In February 2026, Elastic Security Labs uncovered a sophisticated ClickFix campaign that hijacks legitimate websites to deploy a previously undocumented remote access trojan (RAT) dubbed MIMICRAT (also known as AstarionRAT).

Campaign Overview

• Vector: Attackers compromise legitimate websites and inject malicious scripts. When a user visits, they are met with a fake Cloudflare verification page or browser error message.
• The “ClickFix” Hook: The lure tricks users into copying a “fix” command to their clipboard and pasting it into a PowerShell or Run (Win+R) dialog. This social engineering tactic bypasses traditional browser download protections.
• Targeting: The campaign is highly localized, supporting 17 languages. Victims have been identified globally, including a U.S.-based university and Chinese-speaking users.

Technical Breakdown of MIMICRAT

MIMICRAT is a custom C++ implant designed for high-level operational stealth:

• Multi-Stage Infection: The PowerShell command triggers a chain that bypasses Windows event logging (ETW) and Antivirus scanning (AMSI) before dropping a Lua-scripted shellcode loader.
• Stealth Communication: It communicates over HTTPS using malleable C2 profiles that mimic legitimate web analytics traffic to evade detection.
• Capabilities: The RAT includes a 22-command toolkit featuring SOCKS5 tunneling, Windows token impersonation, and process/file system control.

Defensive Recommendations

To mitigate this threat, security experts at Microsoft and Elastic recommend:

• User Education: Training users to never paste and run commands from website pop-ups.
• Policy Hardening: Restricting the use of the Windows Run dialog or PowerShell for non-administrative users.
• Monitoring: Auditing for suspicious PowerShell execution events triggered by clipboard activity.