Back to Intelligence

ShadowHVNC RAT Kit + Brevo Supply-Chain ClickFix Campaign: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
September 18, 2026
9 min read

Two distinct but operationally significant threat activities surfaced in OTX telemetry this cycle, both emblematic of how criminal tooling is industrializing in 2026.

Pulse 1 — ShadowHVNC and Shadow Loader: MalBear Labs published analysis of a commercial malware kit pairing Shadow Loader (a crypter/loader) with ShadowHVNC (a Hidden Virtual Network Computing remote access trojan). The kit is notable for its aggressive license-protection and anti-analysis armor — the operators invest more engineering effort into protecting their criminal IP than their customers invest in operational security. The loader decrypts and injects the HVNC payload into memory, establishing a covert interactive desktop session invisible to the legitimate user. Distribution is typical of the loader-as-a-service ecosystem: malspam, cracked software, and SEO-poisoned downloads.

Pulse 2 — Brevo Supply-Chain Compromise (SanSec research): On September 14, 2026, attackers compromised Brevo's (formerly Sendinblue) infrastructure and injected malicious code into JavaScript assets and widgets served from Brevo CDN infrastructure (observed staging host: cdn10.sendibt1.com). Over 100,000 customer websites were affected. The attack chain delivers two payloads:

  1. WordPress plugin backdoor — automatically installed when a logged-in site administrator browses their own compromised site, exploiting the admin's authenticated session and nonce-bearing requests to install a malicious plugin without consent.
  2. ClickFix overlays — fake CAPTCHA/browser-update prompts targeting regular visitors, tricking them into pasting attacker-supplied commands into a Run dialog or terminal, achieving user-assisted execution.

The collective picture: initial access is shifting away from exploit-heavy delivery toward abuse of trusted infrastructure (legitimate marketing/SaaS CDNs) and user-assisted execution (ClickFix), paired with commodity RAT kits (ShadowHVNC) that give operators hands-on-keyboard access through hidden sessions.

Threat Actor / Malware Profile

ShadowHVNC + Shadow Loader

  • Distribution: Loader-as-a-service model; delivered via phishing attachments, trojanized installers, and pay-per-install networks. Shadow Loader acts as stage-one, decrypting the ShadowHVNC payload from an embedded or downloaded blob.
  • Payload behavior: HVNC creates a hidden desktop session (Windows hidden desktops / CreateDesktop abuse) allowing full GUI interaction — browsing, banking sessions, file browsing — without any visual indicator to the logged-in victim. Commonly used for banking fraud, session hijacking, and manual data theft.
  • C2 communication: Typically TCP-based with a proprietary or TLS-wrapped protocol to operator-controlled infrastructure; loaders frequently use hardcoded fallback C2s and DGA-lite rotation.
  • Persistence: Run keys, scheduled tasks masquerading as system maintenance, or service installation depending on privilege level obtained by the loader.
  • Anti-analysis: The kit's defining trait — heavy packing, license-hardware binding, VM/sandbox checks (CPU core count, RAM, process blocklists for analysis tools), string encryption, and delayed execution. The license protection itself uses hardware fingerprinting that can be fingerprinted by defenders as a detection pivot.

Brevo Supply-Chain / ClickFix Operation

  • Distribution: Trusted-delivery abuse — poisoned Brevo JavaScript widgets embedded in 100k+ customer sites. No phishing email required; the victim arrives at a legitimate site.
  • Payload behavior (admin path): Malicious JS detects a WordPress admin session cookie, then issues authenticated REST/AJAX calls to upload and activate a backdoored plugin (wm.zip observed staging from the attacker CDN). The backdoor provides persistent webshell-style access independent of the CDN compromise.
  • Payload behavior (visitor path): ClickFix-style fake verification overlay instructing users to press Win+R and paste a clipboard-injected command — typically mshta, powershell -enc, or curl | bash — leading to stealer/RAT execution.
  • Persistence: Rogue WordPress plugin with hidden admin users and modified theme files; ClickFix payloads typically install Run-key persistence.
  • Anti-analysis: Domain rotation across lookalike CDN hostnames (cdn10.sendibt1.com mimics Brevo's legitimate sendibt* naming), conditional payload delivery (only to admins / only once per IP), and geofencing.

IOC Analysis

Indicator types present across both pulses:

  • File hashes (MD5/SHA1/SHA256) — 12+ hashes for Shadow Loader/ShadowHVNC samples and 5+ SHA256 hashes for the Brevo injected JS and backdoor plugin (wm.zip). SHA256 values should be priority-ingested into your EDR blocklists and retrohunted in VirusTotal/EDR telemetry; MD5/SHA1 remain useful for matching against threat intel platforms and sandbox reports.
  • Domains/hostnames — cdn10.sendibt1.com (payload staging), ecomscan.com (associated infrastructure). These should be blocked at DNS/proxy and retro-searched in DNS logs back to 2026-09-14. Note the typosquat-style mimicry of legitimate Brevo infrastructure — audit any sendibt* resolution that isn't a documented Brevo-owned domain.
  • URLs — https://cdn10.sendibt1.com/p/wm.zip is the backdoor plugin package. The full URL is high-fidelity; the /p/ path pattern is worth a proxy regex hunt across lookalike hosts.

