ClickFix × HijackLoader: Dissecting a Live Stealer Campaign - Part 2

1. Overview

In Part 1, I walked through the full delivery chain, from the ClickFix lure through the MSI package, both loader stages, and into the ti64 orchestrator. By the end, the syscall table was built, ntdll was unhooked, and TinyCallProxy64 was loaded into the runtime context. Everything was in place, but nothing had executed yet. This part picks up where that left off. The focus here is on what the orchestrator actually does, how it routes every syscall through an indirect call chain with full stack spoofing, how it selects its injection method, and how the final payload is deployed.

At a high level, executi…