Potemkin Loader ClickFix Intrusion: Multi-Stage Campaign Deploying RMMProject RAT and Blockchain-Resolved Backdoor

In a confirmed hands-on intrusion spanning eleven endpoints, attackers gained initial access through a ClickFix lure served from a compromised website that directed victims to paste a command into the Windows Run dialog. The command abuses pcalua.exe as a LOLBIN to spawn mshta.exe with a remote HTA URL, which silently downloads and executes an MSI installer delivering the Potemkin loader. Potemkin is a compact custom loader that uses a deterministic domain generation algorithm built on XorShift32 to probe ten thousand candidate domains for active C2, reflectively loading its follow-on payload directly in memory once contact is made. The use of a shared DGA codebase between Potemkin and its second stage, RMMProject, suggests a single development team behind the campaign.

RMMProject is a modular RAT framework embedding a LuaJIT scripting engine that gives the operator dynamic execution capability without recompiling the implant. Its capabilities cover browser credential and cookie theft across Chrome, Firefox, and Edge, an App-Bound Encryption bypass that injects a helper DLL into a spawned Chrome process to decrypt stored secrets from Chrome version 127 and later, remote desktop control on a hidden Windows desktop, process injection, and reflective module loading. Following RMMProject deployment, a second installer delivers EtherRAT: a Node.js-based backdoor that resolves its C2 server address by reading a value from an Ethereum smart contract, making the C2 channel resilient to domain takedowns since updates require only a low-cost blockchain transaction. A renamed Cloudflare tunnel binary provides an additional persistent inbound access channel.

What distinguishes this intrusion is the visible adaptability of the human operator once inside. Rather than running a fixed playbook, the attacker cycled through a progression of defense evasion techniques in response to Defender detections: beginning with disabling Windows' built-in script scanning interface (AMSI) via .NET reflection, escalating to registry policy writes that stripped real-time protection, then adding exclusion paths via PowerShell, and ultimately terminating the Windows Defender service entirely when earlier attempts were blocked. This back-and-forth against endpoint defenses played out while the attacker simultaneously deployed a Chisel reverse proxy for network pivoting and spread the loader across eleven hosts using Impacket-style remote execution, compromising domain administrator credentials and reaching the domain controller. The attacker likely had hours of unobserved access on at least one endpoint before any telemetry existed, underscoring the risk of gaps in endpoint monitoring coverage.