A live AlienVault OTX pulse authored by the AlienVault research team documents a coordinated ClickFix campaign cluster attributed to Vanilla Tempest (the financially motivated threat actor also tracked by Microsoft for its prolific ransomware-adjacent intrusion activity). The pulse, derived from Field Effect's analysis of recent ClickFix operations, identifies multiple concurrent campaigns sharing a common operational backbone while employing three distinct delivery mechanisms.

ClickFix is a social engineering technique that has exploded in prevalence through 2025-2026: victims browsing compromised or adversary-controlled websites are presented with fake error dialogs, CAPTCHA challenges, or "document loading" prompts that instruct them to copy and paste a malicious command — typically into the Windows Run dialog or a terminal — effectively social-engineering the victim into executing the payload themselves. This bypasses traditional email gateway and attachment-based detection entirely.

The campaigns documented in this pulse share a consistent tradecraft signature:

1. Remotely hosted MSI packages containing legitimate software bundled with malicious DLLs — the classic sideloading pattern where a signed, trusted binary loads an attacker-controlled library.
2. NodeJS-based execution — JavaScript payloads executed through Node.js runtime installed or staged on the victim host, enabling the Supper backdoor family.
3. Dead drop resolvers (DDRs) for command-and-control — rather than hardcoding C2 infrastructure in the malware, Vanilla Tempest hosts encoded C2 addresses on legitimate third-party services (paste sites, cloud storage, social media profiles), forcing the implant to fetch and decode its true C2 at runtime. This dramatically extends infrastructure lifespan and defeats static IOC blocking.

Consistent file-naming conventions across all three delivery mechanisms confirm a single development pipeline. The objective appears to be persistent access broker-style compromise: Supper provides remote access and reconnaissance capability, typically a precursor to ransomware deployment or access resale — consistent with Vanilla Tempest's historical monetization model.

Threat Actor / Malware Profile

Vanilla Tempest

Vanilla Tempest (previously tracked as DEV-0832) is a financially motivated intrusion group known for deploying multiple ransomware families and operating as an initial access provider. Their adoption of ClickFix lures represents a shift toward delivery mechanisms that evade email and exploit-based detection, relying instead on user-assisted execution.

Supper Backdoor

• Distribution: ClickFix lure pages instructing victims to execute staged commands; delivered via NodeJS scripts and MSI-bundled sideloaded DLLs.
• Payload behavior: Remote access backdoor with host reconnaissance, command execution, and staging capability for follow-on payloads. The NodeJS variant executes attacker-controlled JavaScript, enabling fileless-ish operation through a legitimate runtime.
• C2 communication: Uses dead drop resolvers — the implant queries legitimate web services to retrieve encoded C2 addresses, then establishes beaconing to the resolved infrastructure (including the domains in the IOC set below).
• Persistence: Achieved via installed MSI artifacts and NodeJS service/scheduled execution patterns; sideloaded DLLs persist alongside their legitimate host application.
• Anti-analysis: DLL sideloading into signed binaries evades application allowlisting and reputation checks. Dead drop resolution defeats sandbox network analysis (sandboxes see only traffic to legitimate DDR services). The placeholder "Lorem Ipsum" family tagging reflects internal/staging tooling and filler artifacts used during campaign development.

Attack Chain

1. Victim lands on ClickFix lure (fake CAPTCHA / document error page — note the lure-themed domains editdocumentfree.com, opendocumentonline.com).
2. Victim pastes attacker command into Run dialog → stages MSI or NodeJS payload.
3. Legitimate signed binary sideloads malicious DLL, or NodeJS executes JavaScript stager.
4. Implant resolves C2 via dead drop resolver.
5. Supper backdoor establishes persistence and beaconing; operator conducts reconnaissance and prepares follow-on payloads.

