ClickFix is no longer just a clever help-desk impersonation trick. In the latest TAG-150 activity documented by eSentire’s Threat Response Unit, the social engineering step was only the front door. Once the victim ran the command, the intrusion chain used legitimate installation paths, the Deno JavaScript runtime, DenoRAT, and NightshadeC2 to move toward credential theft and remote control.

For small businesses and government contractors, the practical takeaway is simple: if your controls only look for obviously malicious files, you are going to miss attacker workflows that assemble themselves from trusted tools after the user is convinced to run the first command.

What eSentire Reported

According to eSentire TRU’s analysis, the observed TAG-150 chain began with a ClickFix-style lure that pushed a malicious command through the Windows Run prompt. That command downloaded and executed an MSI installer, which then launched a PowerShell stage named Griffin20.ps1.

The PowerShell stage checked for the Deno runtime, attempted to install it through common Windows package-management paths, and then used Deno with broad permissions to fetch and execute the next stage. From there, the chain moved through DinDoor, DenoRAT, and eventually NightshadeC2.

The important defensive detail is not just the malware family name. It is the pattern: social engineering plus package managers plus runtime abuse plus browser/session theft. That combination can slip through environments that treat developer runtimes, MSI execution, and user-launched PowerShell as normal background noise.

Why This Matters

DenoRAT is notable because it abuses a legitimate runtime to perform malicious work. eSentire described DenoRAT as a Deno-JavaScript remote access trojan with capabilities for command execution, system profiling, screenshot capture, file operations, browser-data theft, and potential App-Bound Encryption bypass support through DLL injection.

That matters because many organizations have spent years building detections around older patterns: suspicious EXEs, classic PowerShell download cradles, Office macros, or commodity loader names. TAG-150’s chain shows how attackers can instead make the victim install the runtime they need, then execute attacker-controlled JavaScript inside that runtime.

For finance, professional services, healthcare, defense suppliers, and other regulated SMB environments, this is a high-signal warning. Browser credentials, password-manager extensions, crypto wallets, MFA artifacts, Discord tokens, Telegram data, and session material are now common targets because they help attackers move from one endpoint compromise into cloud, SaaS, and financial systems.

Defensive Takeaways

  • Detect ClickFix behavior, not just known payloads. Train users not to paste commands into Run, PowerShell, Terminal, or browser consoles. Back that training with alerting for unusual Win+R-style command execution, hidden PowerShell, and user-driven MSI launch chains.
  • Control runtime installation. Deno, Node.js, Python, Go, and package managers are not inherently bad, but surprise installation on finance, admin, or non-developer endpoints should be rare. Alert on newly installed runtimes outside approved developer groups.
  • Watch Winget and Scoop usage. The reported chain attempted to use Windows package-management paths to install prerequisites. That is useful telemetry for distinguishing normal software deployment from attacker setup activity.
  • Monitor PowerShell policy changes. Scripts that modify execution policy, run hidden, alter PATH, or pull remote scripts deserve triage even when no known malware hash is present.
  • Hunt for Deno execution with broad permissions. Deno commands using unrestricted permissions, remote script URLs, or unusual working directories should be treated as suspicious on managed endpoints.
  • Protect browser/session data as crown jewels. App-Bound Encryption bypass attempts, browser process injection, password-manager extension access, and token theft are often the bridge from endpoint compromise to business impact.

Bulwark Black Assessment

This is the kind of intrusion pattern that punishes “default allow” endpoint environments. A user can be socially engineered into starting the chain, a legitimate installer can prepare the environment, and a legitimate runtime can execute the malware logic. By the time a named RAT appears, the attacker may already have persistence, host inventory, and access to browser-stored secrets.

The fix is not one magic blocklist. The fix is layered control: application allowlisting where possible, EDR detections for suspicious command chains, package-manager monitoring, least-privilege endpoint design, and rapid isolation when browser credential theft is suspected.

For SMBs and government contractors, the best near-term move is to build a short detection package around three events: users running copied commands, unexpected runtime installation, and browser credential-access behavior. That gives defenders a fighting chance before ClickFix becomes full account takeover.

Source: eSentire TRU — DinDoor, DenoRAT, and NightshadeC2: Analyzing TAG-150’s Evolving Tradecraft. Feedly context also surfaced related reporting from SecurityOnline.