Hackers Use ClickFix Technique to Deploy NetSupport RAT Loaders

According to eSentire’s Threat Response Unit (TRU), hackers are increasingly using a technique called ClickFix to deploy NetSupport RAT loaders, shifting away from fake software updates as the primary delivery method in 2025. The attack relies on social engineering: victims are lured to a ClickFix page and told to paste a malicious command into their Windows Run Prompt, triggering a multi‑stage infection that downloads and installs the NetSupport RAT for full remote control.

TRU researchers identified several loader types, with a PowerShell‑based loader that retrieves a JSON file containing Base64‑encoded NetSupport payloads, decodes them, writes them to a hidden directory, and creates a shortcut in the Windows startup folder to ensure persistence on reboot. A newer variant attempts to erase traces by deleting registry values from the RunMRU key, while a less common method uses msiexec.exe to download and run MSI packages that deliver the RAT.

Analysts cluster campaigns into three threat groups—EVALUSION, FSHGDREE32/SGI, and XMLCTL (UAC‑0050)—and advise organisations to disable Run prompts via Group Policy, block unapproved remote management tools, and strengthen security awareness training.