MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

As cited

Copy frozen at 2026-09-18 17:14 UTC (site build).

threat intel

MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites

Elastic Security Labs identified a ClickFix campaign that leverages compromised legitimate websites to deliver MIMICRAT, a custom remote access trojan (RAT) written in C. The five-stage infection chain culminates in a payload capable of command and control (C2) manipulation, stealing authentication tokens, and establishing SOCKS5 tunnels for lateral movement.

Why it matters: Organizations with web-facing assets should monitor for signs of site compromise and suspicious redirects that could distribute MIMICRAT; endpoint teams need to watch for the RAT's token theft and tunneling behavior to detect post-exploitation activity.

Source published

2026-02-20 00:00 UTC

First seen by Cybersecurity Tracker

2026-09-18 16:15 UTC