Recent OTX pulses highlight a dual-threat landscape focusing on credential harvesting through distinct yet sophisticated vectors. The first pulse details an evolution of the "ClickFix" campaign, where adversaries leverage social engineering to trick users into executing payloads via rundll32.exe over WebDAV connections. This technique utilizes ordinal execution to load non-DLL files, evading standard detection mechanisms. The second pulse exposes a massive phishing infrastructure surge targeting Chile, specifically impersonating the "PasasteSinTAG" portal. Researchers identified 99 new domains, indicating a rapid domain rotation strategy designed to bypass static email filtering. Collectively, these campaigns demonstrate a high operational tempo by threat actors focused on initial access via social engineering and credential theft.

Threat Actor / Malware Profile

ClickFix (WebDAV Variant)

• Distribution Method: Social Engineering (Fake browser updates, fake error messages prompting "Run" dialog execution).
• Payload Behavior: Uses rundll32.exe to load remote payloads hosted on WebDAV servers using ordinal export #1. The payload is often a non-DLL file, bypassing standard file extension checks.
• C2 Communication: WebDAV over HTTPS (Port 443). This tunneling mimics legitimate web traffic and bypasses many network inspection controls that block non-standard ports.
• Persistence Mechanism: WMI process spawning is used to maintain access and evade simple process tree analysis.
• Anti-Analysis Techniques: Heavy obfuscation in command lines, use of legitimate Windows binaries (rundll32.exe), and remote payload storage (WebDAV) to avoid leaving files on disk for analysis.

PasasteSinTAG Phishing Campaign

• Distribution Method: Bulk phishing emails, likely containing links to the newly registered domains.
• Targeting: Specific focus on Chile, mimicking a local transit/payment portal (PasasteSinTAG).
• Infrastructure: High-velocity domain rotation utilizing TLDs such as .click, .cfd, .cyou, .mom, .best, .rest, .top, .help, .sbs, and .icu.
• Payload: Fake web portals designed for credential harvesting.

IOC Analysis

The provided IOCs are critical for immediate defense:

• File Hashes (SHA256, MD5, SHA1): Associated with the ClickFix payload. These should be blocked in EDR solutions and used to hunt for historical presence on endpoints.
• Domains & Hostnames: A mix of WebDAV infrastructure (e.g., gentletouchchiropracticclinicauroracol.com) and phishing typosquatting (e.g., pasastesintag.pics).
• Operationalization:
  • DNS Blocking: immediately block the listed domains on DNS resolvers and firewalls.
  • EDR/Hunting: Use the file hashes to scan endpoints. Look for processes connecting to the WebDAV hostnames.
  • Network Inspection: Decrypt and inspect HTTPS traffic on port 443 looking for WebDAV methods (PROPFIND, PROPPATCH) associated with the listed infrastructure.

Detection Engineering

Sigma Rules

title: ClickFix WebDAV Rundll32 Execution
description: Detects suspicious rundll32 execution with remote WebDAV paths characteristic of ClickFix campaigns.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6763456789012345
tags:
    - attack.defense_evasion
    - attack.t1202
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '\\'
    filter:
        CommandLine|contains: 
            - 'javascript:'
    condition: selection and not filter
falsepositives:
    - Legitimate administrative scripts
level: high

---

title: PasasteSinTAG Phishing Domain Access
description: Detects DNS requests or network connections to domains impersonating PasasteSinTAG.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6763456789012346
tags:
    - attack.initial_access
    - attack.t1566.002
logsource:
    category: dns_query
    product: windows
detection:
    keywords:
        QueryName|contains:
            - 'pasastesintag'
            - 'parastesintag' # Typosquat variant
    condition: keywords
falsepositives:
    - Legitimate access to the official portal (if IP range is known, whitelist it)
level: critical

---

title: Rundll32 Ordinal Execution over WebDAV
description: Detects rundll32 executing ordinal exports (#1) which is a common evasion technique in recent ClickFix campaigns.
status: experimental
date: 2026/07/31
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6763456789012345
tags:
    - attack.defense_evasion
    - attack.t1027
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        CommandLine|contains: ',#'
    condition: selection
falsepositives:
    - Legacy application installers
level: high

KQL (Microsoft Sentinel)

kql// Hunt for ClickFix WebDAV activity DeviceProcessEvents | where ProcessCommandLine contains "rundll32" | where ProcessCommandLine has_any ("http://", "https://", "\\") | where ProcessCommandLine contains ",#" | project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName | order by Timestamp desc

// Hunt for PasasteSinTAG Phishing domains DeviceNetworkEvents | where RemoteUrl has_any ("pasastesintag", "parastesintag") | project Timestamp, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessAccountName | order by Timestamp desc

PowerShell Hunt Script

powershell# Check DNS Cache for PasasteSinTAG domains $SuspiciousKeywords = @("pasastesintag", "parastesintag", "gentletouchchiropractic") $DnsCache = Get-DnsClientCache

$SuspiciousEntries = $DnsCache | Where-Object { $Name = $.Entry ($SuspiciousKeywords | Where-Object { $Name -like "*$*" }) -ne $null }

if ($SuspiciousEntries) { Write-Host "[!] Suspicious DNS Cache Entries Found:" -ForegroundColor Red $SuspiciousEntries | Format-Table Name, Type, Data, TimeToLive } else { Write-Host "[+] No suspicious DNS entries found." -ForegroundColor Green }

Check for recent rundll32 processes making network connections

$Rundll32Processes = Get-Process -Name "rundll32" -ErrorAction SilentlyContinue

if ($Rundll32Processes) { Write-Host "[*] Active rundll32 processes found. Checking network connections..." -ForegroundColor Yellow $Connections = Get-NetTCPConnection -OwningProcess ($Rundll32Processes.Id) -ErrorAction SilentlyContinue if ($Connections) { $Connections | ForEach-Object { $Process = Get-Process -Id $.OwningProcess [PSCustomObject]@{ ProcessName = $Process.ProcessName PID = $.OwningProcess LocalAddress = $.LocalAddress LocalPort = $.LocalPort RemoteAddress = $.RemoteAddress RemotePort = $.RemotePort State = $.State CommandLine = (Get-CimInstance Win32_Process -Filter "ProcessId = $($.OwningProcess)").CommandLine } } | Format-Table -AutoSize } }

Response Priorities

Immediate

• Block IOCs: Immediately block all listed domains and hostnames on proxy servers, firewalls, and DNS resolvers.
• Hunt for ClickFix: Search endpoints for the SHA256 hash f11057ab58bef936d98ba189829c64260a6a540cdaa046f93613138e820c98c6 and check for rundll32.exe processes with command line arguments containing https or ordinals.

24h

• Credential Audit: If activity is detected in the Chilean sector, initiate identity verification and password resets for users who may have interacted with the PasasteSinTAG phishing pages.
• WebDAV Inspection: Review web proxy logs for successful WebDAV (OPTIONS, PROPFIND) requests to external IPs on port 443 originating from non-standard user agents.

1 Week

• Application Hardening: Implement Application Control (AppLocker) or ASR rules to restrict rundll32.exe execution to signed libraries only and prevent it from accepting remote arguments (WebDAV/UNC).
• Email Filtering: Update secure email gateways to block emails containing links to the newly observed TLDs (.cyou, .top, .cfd, etc.) or containing the keyword "PasasteSinTAG" with slight misspellings.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub