ThreatHunter.ai Unpacks Azure30, a Node.js Backdoor Tied to a ClickFix msiexec Lure

SINGAPORE - A Windows installer posing as "User Workspace Tools" from "Workspace Apps" drops a remote-access backdoor written entirely in JavaScript, according to an Oct. 9, 2026 report on the ThreatHunter.ai blog by researchers James McMurry and Ivan Wike of the CORVINater threat-analysis team. The per-user package, Azure30-3ade35b5.msi (SHA-256 e08a33f5a9a722f05c1fb881ccb48337013a8824444a0fae7adf0e107b5700a0), bundles its own Node.js runtime and 31 heavily obfuscated modules, a design the researchers say traditional executable-focused tools rarely inspect. Azure30 is the folder name the build gives itself in its own manifest. Once running, the implant profiles the host, checks for 82 cryptocurrency wallets, registers with its operators over an unencrypted WebSocket on port 443, and waits for instructions. The report, CVR-2026-1008-01, is released TLP:CLEAR, and the researchers say they found no public reporting on this family.

The researchers tie the package, with moderate confidence, to a ClickFix intrusion observed on Oct. 7 at 22:13 UTC. A fake "verify you are human" or error page told the user to press Win+R and paste a command the page had already placed on the clipboard. That command ran msiexec with its /package switch spelled in Unicode modifier letters, so exact-string detections for "msiexec /package" do not match while Windows still accepts it, plus a -Q flag for a fully silent install from usaclodconfig[.]net (23.94.145[.]92). Because the package installs per user, no elevation prompt appears. One second after the paste, Microsoft Defender flagged ClickFix activity and a suspicious RunMRU command, and between 22:16 and 22:41 UTC its automatic attack disruption contained the account and the device. The Azure30 MSI the team analyzed was built at 10:56 the same day. The pasted command stays in the HKCU RunMRU registry key, which the report calls a durable forensic artifact of ClickFix execution.

The MSI writes 2,297 files to %LOCALAPPDATA%\BronzeMauve\Azure30\, and a WiX quiet-exec custom action starts the bundled node.exe on launch.js in a hidden window. A scatter stage then moves the runtime, code, and configuration into three new AppData folders, empties the install folder, and records the new locations in install-meta.json, which the researchers single out for responders because its scatter.paths block lists every folder a given build used. The launcher starts the agent as a detached, hidden node.exe and exits within a second, leaving it without a living parent process, and the agent claims a named pipe of the form wra- followed by 24 hex characters. Persistence waits ten minutes: a Startup-folder AzureCopper.vbs runs wscript //B on a hidden launcher, EcruGarnet.vbs, under %LOCALAPPDATA%\Cerulean\. That delay outlasted CORVIN's own five-minute sandbox runs, and the first detonation scored the sample 0/100 until the team fixed three platform gaps, including a Sysmon log that wrote 316,356 records in ten minutes and overwrote the installation events.

The decrypted configuration points to ws://usatraksell[.]net:443 with an X-Agent-Token header and a 12-minute heartbeat, and the first register message carries the MachineGuid, user name, domain or workgroup, and local IP. At every connection, and about every 75 seconds while disconnected, the agent downloads /api/agent/script and runs whatever JavaScript the operators serve, so the stage that would perform the actual theft is not in the installer and can change at any time. Fifteen operator commands cover an interactive PowerShell or cmd shell, file theft up to 50 MB per file, screenshots, download-and-execute, silent MSI deployment, JavaScript eval, self-update, and self-deletion. The wallet scan checks 37 desktop wallets and 45 browser-extension wallets across nine browser families, and an AV scan looks for processes matching *sens* to spot Microsoft Defender for Endpoint. Code for a smart-contract dead-drop resolver is present but disabled in this build, and a leftover table maps five contract addresses to earlier fallback servers at shift-api-control[.]com and dibardo[.]net.

For SOC teams, the report's core message is that this is a device problem, not an identity problem. Credential resets and session revocation are necessary but do not remove the implant, identity sign-in logs will not show its use because operators work from the infected host, and network isolation pauses the agent rather than removing it. The researchers publish Microsoft Defender XDR hunting queries for msiexec URLs in RunMRU, node.exe launched by msiexec or running from AppData with a .js argument, wscript //B launching AppData VBS files from a Startup item, and node.exe lookups of the C2 domains and api.ipify.org, plus three YARA rules they say matched the MSI and its unpacked agent files with no false positives across 30,165 benign files. Because all C2 traffic is cleartext, the X-Agent-Token header and WebSocket upgrades to port 443 without TLS are visible on the wire. The team recommends treating any host that ran the installer as compromised by a human operator, re-imaging it, moving cryptocurrency from a clean device, restricting per-user MSI installs with the DisableUserInstalls policy, and alerting on interpreters such as node.exe running from user profile folders. The report makes no attribution; in the researchers' assessment, German installer strings and per-campaign tokens suggest a commercial or crimeware toolkit used by multiple operators.