Executive Summary
A new ClickFix campaign has been identified using advanced social engineering to trick users into executing malicious commands that abuse legitimate Windows utilities. The attack chain begins with a social engineering prompt that leads to the execution of pcalua.exe, which subsequently leverages WMI and PowerShell to initiate a multi-stage infection process.
Technically, the campaign stands out by using the Program Compatibility Assistant (pcalua.exe) and WMI (Win32_Process) to spawn a hidden command shell. This shell mounts a remote, HTTPS-protected WebDAV share via the 'pushd' command, allowing the attacker to load a malicious DLL (gc.key) directly into memory using rundll32.exe. This method effectively bypasses many standard detection mechanisms that focus on direct file downloads.
This campaign represents a significant risk to organizations as it utilizes trusted binaries and encrypted WebDAV channels to deliver information-stealing malware. The infrastructure is characterized by short-lived TLS certificates and victim-specific UUID paths, indicating a sophisticated and highly targeted delivery mechanism.