ClickFix Campaign Abuses Compromised Sites to Deploy MIMICRAT Malware

Researchers disclosed a sophisticated ClickFix campaign that compromises legitimate sites to deliver a custom C++ RAT called MIMICRAT (AstarionRAT). The attack uses a multi-stage PowerShell chain that bypasses ETW and AMSI, drops a Lua-scripted shellcode loader, and executes an in-memory RAT communicating over HTTPS; the implant supports token impersonation, SOCKS5 tunneling, and 22 post-exploitation commands, with suspected objectives of data exfiltration or ransomware.