Operationalization:

  • Ingest hashes into EDR (Defender custom indicators, CrowdStrike IOC management, SentinelOne blacklist) and run a 14-day retrohunt.
  • Add domains to DNS sinkhole/proxy deny lists; enable alerting (not just blocking) so any resolution attempt generates an investigation.
  • Feed IOCs into your TIP (MISP, OpenCTI, Anomali) with TLP:WHITE tagging for sharing.
  • Tooling for decoding: unpack Shadow Loader samples with sandbox detonation (ANY.RUN, Joe Sandbox, CAPE) to extract decrypted config/C2; deobfuscate ClickFix injected JS with jsbeautifier and extract the clipboard-injection routine and payload URLs; validate wm.zip contents statically before any dynamic analysis.

Detection Engineering

YAML
---
title: ShadowHVNC Hidden Desktop Session Creation
id: 5f1a9c2e-3b7d-4e8a-9c1f-2d6b8a4e7f01
status: experimental
description: Detects creation of hidden/virtual desktop objects commonly abused by HVNC malware (ShadowHVNC) to run invisible interactive sessions.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\explorer.exe'
      - '\rundll32.exe'
      - '\powershell.exe'
      - '\wscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'CreateDesktop'
      - '\\Sessions\\'
      - 'hidden_desktop'
  condition: all of selection_*
falsepositives:
  - Legitimate virtualization or kiosk software
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.t1219
date: 2026/09/18
---
title: Shadow Loader Process Injection Into Legitimate Process
id: 7c3e8b1a-4f2d-4a9c-8e5b-1d7a3c6f9b02
status: experimental
description: Detects suspicious access to remote process memory with allocation/write patterns consistent with Shadow Loader injecting ShadowHVNC payload.
author: Security Arsenal
logsource:
  category: process_access
  product: windows
detection:
  selection_access:
    GrantedAccess|contains:
      - '0x1F3FFF'
      - '0x143A'
      - '0x1FFFFF'
  selection_target:
    TargetImage|endswith:
      - '\svchost.exe'
      - '\explorer.exe'
      - '\dllhost.exe'
  filter_legit:
    SourceImage|startswith:
      - 'C:\\Windows\\System32\\'
      - 'C:\\Program Files\\'
  condition: all of selection_* and not filter_legit
falsepositives:
  - EDR and monitoring agents injecting sensors
level: high
tags:
  - attack.defense_evasion
  - attack.t1055
date: 2026/09/18
---
title: ClickFix User-Assisted Run Dialog Execution
id: 9b4d2f7c-1a8e-4c3b-a6d9-5e2f8b1c4d03
status: experimental
description: Detects mshta/powershell/curl launched via the Run dialog pattern used by ClickFix overlays from the Brevo supply-chain compromise.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_img:
    Image|endswith:
      - '\mshta.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\curl.exe'
      - '\wscript.exe'
      - '\rundll32.exe'
  selection_cmd:
    CommandLine|contains:
      - '-enc'
      - 'frombase64string'
      - 'https://'
      - 'http://'
  condition: all of selection_*
falsepositives:
  - Admin quick-launch of scripts
level: critical
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.001
date: 2026/09/18
KQL — Microsoft Sentinel / Defender
// Security Arsenal — Brevo supply-chain + ShadowHVNC hunt (14-day lookback)
let lookback = 14d;
let badHashes = dynamic([
  "e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690",
  "7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8",
  "26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca",
  "4af488d79aef7daa12b1c18f0cce28b7edadccb8b6b0fb8d50d1d53a9a7c2df7",
  "58a5c601c9df7ca2120435588fc39f97712d9b878795f6ee500590099a432308",
  "9b62c12bc5c7feb9802f58e6cf75a368690df3c754e37cc64483a92acacf87a5",
  "f67d572d2d30407b3f470904326411450763108980cdad89550fbb221fb06782"
]);
let badDomains = dynamic(["cdn10.sendibt1.com", "ecomscan.com"]);
let NetworkHits =
  DeviceNetworkEvents
  | where TimeGenerated > ago(lookback)
  | where RemoteUrl has_any (badDomains)
     or RemoteUrl contains "/p/wm.zip"
  | project TimeGenerated, DeviceName, InitiatingProcessFileName,
            InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let FileHits =
  DeviceFileEvents
  | where TimeGenerated > ago(lookback)
  | where SHA256 in~ (badHashes)
  | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256,
            InitiatingProcessCommandLine;
let ClickFixProc =
  DeviceProcessEvents
  | where TimeGenerated > ago(lookback)
  | where InitiatingProcessFileName =~ "explorer.exe"
  | where FileName in~ ("mshta.exe","powershell.exe","pwsh.exe","curl.exe","wscript.exe")
  | where ProcessCommandLine has_any ("-enc","frombase64string","http")
  | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName;
union NetworkHits, FileHits, ClickFixProc
| sort by TimeGenerated desc
PowerShell
# Security Arsenal — ShadowHVNC + Brevo/ClickFix IOC Hunt
# Run elevated on suspect endpoints; outputs CSV findings.

$findings = @()

# 1. Shadow Loader / ShadowHVNC file hash sweep (common staging dirs)
$targetHashes = @(
  'e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690',
  '7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8',
  '26166cd87ff07e7a50317a24126d14b262e842c5715585636dee3ab3f227ddca'
)
$searchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public")
foreach ($path in $searchPaths) {
  Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $_.Length -lt 50MB } | ForEach-Object {
      $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
      if ($targetHashes -contains $h.ToLower()) {
        $findings += [pscustomobject]@{Type='HashMatch'; Path=$_.FullName; Detail=$h}
      }
    }
}

# 2. Persistence: Run keys with suspicious value paths
$runKeys = @(
  'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
  'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($key in $runKeys) {
  if (Test-Path $key) {
    (Get-Item $key).GetValueNames() | ForEach-Object {
      $v = (Get-ItemProperty -Path $key -Name $_).$_
      if ($v -match 'Temp|AppData|Public|\.ps1|mshta|powershell.*-enc') {
        $findings += [pscustomobject]@{Type='RunKey'; Path="$key\$_"; Detail=$v}
      }
    }
  }
}

# 3. Scheduled tasks masquerading as maintenance (ShadowHVNC persistence)
Get-ScheduledTask | Where-Object {
  $_.TaskName -match 'Maint|Update|Sync|Cleanup' -and
  $_.Actions.Execute -match 'powershell|wscript|mshta|rundll32'
} | ForEach-Object {
  $findings += [pscustomobject]@{Type='ScheduledTask'; Path=$_.TaskName; Detail=$_.Actions.Execute}
}

# 4. Active/historical connections to Brevo attack infrastructure
$badHosts = @('cdn10.sendibt1.com','ecomscan.com')
foreach ($host_ in $badHosts) {
  $r = Resolve-DnsName $host_ -ErrorAction SilentlyContinue
  if ($r) { $findings += [pscustomobject]@{Type='DNSResolution'; Path=$host_; Detail=($r.IPAddress -join ',')} }
}
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
  ForEach-Object {
    $rdns = (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
    if ($badHosts -contains $rdns) {
      $findings += [pscustomobject]@{Type='ActiveC2'; Path=$_.RemoteAddress; Detail="PID $($_.OwningProcess) -> $rdns"}
    }
  }

# 5. ClickFix artifact: recent RunMRU entries (user pasted commands)
$mruPath = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU'
if (Test-Path $mruPath) {
  (Get-Item $mruPath).GetValueNames() | Where-Object { $_ -ne 'MRUList' } | ForEach-Object {
    $cmd = (Get-ItemProperty -Path $mruPath -Name $_).$_
    if ($cmd -match 'mshta|powershell|curl|http') {
      $findings += [pscustomobject]@{Type='RunMRU'; Path="Entry $_"; Detail=$cmd}
    }
  }
}

$findings | Format-Table -AutoSize
$findings | Export-Csv -Path ".\otx_hunt_findings_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($findings.Count) finding(s)."

Response Priorities

Immediate (0–4 hours):

  • Block cdn10.sendibt1.com and ecomscan.com at DNS, proxy, and EDR network layers; alert on any resolution attempt.
  • Push all SHA256/MD5/SHA1 hashes from both pulses into EDR blocklists; run retrohunts back to 2026-09-14.
  • If your organization uses Brevo/Sendinblue web widgets or plugins, immediately audit all sites embedding Brevo JS and check for unauthorized WordPress plugin installs since September 14.
  • Deploy the ClickFix Run-dialog Sigma rule — user-assisted execution is the fastest-moving payload path.

24 hours:

  • ShadowHVNC enables full hidden interactive sessions — treat any host with a hash or network hit as fully compromised, including any credentials typed or sessions active on it. Force password resets and session revocation for affected users, prioritizing banking, SSO, and privileged accounts.
  • Audit WordPress admin accounts for rogue administrators and review wp-content/plugins/ against known-good baselines; check for modified theme files and unknown API keys.
  • Review RunMRU and PowerShell history on endpoints belonging to users who browsed sites embedding Brevo widgets.

1 week:

  • Implement a third-party script governance policy: inventory all externally loaded JS (Brevo and otherwise), apply Subresource Integrity (SRI) where feasible, and deploy Content Security Policy with strict script-src to contain future CDN poisoning.
  • Harden WordPress: disable plugin installation via the dashboard for routine admin accounts, enforce 2FA, and restrict DISALLOW_FILE_MODS on production sites.
  • Roll out ClickFix awareness guidance — no legitimate website ever requires users to paste commands into a Run dialog — and consider AppLocker/WDAC rules blocking mshta.exe and unsigned script hosts for standard users.
  • Add HVNC behavioral detections (hidden desktop creation, unexplained CreateDesktop/session activity) to your standard detection library, as HVNC kits are proliferating across the loader ecosystem.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-malwareshadow-hvncshadow-loaderclickfixsupply-chain-attackwordpress-backdoor

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action