Threat Pulse: 68th Edition

Featured Incident

Breaking the Chain

What we’re seeing 

• The Blackpoint SOC alerted to msiexec abuse on a host, consistent with a ClickFix lure that tricked a user into running a command from the Windows Run dialog.
• The command used msiexec to pull a second-stage MSI package from attacker-hosted infrastructure; the package presented itself as a generic application runtime.
• Additional analysis identified the payload as a new ChainScript build, a JavaScript RAT with WebSocket C2, interactive shell access, file operations, and payload deployment capabilities.
• The build sets its C2 directly and creates a scheduled task for persistence.

What the Blackpoint SOC did 

• The Blackpoint SOC isolated the device and identified no signs of lateral movement.
• The Blackpoint APG conducted additional research to trace the MSI to ChainScript and compared it to previous research, which identified this variant as a new build of the malware.

Why it matters 

• ClickFix-style social engineering skips file-based detection entirely by tricking the user to run the payload themselves; and msiexec is a trusted Windows installer, so the activity can blend into normal software installation.

What Blackpoint is Doing

Blackpoint has detections in place for key behaviors associated with the Fake CAPTCHA/ClickFix-style activity and suspicious use of Windows processes. The SOC provides 24/7 monitoring and response, while APG tracks changes in adversary behavior, campaigns, and vulnerabilities to provide intelligence that supports detection, investigation, and response. Together, these capabilities help identify and respond to malicious activity before it can escalate into broader operational or business impact.

Recommendations

• Train users on ClickFix techniques. No legitimate site or CAPTCHA will ask someone to paste a command into Run or Terminal.
• Disable the Windows Run dialog. Use Group Policy or Intune where business workflows allow.
• Enforce the practice of Least Privilege. Restrict standard users from access administrative utilities or command-line interfaces where business function does not strictly require them.
• Implement an app control policy that prohibits the launch of native Windows binaries from Run.

BROC Weekly Snapshot

What changed. What didn’t. What matters.

Campaign Statuses

In Case You Missed It

On October 16, 2026, ConnectWise disclosed a security incident involving Cloud Backup (formerly SkyKick), following reports of unauthorized access to customer Microsoft 365 environments through compromised application credentials.

Blackpoint Cyber’s Adversary Pursuit Group (APG) initiated an investigation into the incident, identifying affected ConnectWise enterprise applications within customer Microsoft 365 environments. As part of our response, Blackpoint proactively disabled the affected application in tenants where recent activity was observed and coordinated directly with customers regarding the containment actions taken.

Since the initial disclosure, additional findings have expanded the known scope of the incident to include other ConnectWise Cloud Management integrations, raising concerns about unauthorized changes to application credentials, permissions, and administrative role assignments.

APG continues to investigate this incident, review available indicators of compromise, and work alongside our SOC to assess potential impacts to customer environments. Blackpoint remains engaged in monitoring for suspicious activity and coordinating additional investigative or containment actions as necessary.

Social Content

Blogs/Content

• October 15, 2026: Variola: From ClickFix to A Modular Implant – Blog

Threat Notices

• October 16, 2026: ConnectWise Cloud Backup (formerly Skykick) – LinkedIn
• October 16, 2026: BeyondTrust Vulnerability – LinkedIn | infosec.exchange
• October 15, 2026: Cisco and Palo Alto Vulnerabilities – infosec.exchange