A compromised NYTimes Help page: from ClickFix to SilabRAT.

A human reconstruction

John only wanted help with his account.

John notices a subscription charge he does not recognize. It is not alarming, but it nags at him enough to want an answer. He opens the legitimate NYTimes Help site, mildly concerned and expecting a routine support page. The familiar address is reassuring.

As he looks for the right contact information, a verification prompt appears. It is clean, direct and neatly explained. His concern gives way to curiosity, then a little reassurance. John might even think, They have tightened security here. Good. An additional check on a Help page feels plausible.

The prompt guides him through each step: open Windows Run, paste text already prepared for him, then press Enter. The unusually specific instructions give him a brief moment of hesitation, but the trusted address and polished presentation make the request feel legitimate. Nothing asks him to evaluate code. Every action is presented as a small part of reaching the answer he came for, and John follows the steps exactly as they appear.

The page then gives John the information he needs. He contacts support and the issue is handled. Relief replaces the earlier concern. He closes the tab and returns to his day, unaware that the computer has interpreted his helpful-looking instruction in an entirely different way.

John's visible task was over. Windows had only just begun.

Behind the closed tab, the copied instruction had opened a path into the computer and arranged for hidden access to return regularly. What looked like a brief verification step had left something designed to stay.

The recovered malware was built to look for saved logins, browser data and session cookies, cryptocurrency wallet information, files and anything copied to the clipboard. It could also record the screen, capture keystrokes and allow remote control of the device while John carried on with an otherwise ordinary day.

Those are not abstract pieces of data. A browser session can open personal email, photographs, private messages, work accounts and the services that hold a person's daily life together. An email login can become the reset key for many other accounts. A cryptocurrency wallet may hold years of savings. Criminals can sell collections of stolen logins and cookies, take over accounts, impersonate the owner, commit fraud or use a trusted account to reach family, colleagues and customers.

By the time reverse engineering began, the malicious kit was no longer available from the observed NYTimes Help-page location. That is consistent with a rapid removal by the site operator, although the retained evidence cannot establish who removed it or the exact removal time.

The important conclusion is not that someone failed a test. The lure was designed by people to turn an ordinary need for help into a dangerous action, then hide the consequences beneath several technical layers. The technical analysis below reconstructs the recovered chain.

One ordinary-looking instruction quietly opened the door to a hidden compromise.

After the copied command

From one instruction to a recovered RAT.

The first command did not deliver the final malware in one step. It opened a sequence of staging, recurring execution, bundle retrieval, side-loading and shellcode recovery. The infographic follows that sequence from the browser handoff to SilabRAT. Public infrastructure is defanged in the tables below.

At the end of the chain

SilabRAT revealed what the operation was built to make possible.

At the far end of the loader sequence, static analysis of the recovered SilabRAT sample exposed the capability set, configuration material and embedded endpoint strings below.

Inside the loader

The malware changed form at every layer.

Reaching SilabRAT required more than downloading an executable. Each layer changed the payload's form or the component responsible for running it. Following those transformations made the final sample recoverable.

1. PowerShell staging

   The persisted script checked for guard processes, contained AMSI and PowerShell ETW tampering logic, compiled helper code through csc.exe, then retrieved S_Smart.txt.

2. Bundle preparation

   The response was Base64-decoded to a temporary ZIP, 15,792,137 bytes, and exactly 21 top-level files were extracted to C:\ProgramData\S_Smart.

3. Signed carrier

   S_Smart.exe was a legitimately signed Microvirt MEmu component with original filename MEmuPush.exe. It side-loaded modified libmemuqt.dll and WebView2Loader.dll.

4. Shellcode recovery

   linker64.so held a decoy prefix and 6,164-byte x86 body. Adding 0xAE463C50 to each DWORD recovered the shellcode.

5. HijackLoader container

   The shellcode stomped tapisrv.dll and consumed spritestate67.dat. That file used 567 CRC-valid PNG IDAT chunks without a normal PNG signature or IHDR.

6. Final payload

   The IDAT bodies used marker 0xEA79A5C6, XOR key 0x36B4F02B and LZNT1 compression. HijackLoader selected its ti module, loaded input.dll and recovered the 3,716,808-byte SilabRAT PE.

Static reversing recovered the strings tag=work, buildId=main and%ALLUSERSPROFILE%\Siyuta. The endpoint strings appear in the IOC appendix.

Takeaways

Case characteristics in relation to published ClickFix research.

Since 2024, public reporting has documented fake verification prompts, compromised websites, trusted-brand impersonation, smart-contract staging and many different payload families. This case combined a legitimate Help-page context, a Windows Run handoff, recurring persistence, signed-carrier sideloading, HijackLoader and a recovered SilabRAT payload.

Compromised websites are a recurring arrival route for ClickFix campaigns. Attackers can add or load JavaScript that presents a fake verification overlay, places a command on the clipboard or redirects selected visitors to attacker-controlled infrastructure. Delivered inside a legitimate site, the lure can inherit that site's existing traffic, search visibility and user trust.

A content management system is not required for this technique. It is relevant because a compromised installation can provide a practical place to insert, update and selectively serve the lure. WordPress appears frequently in reporting because of its deployment scale and extensible theme and plugin ecosystem. That broader compromised-site pattern is the context for the WordPress-specific examples below.

Compared with earlier cases in this research series

These comparisons describe technical patterns. They do not imply common ownership or attribution.

Compared with published ClickFix research, 2024 to 2026

The source name in each row links to the original vendor report.

Investigation pivots

Investigation artifacts to search for across the execution chain.

The pivots below connect the browser handoff to PowerShell persistence, loader execution and recovered payload behavior.

Defanged appendix

Full public IOC list for this case.

Domains, URLs and public addresses are defanged. The legitimate NYTimes Help host is included only to document initial-access context. No private address, victim identity, endpoint name, username, email address, employer name or internal incident identifier is published.

Network and infrastructure

Persistence, paths and filenames

Cryptographic hashes

Scope and privacy

One case now, a comparable series later.

This first paper documents the recent vacuumtubr case. Additional cases can be added later using the same reverse-engineering standard. The public edition intentionally removes victim and organization details, endpoints, usernames, email addresses, internal identifiers, private addresses and organization-specific telemetry.

Public attacker infrastructure, payload paths, filenames, persistence artifacts and cryptographic hashes are retained because they support detection and incident response. No smart-contract address was verified in this case, so none is listed.