazon Security Alert to HarborWatch Agent: ClickFix Delivery of a Custom Monitoring RAT

Cofense details an Amazon-branded phishing campaign that leverages ClickFix style social engineering and a clipboard-pasted PowerShell chain to download and execute a custom RAT called HarborWatch Agent (mysql.exe). The report includes the multi-stage infection flow, PowerShell artifacts (Clipboard.ps1, code.txt), file hashes, observed payload and C2 URLs/IPs (including 185.193.127.44), API endpoints used by the agent, and an administrative web panel labeled "Harbor Sentinel."