Last Updated: 2026-09-12T15:06:12Z
What’s Happening
While reviewing some recent ClickFix/Etherhiding domains on ThreatFox, I noticed a bizarre sample with weirdo strings in it.
Turns out it was part of the Lorem Ipsum malware family, which uses nonsense strings as a sort of encoding mechanism for its C2 commands.
This is a known technique. Also known is the use of letsdiskuss[.]com, an Indian social media site, to host C2 data. For example, this user profile.
The malware’s second stage uses a signed Microsoft binary (CertEnrollCtrl.exe) with a patched DLL containing the evil stuff.
If anything is interesting here, it’s that the .zip file downloaded by the initial ClickFix payload contains a batch script file with comments that, uh, suggest other-than-human authorship.
Great work, robots. Thanks for that.
Actions
Most EDRs will block these ding-dong attacks, but consider blocking these domains, if they aren’t already.
| Value | Type | Description |
|---|---|---|
runtimerailbit[.]com |
Domain | ClickFix First Stage Download |
letsdiskuss[.]com |
Domain | Initial C2 |
queuepodnet[.]com |
Domain | Second Stage C2 Domain |
signinbyte[.]com |
Domain | Second Stage C2 Domain |
yourbestsupervisiournow[.]com |
Domain | Second Stage C2 Domain |
Notes
I’m mostly interested in the recurrence of this technique in the ClickFix/Etherhiding campaigns. I firmly believe that we’re seeing the results of a vibrant cryptocurrency market for bidding on compromised sites which will load a dizzying array of malware variants based on the top bidder.
