From ClickFix to Crypto Theft: Inside a Tor-Routed, Multi-Module Windows Crimeware Kit

Written by Constantinos Patsakis, Athena Research Center

A layered PyInstaller/PyArmor payload turns a social-engineering foothold into a persistent stealer with clipboard hijacking, wallet-secret theft, screenshot exfiltration, remote code execution, and WordPress password guessing capabilities.

Bottom line

The ClickFix lure is only the opening move. Once executed, the sample establishes redundant persistence, launches its own Tor proxy, profiles the host for cryptocurrency exposure, and activates two distinct JScript modules, one that steals cryptocurrency-related data and hijacks payments; the other attacks remote WordPress sites. A C2-controlled EVAL channel also gives the operator arbitrary code execution in the context of the current user.

ClickFix campaigns abuse a familiar troubleshooting pattern, the victim is tricked into pasting and running a command presented as a fix, verification step, or prerequisite. This interaction bypasses the usual “download and open” mental warning. In this case, the technique delivers a payload whose apparent native Windows code is largely a decoy layer. The actual behavior is inside an encrypted Python entry point and a second obfuscated bundle.

The result is not a single-purpose clipper. It is a compact crimeware platform with victim qualification, persistence, a private communications layer, theft capabilities, remote execution, and an unrelated WordPress attack module.

Key findings

• The installer seeks UAC elevation, adds Microsoft Defender exclusions, hides its staging directory, and writes payloads beneath C:\Users\Public\Videos\.
• Run-key and Scheduled Task mechanisms provide redundant persistence; the task is configured to run JScript every minute for approximately 11.4 years.
• A bundled Tor 0.4.8.12 client is launched as a local SOCKS5 proxy on localhost:9050 and carries nearly all command-and-control traffic.
• The crypto module profiles installed wallets and browser extensions, replaces copied wallet addresses, steals BIP39 seed phrases and private keys, and captures five screenshots after a secret is detected.
• A separate module enumerates WordPress usernames and attempts XML-RPC password guessing with as many as 40 workers.
• An EVAL-prefixed C2 response is passed to JScript eval(), enabling arbitrary operator-supplied code execution.
• The one deliberate clearnet exception—an ipinfo.io/country request—creates a useful detection opportunity.

The delivery mechanism and the binary’s internal behavior are best understood as a single sequence. ClickFix ensures the human-assisted execution. The payload then moves quickly from staging to persistence and launches two independent operational branches.

Initial native-code inspection produced an intentionally boring result, the PE entry point and the highest-complexity native functions were standard Microsoft C runtime and PyInstaller bootstrap boilerplate. However, this redirected the analysis toward the appended PyInstaller archive, where 63 files were extracted, including CPython 3.13, a PyArmor runtime, installer.pyc, and the data_p002 directory.

Offline recovery reproduced the PyArmor AES-GCM key derivation and decrypted the protected body. Thirty-nine code objects were recovered structurally. While post-entry bytecode remained armored, names, constants, and configuration were sufficient to confirm the installer’s orchestration, including privilege elevation, Defender exclusions, XOR decoding, staging, persistence, host profiling, and payload launch.

One key, one coherent payload bundle

Every file under data_p002 was recovered with the same repeating XOR key. The shared key links the artifacts as one builder-produced bundle rather than unrelated artifacts.

Before activating the theft modules, the installer tries to determine whether the victim appears valuable. Its get_crypto_user routine searches for desktop wallets including Electrum, Exodus, Ledger Live, Trezor Suite, Monero, Atomic, and others. It also examines Chrome, Brave, and Edge profiles for roughly 65 known wallet-extension identifiers. The results are written to crypto.inf and included in subsequent beacons.

This is narrower than a conventional browser stealer. The recovered sample does not seem to contain a built-in collector for saved browser passwords or cookies. Yet, the operator could deliver additional code through the EVAL channel, but that possibility should not be confused with capability present in the analyzed files.

