Since early January 2025, threat actors have been using the ClickFix technique to spread the NetSupport RAT remote access trojan. An updated version of the Lumma Stealer malware that uses the ChaCha20 cipher to decrypt a configuration file containing the list of command-and-control (C2) servers is also being spread via the ClickFix method. According to an analysis of the attack chains, "These changes provide insight into the evasive tactics employed by the developer(s) who are actively working to circumvent current extraction and analysis tools," eSentire stated.
The development coincides with the threat actors' use of the Click fix method to spread a Lumma stealer version that encrypts a Configuration file with a list of C2 servers using a different cipher.