CornFlake RAT Execution via ClickFix: Correlated Browser→Shell→Update Binary→C2 Chain

Duo Tech@duotech

•updated Aug 5, 2026•3•0•13

Detects the CaptiveCrunch ClickFix execution chain where a browser or Explorer process spawns a command interpreter that launches an unsigned or non-standard-vendor 'update'-named binary from a Temp/Downloads path, which then establishes a network connection (C2) within 5 minutes of process start.