Copy. Paste. Pivot.

On an otherwise ordinary workday, unusual activity on a luxury real estate developer's environment caught the eye of one of our MDR analysts. A threat actor was attempting to set up an identity-based attack using a new variation of the ClickFix technique (MITRE T1204.004).

A quiet environment suddenly speaks

Our MDR analysts build a baseline for every environment they monitor, because normal looks different from one company to the next. The real estate firm fell into the "usually quiet" category, which made a sudden cluster of detections for suspicious activity immediately stand out.

The ThreatDown EDR agent on one endpoint had captured a command line that had executed through the Windows Run feature. Immediately, the MDR analyst wondered if it could be a ClickFix campaign, a social engineering attack that tricks users into copy-pasting a malicious command directly on their own machine. There's no malicious file, no suspicious download. Just a regular user doing an innocent thing

But one detail did not fit. Typical ClickFix attacks rely on PowerShell, CMD, or mshta to execute HTML content. This command used rundll32. With years of experience tracking how threat actors operate, the analyst suspected the adversary had pivoted their method to evade the usual detection signatures, and moved to confirm it.

---

The smoking gun

Inside the active response shell

To confirm a ClickFix execution, the analyst needed proof that a person, not a script or a scheduled task, had run the command. The Run MRU registry key logs every command a user executes from the Windows Run dialog. If the alert's command line was in there, the case was made.

From there, the analyst moved straight to containment: malicious processes terminated, endpoint isolated, the attacker's domain added to web protection, and the command pattern flagged in the anti-exploit engine so the same shape cannot execute anywhere else on the network. All of it inside the same window of minutes that opened with the first alert.

Identity attack averted

ClickFix attacks are built for one outcome: stealing credentials that can be used in identity-based attacks. The script unwittingly executed by the user was a downloader. Its job was to contact the attacker's server and install an information stealer that could quietly harvest credentials from the infected machine.

With valid credentials, the threat actor would have been able to:

• Access internal systems while appearing as a legitimate user
• Steal sensitive financial details, property records, and active negotiations
• Plant ransomware on a network they had already mapped

None of that happened.

For a luxury real estate developer operating across the US and Europe, trust drives the business. Every transaction depends on discretion, timing, and confidence. Clients expect their financial details, property records, and negotiations to stay private. A single breach could trigger regulatory scrutiny, expose sensitive transactions, and fracture relationships that took years to build.

---

Reconstruction

From first signal to full handover

Five stages of the analyst's work, reconstructed from EDR telemetry and Active Response Shell session logs.