Executive Summary
Akamai researchers have identified StrikeStub, a full-featured modular Remote Access Trojan (RAT) and stealer likely distributed as Malware-as-a-Service (MaaS). The malware is delivered via 'ClickFix' campaigns, where compromised websites (e.g., spiraldirect[.]ch) trick victims into manually executing obfuscated PowerShell commands. StrikeStub bears architectural similarities to commercial kits like DcRat and AsyncRAT, suggesting it is a refined builder product.
Technically, the malware employs extensive compile-time XOR encryption for strings and masquerades as legitimate Windows processes like RuntimeBroker.exe and WindowsUpdate.exe. It establishes a C2 channel over WebSockets using a specific enrollment challenge handshake. Its modular design allows operators to toggle features such as Hidden VNC (HVNC), keylogging, webcam capture, and browser credential theft using DPAPI and profile cloning to bypass file locks.
The use of highly deceptive social engineering coupled with modular espionage capabilities makes StrikeStub a significant threat to enterprise environments. Its ability to capture live screens, monitor clipboards, and steal browser data directly impacts financial security and sensitive corporate data, particularly as organizations move toward more automated web-based workflows.