IOC Analysis

The pulse contains 20 indicators, with two primary operational types:

Domains (5): editdocumentfree.com, opendocumentonline.com, newpopularimages.com, cloudbreachdetection.com, cooldogshistory.com

• The naming conventions are telling: document-themed domains are consistent with ClickFix lure infrastructure (fake document viewers/editors), while cloudbreachdetection.com mimics security vendor branding — a classic social-engineering credibility play. newpopularimages.com and cooldogshistory.com fit the dead-drop/content-hosting resolver pattern.
• SOC action: Block at DNS sinkhole, secure web gateway, and email gateway. Retrospectively search DNS and proxy logs for 90 days.

FileHash-SHA256 (3 shown, 20 total indicators in pulse):

• Hashes correspond to the malicious DLLs, MSI packages, and NodeJS stagers across the three campaign variants.
• SOC action: Push to EDR blocklists. Because DLL sideloading means hashes change with each campaign build, do not rely on hashes alone — pair hash blocking with the behavioral detections below (sideloading parent-child relationships, unsigned DLL loads in legitimate application paths).

Tooling: Ingest the full pulse via the OTX DirectConnect API or your TIP (OpenCTI, MISP, ThreatQuotient). YARA scanning against historical binaries and Sysmon Event ID 7 (Image Load) telemetry will surface sideloaded DLLs even when hashes drift.

Detection Engineering

---
title: ClickFix Lure Execution - Run Dialog Paste Command Staging
id: 7a1b2c3d-4e5f-4a6b-8c9d-clickfix00101
status: experimental
description: Detects child processes spawned from explorer.exe or Run dialog usage patterns consistent with ClickFix social engineering, where victims paste malicious commands (curl/mshta/powershell retrieving remote MSI or JS payloads)
author: Security Arsenal Threat Intelligence
references:
  - https://otx.alienvault.com/pulse/clickfix-cluster-vanilla-tempest
  - https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns
date: 2026/08/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_img:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\node.exe'
      - '\msiexec.exe'
      - '\wscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http'
      - '.msi'
      - '.js'
      - 'Invoke-'
      - 'iwr'
      - 'iex'
  condition: selection_parent and selection_img and selection_cmd
falsepositives:
  - Legitimate software installation by users
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059
level: high
---
title: Vanilla Tempest DLL Sideloading - Unsigned DLL Loaded By Signed Binary
id: 7a1b2c3d-4e5f-4a6b-8c9d-sideload00202
status: experimental
description: Detects unsigned DLLs loaded from non-standard locations by signed executables, consistent with the Vanilla Tempest MSI-bundled DLL sideloading technique observed in ClickFix campaigns delivering Supper
author: Security Arsenal Threat Intelligence
references:
  - https://otx.alienvault.com/pulse/clickfix-cluster-vanilla-tempest
  - https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns
date: 2026/08/25
logsource:
  category: image_load
  product: windows
detection:
  selection_signed_host:
    Signed: 'true'
  selection_dll:
    ImageLoaded|endswith: '.dll'
  filter_paths:
    ImageLoaded|contains:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_signed_host and selection_dll and not filter_paths
falsepositives:
  - Legitimate applications loading DLLs from application data directories
level: medium
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.persistence
---
title: NodeJS Suspicious Script Execution - Supper Backdoor Staging
id: 7a1b2c3d-4e5f-4a6b-8c9d-nodejs00303
status: experimental
description: Detects NodeJS runtime executing JavaScript files from user-writable or temporary directories with network-related arguments, matching the Supper backdoor delivery mechanism attributed to Vanilla Tempest
author: Security Arsenal Threat Intelligence
references:
  - https://otx.alienvault.com/pulse/clickfix-cluster-vanilla-tempest
  - https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns
date: 2026/08/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\node.exe'
      - '\nodejs.exe'
  selection_paths:
    CommandLine|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Public\'
      - '\Downloads\'
      - '.js'
  condition: selection_img and selection_paths
falsepositives:
  - Developers running local NodeJS tooling
  - Electron-based applications
level: high
tags:
  - attack.execution
  - attack.t1059.007

