Executive Summary
The Cofense Phishing Defense Center has identified a novel campaign utilizing the ClickFix self-infection technique to deliver a custom monitoring RAT named HarborWatch Agent. The attack begins with highly convincing Amazon-themed security alerts that lure users to a lookalike domain. Once there, victims are socially engineered into manually executing a malicious PowerShell command via the Windows Run dialog, effectively turning the user into the primary infection vehicle.
The payload, HarborWatch Agent, is a specialized remote access trojan (RAT) that exfiltrates extensive system hardware and network details to a command-and-control (C2) server. This C2 infrastructure utilizes a Chinese-language management interface branded as 'Harbor Sentinel' (港湾哨兵), which provides attackers with real-time asset monitoring and tasking capabilities. This campaign represents a shift toward user-assisted execution to bypass traditional email security gateways and automated sandboxes.