The campaign uses ClickFix social engineering to deliver an unidentified Remote Access Trojan (RAT). After the initial compromise, attackers deploy MeshAgent on the infected Windows host to establish persistence and maintain remote access. The infection chain also relies on password-protected ZIP archives to distribute malicious components.
The investigation included analysis of infection traffic in Wireshark and examination of fake verification pages used in the ClickFix scheme. Analysts identified an unknown RAT alongside MeshAgent running persistently on the compromised host. Suspicious file activity was primarily observed within the AppData\Local\Temp directory.
Organizations should use web filtering to block known malicious ClickFix landing pages and associated social engineering domains. Endpoint security controls should monitor and prevent unauthorized MeshAgent execution and suspicious binaries launched from Temp directories. Users should also be trained to recognize fake verification or error messages requesting manual script execution.
If malicious activity is detected, the compromised Windows host should be isolated immediately to stop further C2 communication. Responders should perform forensic analysis of the AppData\Local\Temp directory to identify malicious files. Network logs should also be reviewed for connections to Mesh C2 infrastructure, followed by a full system hunt for unauthorized remote access tools.
Attack Narrative & Commands: The adversary has gained initial access via a phishing macro. To establish a persistent remote access channel, they download a specialized tool named MeshAgent.exe . To blend in with standard user activity and evade directory-based scrutiny, they drop the file into the %TEMP% folder. They then execute the agent using a command line that explicitly includes the string “MeshAgent” to interact with their C2 infrastructure. This action is designed to trigger the specific signature-based detection rule currently in place.
Attack Narrative & Commands: The adversary has gained initial access via a phishing macro. To establish a persistent remote access channel, they download a specialized tool named MeshAgent.exe . To blend in with standard user activity and evade directory-based scrutiny, they drop the file into the %TEMP% folder. They then execute the agent using a command line that explicitly includes the string “MeshAgent” to interact with their C2 infrastructure. This action is designed to trigger the specific signature-based detection rule currently in place.
Regression Test Script: # Simulation script to trigger the detection of MeshAgent in Temp $TempPath = $env:TEMP $BinaryName = "MeshAgent.exe" $BinaryPath = Join-Path $TempPath $BinaryName # 1. Create a dummy executable (mimicking a RAT/Agent) # We use a simple renamed system tool to ensure it can actually 'run' for the simulation Copy-Item "C:WindowsSystem32cmd.exe" -Destination $BinaryPath # 2. Execute the binary with the specific strings required by the detection rule # The rule looks for 'MeshAgent', 'RAT', or 'C2' in the CommandLine Start-Process -FilePath $BinaryPath -ArgumentList "/c echo This is a MeshAgent simulation with C2 connectivity"
Regression Test Script:
Cleanup Commands: # Cleanup the simulation artifacts Remove-Item -Path "$env:TEMPMeshAgent.exe" -Force -ErrorAction SilentlyContinue
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