// Vanilla Tempest ClickFix Cluster Hunt - C2 & Staging Behavior
let clickfix_domains = dynamic(["editdocumentfree.com","opendocumentonline.com","newpopularimages.com","cloudbreachdetection.com","cooldogshistory.com"]);
let network_hits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in~ (clickfix_domains)
| project NetworkTime=TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, DeviceId;
let staging_behavior = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FileName in~ ("node.exe","nodejs.exe") and ProcessCommandLine has_any ("AppData","Temp","Public") and ProcessCommandLine endswith ".js")
     or (FileName =~ "msiexec.exe" and ProcessCommandLine has "http")
     or (InitiatingProcessFileName =~ "explorer.exe" and FileName in~ ("powershell.exe","cmd.exe","curl.exe","mshta.exe") and ProcessCommandLine has "http")
| project StagingTime=TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, DeviceId;
union network_hits, staging_behavior
| order by DeviceId

# Vanilla Tempest / Supper ClickFix Hunt Script - Run on endpoints via RMM/Intune
$domains = @("editdocumentfree.com","opendocumentonline.com","newpopularimages.com","cloudbreachdetection.com","cooldogshistory.com")
Write-Host "=== [1] DNS Cache Check for ClickFix C2 Domains ===" -ForegroundColor Cyan
Get-DnsClientCache | Where-Object { $entry = $_; $domains | ForEach-Object { $entry.Entry -like "*$_*" } } | Format-Table Entry, Data, TimeToLive -AutoSize

Write-Host "=== [2] Established Network Connections (NodeJS/MSI/Sideloaded hosts) ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($p.Name -match "node|msiexec|rundll32|powershell") {
        [PSCustomObject]@{ Process=$p.Name; PID=$_.OwningProcess; RemoteIP=$_.RemoteAddress; RemotePort=$_.RemotePort; Path=$p.Path }
    }
} | Format-Table -AutoSize

Write-Host "=== [3] Suspicious JS/MSI Artifacts in User-Writable Paths ===" -ForegroundColor Cyan
$paths = @("$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA","C:\Users\Public")
foreach ($path in $paths) {
    Get-ChildItem -Path $path -Recurse -Include *.js,*.msi,*.dll -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
        Select-Object FullName, Length, LastWriteTime
}

Write-Host "=== [4] Scheduled Tasks Referencing Node/JS (Supper Persistence) ===" -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match "node|wscript|msiexec" -or $_.Actions.Arguments -match "\.js|\.msi" } | Format-Table TaskName, TaskPath, State -AutoSize

Write-Host "=== [5] Recent Run Dialog / RunMRU Evidence (ClickFix Paste Execution) ===" -ForegroundColor Cyan
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue | Format-List

Response Priorities

Immediate (0-4 hours):

• Block all five IOC domains at DNS, proxy, and email gateway; push the SHA256 hashes to EDR blocklists.
• Run the KQL query across the last 30 days of DeviceNetworkEvents and DeviceProcessEvents for C2 contact and ClickFix staging behavior.
• Deploy the Sigma rules — particularly the Run-dialog staging and DLL sideloading rules — to your SIEM.
• Isolate any host with confirmed connections to the C2 domains.

24 Hours:

• While Supper is primarily an access backdoor rather than a dedicated credential stealer, Vanilla Tempest intrusions historically progress to data theft and ransomware staging — treat any confirmed infection as a full identity compromise. Force password resets and revoke tokens/sessions for all users on affected endpoints.
• Audit RunMRU and PowerShell logs on exposed endpoints for evidence of victim-executed paste commands.
• Check for follow-on payload staging: unusual RDP, new local accounts, or lateral movement from patient zero.

1 Week:

• Deploy application control (WDAC/AppLocker) restricting NodeJS execution to approved developer paths and blocking MSI installation from non-standard locations.
• Implement browser-level controls or user awareness targeting ClickFix lures — train users that no legitimate site will ever ask them to paste commands into the Run dialog.
• Restrict outbound traffic from user endpoints to paste/content-hosting services commonly abused as dead drop resolvers, or deploy TLS inspection with DDR-pattern alerting.
• Hunt broadly for DLL sideloading across the fleet using Sysmon ImageLoad telemetry, since Vanilla Tempest's hash rotation makes signature blocking insufficient alone.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub