ClickFix ModeloRAT Persistence Artifacts

Ethan Andrews@eandrews

•updated Feb 16, 2026•13•0•176

Detects the creation of specific persistence artifacts (a VBScript file and a startup shortcut) associated with the ModeloRAT payload delivered by recent ClickFix campaigns. Specifically, it looks for a VBScript file at '\WPy64-31401\python\script.vbs' or a shortcut file named 'MonitoringService.lnk' in a user's startup folder.