clickfix

DPRK's Contagious Interview campaign appears to have started buying ClickFix traffic from ErrTraffic, a kit sold as a service, alongside its fake recruiter and fake interview lures. Every route delivers a portable Node.js loader that resolves its C2 from Polygon smart contracts labelled team1 to team10, plus a second npm.zip RAT kit with a hardcoded C2.

Analysis of a ClickFix campaign across compromised WordPress sites that pulls its first stage from GitHub via jsDelivr, decodes a 6 MB XOR'd PowerShell loader, and Early Bird injects shellcode into MicrosoftEdgeUpdate.exe to reflectively load an undetected PE masquerading as Realtek HD Audio Manager.