Persistence and defense evasion

• Requests elevation through ShellExecuteW with the runas verb.
• Adds Microsoft Defender path and process exclusions through PowerShell.
• Stages files beneath C:\Users\Public\Videos\\.
• Sets FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM on the staging directory.
• Adds an HKLM Run-key command that starts WScript.
• Creates a Scheduled Task from 002.xml with a one-minute interval and PT99998H58M duration.

The main JScript payload scans the clipboard every half-second. It recognizes several cryptocurrency address formats and silently substitutes a visually similar address from the bundled replacement pool. This creates a dangerous failure mode, the victim sees a plausible-looking destination after pasting, but the transaction is redirected to an attacker-controlled wallet.
The same module looks for 12- and 24-word BIP39 phrases and several private-key formats, including raw, WIF, and BIP32 material. It can accumulate a phrase across separate clipboard events. When it captures a seed or key, it takes five full-desktop screenshots at five-second intervals and uploads both the secret and images over Tor.

Impact

Any cryptocurrency address, seed phrase, or private key copied on an infected host during the exposure window should be treated as compromised. Visual comparison of the first and last characters of a pasted address is not a reliable safeguard against a lookalike pool of this size.

The payload launches uusd.exe, a genuine Tor client, and supervises it as a local SOCKS5 service on port 9050. Beaconing, command polling, screenshot upload, wallet-secret exfiltration, address-pool refreshes, and WordPress worker status all use .onion services through this proxy.

The exception is the installer’s country lookup, it performs a request to https://ipinfo.io/country directly over clearnet to geolocate the victim.

Remote code execution through EVAL

One C2 path interprets a response whose first line is EVAL and passes the remaining body directly to JScript eval(). This gives the operator arbitrary code execution with the privileges of the WScript process. The channel expands the post-compromise risk, even though no live command response was observed during analysis.

The 002_b.js module is operationally separate from the crypto theft. It retrieves usernames exposed by the WordPress REST API, generates guesses derived from the target’s domain, or accepts an operator-supplied list, then tests credentials through XML-RPC metaWeblog.newPost. The worker can run up to 40 concurrent processes and reports status to a third onion endpoint.

This behavior does not prove that WordPress credentials were stolen from the infected Windows host. Instead, the victim’s machine is used as infrastructure for attacks against operator-selected websites.

The most useful detections combine artifacts across layers. A single PyInstaller or Tor signal is too broad; the staging path, WScript persistence, unusual task duration, wallet-profile files, and local SOCKS activity form a much stronger behavioral cluster.

Yara rule

Selected MITRE ATT&CK mapping

• Treat execution as a confirmed compromise. Isolate the host and preserve relevant triage data before remediation.
• Terminate malicious WScript and uusd.exe processes; remove the matching Run key, Scheduled Task, Defender exclusions, and staged files.
• Assume copied wallet addresses, seed phrases, and private keys were exposed. Move funds using a clean device and regenerate affected wallets where appropriate.
• Rotate credentials used on the host according to incident-response policy because screenshots and arbitrary code execution broaden exposure beyond the built-in collectors.
• Review sites you operate for WordPress REST username exposure and XML-RPC abuse, but do not misstate the module as local WordPress credential theft.
• Hunt across the environment for the behavioral cluster, not only the exact sample hash; builder-generated variants may change hashes and names.

This sample illustrates why ClickFix deserves to be treated as more than a delivery trick. The social-engineering step creates an execution path that feels user-authorized; the malware then uses commodity components and layered obfuscation to build something much more durable. By the time the victim has been lured to run the fix/verification, the host may be persisting JScript every minute, proxying traffic through Tor, qualifying the victim for cryptocurrency exposure, intercepting wallet data, taking screenshots, attacking third-party websites, and waiting to execute arbitrary commands.

Train your users not to click and trust remote content. Hunt your networks for abnormal traffic. Make your blue teams quickly identify potential malicious behaviour, even when it comes from your own network. Why would a typical user of your network suddenly use Tor? Monitor scheduled tasks per host, block access to sites, and always provide the least privileges.