Do Son 
A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an evolving TAG-150 attack chain. Security researchers from eSentire Threat Response Unit (TRU) disrupted this operation in June 2026. Industry observations confirm that threat actors modify their payloads repeatedly to evade detection. The attackers used this chain to deploy DenoRAT malware and NightshadeC2. Consequently, security teams must understand these new tactics to protect their networks.
At a Glance
- Malware Family: DinDoor, DenoRAT, NightshadeC2
- Threat Actor: TAG-150 (Confirmed)
- Target or Victims: Finance sector
- Delivery Vector: ClickFix social engineering, Windows Run prompt, MSI installer
- Key Capabilities: Deno runtime abuse, Python-based reflective PE loading, App-Bound Encryption bypass
- Source: eSentire TRU
TL;DR
The latest TAG-150 attack chain tricks users into running malicious commands via a ClickFix lure. This action installs the Deno runtime to execute DinDoor and DenoRAT malware. Finally, the attackers deploy NightshadeC2 to steal credentials and browser data.
Delivery
The attack begins with a ClickFix-style social engineering lure. Specifically, the attackers trick a victim into executing a command via the Windows Run prompt. This command downloads and runs a Microsoft Installer (MSI) file. Then, the MSI file writes and executes a Windows batch file. This batch file launches an artificial intelligence-generated PowerShell script named Griffin20.ps1. The report states, “In June 2026, eSentire’s Threat Response Unit (TRU) disrupted a malicious ClickFix-style command in a Finance customer’s environment.”
The attackers designed this script to ensure the victim’s system meets their specific requirements. It explicitly targets the user’s Scoop shims directory to bypass standard network restrictions. The Griffin20.ps1 script plays a critical role in the deployment phase. First, it sets the local PowerShell execution policy to RemoteSigned. Next, it checks for the Deno runtime environment on the host machine. If Deno is missing, the script installs it using Windows package managers like Winget or Scoop. Finally, the script executes Deno with full permissions to fetch a remote JavaScript file. This JavaScript file acts as the primary DinDoor stager.
Infection Chain
DinDoor operates as a tiny, continuous evaluation loop. It reaches out to a command-and-control server to fetch a secondary malware stager. This secondary stager establishes persistence by creating a new registry value in the CurrentVersion Run key. Furthermore, it registers the compromised host with the server using a JSON Web Token.
After establishing persistence, the stager retrieves the main DenoRAT malware payload. DenoRAT is a remote access trojan written entirely in Deno-JavaScript. It utilizes DenoForeign Function Interface to call native Windows APIs. Consequently, this capability allows the malware to perform low-level system operations directly. The attackers use Obfuscator.io to hide the secondary stager code. This obfuscation greatly complicates the analysis process for incident responders.
Next, DenoRAT retrieves executable tasks from the command server. One specific task includes a secondary PowerShell script. This script downloads a Python archive and a reflective PE loader. Ultimately, this Python loader decrypts and runs NightshadeC2 directly in memory. NightshadeC2 acts as a fully featured information stealer. It decrypts container files using an AES-256 key derived from the hardcoded phrase “MoscauHighSmoke”.
Command-and-Control and Data-Exfiltration Behaviour
DenoRAT communicates with its command-and-control server using regular HTTP polling. The malware registers the victim host using specific JSON Web Tokens. These tokens contain unique campaign identifiers for attacker tracking purposes. Once registered, the malware requests new tasks from the central server.
The server assigns various destructive tasks to the infected machine. For instance, the “sysinfo” task gathers extensive system details. The malware collects the username, hostname, installed anti-virus software, and hardware configurations. Then, it sends this data back to the server via a POST request.
Moreover, the “stealer” task targets specific sensitive user data. It extracts information from Chromium and Gecko-based web browsers. The malware specifically targets cryptocurrency wallets, password managers, and multi-factor authenticators. It searches for popular extensions like MetaMask, Bitwarden, and Google Authenticator. Additionally, DenoRAT can capture live screenshots of the victim’s desktop. It transmits these images as base64-encoded strings to the server.
To steal browser data, DenoRAT attempts to bypass App-Bound Encryption mechanisms. It achieves this by injecting a malicious DLL into active Chromium browser processes. However, the malware actively checks for specific anti-virus products first. If it detects ESET software, it aborts the DLL injection routine entirely.
Defense or Detection Guidance
Security defenders must monitor their environments for unexpected Deno runtime installations. Network administrators should restrict the execution of unauthorized MSI files. Additionally, organizations must train employees to recognize ClickFix social engineering tactics. Users should never paste unknown commands into the Windows Run prompt.
Security tools should flag anomalous PowerShell executions immediately. Specifically, defenders should look for scripts that attempt to modify local execution policies. Monitoring the Windows registry for unauthorized changes to the Run key remains vital.
Analysts should hunt for unusual network connections to unrecognized external domains. Furthermore, reviewing system logs for unexpected process hollowing or DLL injection is critical. Security teams must ensure their endpoint anti-virus solutions remain active and fully updated.
Finally, organizations can block known malicious indicators of compromise at the firewall level. Threat intelligence platforms provide valuable data to enhance overall network defenses. Implementing these proactive strategies will reduce the risk of a successful intrusion. Cybercriminals continue to innovate their attack strategies to bypass modern security controls. By understanding the TAG-150 attack chain, security teams can better defend their infrastructure.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
