Atos Says a New ClickFix Variant Maps a Remote WebDAV Drive With net use and Hides Its Beacon in a Trojanized WorkFlowy App, Slipping Past Default Detection Until a RunMRU Hunt Caught It

LONDON - A new twist on the ClickFix social engineering technique skips the PowerShell and mshta one-liners that defenders have learned to alert on and instead has the victim mount the attacker's server as a network drive, according to research published Oct. 27 by Atos. The intrusion it describes was not caught by security controls and surfaced only through a threat hunt, the company said.

The report, by Atos adversary researcher Piotr Bienias, follows the familiar ClickFix opening. A page on happyglamper[.]ro posed as a captcha check and told visitors to press Windows and R, paste with Ctrl and V, and hit Enter. What they pasted was a cmd.exe command that ran net use Z: against a WebDAV path on 94[.]156[.]170[.]255 with persistence turned off, executed a batch file called update.cmd from the new Z: drive, and then deleted the mapping.

Atos said using net use to pull a batch script from a remote share was not a new technique in itself, but that it had not seen it in ClickFix attacks before. The batch file started a hidden PowerShell window that downloaded flowy.zip from the same address, unpacked it into a MyApp folder under the user's local application data directory and launched WorkFlowy.exe.

A legitimate app with a replaced core

The archive held the WorkFlowy desktop application, version 1.4.1050, signed by its developer, FunRoutine Inc., and built on Electron. Atos said the attackers had repackaged that older release, against a current version 4.3, and replaced the app.asar archive, the package that holds an Electron app's JavaScript, with one in which main.js had been rewritten.

The injected code runs before anything legitimate. It opens with an endless beacon loop that never returns, so WorkFlowy itself never finishes starting. On first run it writes a random eight-character victim ID to id.txt in the user's roaming application data folder. It then posts that ID, the computer name and the Windows user name to cloudflare.report/forever/e/ every two seconds, a domain Atos said spoofs Cloudflare branding. When the server answers with a task, the code decodes base64 file contents, writes them to a folder under the temp directory named for a Unix timestamp and runs any executable it finds there.

Atos traced the C2 to 144[.]31[.]165[.]173 in Frankfurt, on AS215439 operated by play2go.cloud, and said the domain was registered in January 2026 through OnlineNIC with a Hong Kong registrant. The dropper sets up no persistence of its own and runs only while WorkFlowy is open, which Atos takes to mean persistence is left to whatever payload the server delivers. The C2 was already unresponsive when the company analyzed it, so the final payload is not known.

Why it evaded default detection

Because the code runs inside the Electron main process, outside the Chromium sandbox, it has the full rights of the logged-in user, Atos said. The malicious logic sits inside a signed application's package, a format the company said is rarely inspected, and the initial access never calls PowerShell, mshta or wscript directly from the Run dialog. Earlier ClickFix waves, Atos noted, tended to give themselves away by invoking interpreters and living-off-the-land binaries that endpoint tools watch closely.

What did work was hunting on execution context instead of payload indicators. Windows records commands typed into the Run dialog under the RunMRU key in each user's registry hive, and Atos built its hunt around writes to that key by explorer.exe.

What SOC teams can take from it

The published Sigma rule, "Suspicious Commands executed via Run dialog," is marked experimental and medium severity. It reads Sysmon Event ID 13 registry-set events or equivalent EDR telemetry, looks for values written under the Explorer RunMRU key by explorer.exe, and matches a list of interpreters and LOLBins that now includes net.exe and net1.exe alongside cmd, PowerShell, mshta, rundll32, msiexec and others. Atos lists administrators and IT staff using the Run dialog for legitimate tools as the expected false positives.

Beyond the rule, the chain Atos documents leaves other artifacts worth hunting: a net use mapping to an HTTP WebDAV path, a .cmd file run from the new drive letter and the mapping deleted in the same command line; an Electron application launched from a user-writable MyApp folder under local application data; and an id.txt file in the roaming application data folder. Atos published the app.asar hash as a390fe045f50a0697b14160132dfa124c7f92d85c18fba07df351c2fcfc11063, along with the lure domain, both IP addresses and the C2 URL.

The broader lesson, Atos argues, is that ClickFix is still evolving toward native utilities and trusted applications that generate few alerts, and that hypothesis-driven hunting is what catches those weak signals early enough to break the chain.