ClickFix campaign abuses Deno runtime for infostealer delivery

Counter Threat Unit™ (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism within a ClickFix-driven intrusion chain. On June 3 and June 4, compromised WordPress sites served Cloudflare-themed ClickFix lures that prompted users to execute a clipboard-delivered PowerShell command. This command initiated an MSI-based staging process that installed Deno and enabled retrieval and execution of remote JavaScript. CTU™ analysis indicates that Deno functioned as a key element supporting payload delivery, follow-on tasking, and persistence.

Attack chain

The ClickFix social engineering attack relied on malicious JavaScript injected into the main pages of compromised WordPress sites. CTU researchers identified injected script references to hxxps://columbnezhjdq[.]com/goolgetagmanager.js?v=2.0&_cb=[REDACTED], which performed browser environment checks before presenting staged verification prompts and ClickFix instructions (see Figure 1). The injected script was consistent across the investigated incidents, but the _cb value specified in the URL query string varied across compromised WordPress sites. In observed cases, the lure presented the user with a PowerShell command to execute via Windows Terminal.

Figure 1: Cloudflare-themed ClickFix lure on a compromised WordPress site

The executed PowerShell command triggered an MSI-based staging chain that invoked command-line and PowerShell components written to the user’s AppData directory. The MSI installer executed two embedded scripts (november85.cmd and Griffin20.ps1) that carried out Deno runtime installation and payload delivery. The native Windows package manager utility (winget.exe) was used to download and install Deno runtime, and then the legitimate deno.exe ran a remote JavaScript payload from attacker-controlled infrastructure hosted on webstizkgao[.]com. This approach enabled the threat actors to remotely execute code without relying on traditional malware loaders.

Figure 2 shows the execution flow, which remained consistent across the investigated incidents.

Figure 2: Process tree for the Deno-based execution chain

Follow-on activity

Deno functioned as the primary orchestrator of subsequent activity. This activity included executing additional PowerShell scripts, performing system reconnaissance, and establishing persistence via registry Run keys that invoke JavaScript through a headless conhost.exe process.

The Deno execution of remote JavaScript enabled delivery of a Python-based payload (install.pyc) executed via pythonw.exe. Sophos analysts confirmed that the payload, retrieved from 162[.]33[.]177[.]16, is an infostealer capable of collecting system information, browser and extension data, cryptocurrency wallet information, and keystrokes. Additional process behavior observed in telemetry indicated system profiling and anti-analysis techniques.

CTU analysis revealed continued communication with command and control (C2) infrastructure via a scheduled task that used deno.exe to execute a remote JavaScript payload hosted at hxxp://webstizkgao[.]com/v020def066f14754be9.js. On June 23, the remote JavaScript changed, defining a new remote staging URL hosted on the TryCloudFlare free Cloudflare service. The script downloaded content from hxxps://ordinary-computer-analytical-spell[.]trycloudflare[.]com/c and stored the content in a new registry key disguised as a Microsoft Edge update.

Additional observations

CTU researchers identified more than 500 compromised WordPress sites hosting similar malicious JavaScript injections that communicate with the columbnezhjdq[.]com and webstizkgao[.]com domains. Columbnezhjdq[.]com was registered on June 1, 2026, five days after registration of webstizkgao[.]com. The volume of affected sites indicates that the operators likely used website compromise or injection mechanisms to scale delivery of the ClickFix lure rather than relying on targeted WordPress compromises.

The May 2025 v2.3 release of the Deno runtime introduced trusted, code-signed distributions that reduced the likelihood of security controls flagging the binary. However, security researchers warned at the time how it could be abused to execute malicious payloads. Its ability to retrieve remote code, operate from user-writable directories, and execute with broad permissions makes it well suited for multi-stage malware delivery and persistence. All of these factors likely increased Deno’s appeal to threat actors.

Recommendations, protections, and indicators

CTU researchers recommend that organizations monitor and restrict unauthorized use of Deno, review execution of deno.exe from user-writable directories, investigate persistence events involving Deno, and block connections to malicious domains and IP addresses that have been linked to this activity.

The following Sophos protections relate to this threat:

• WIN-EXE-PSH-INVOKE-AND-WRITEALLBYTES-1
• WIN-PROT-BEHAVIORAL-MALWARE-CREDS-2D-T1555-003
• WIN-PROT-BEHAVIORAL-MALWARE-CLEANUP-3A-T1059-001
• WIN-PER-PSH-CURRENTVERSION-RUN-1
• WIN-EXE-PSH-INVOKE-AND-WRITEALLBYTES-1
• WIN-EVA-PRC-EXE-IN-ZIP-1
• WIN-EVA-PRC-SUSP-CONHOST-SPAWN-1
• WIN-EVA-PRC-CONHOST-CODE-INJECTION-2

The threat indicators in Table 1 can be used to detect activity related to this threat. Note that IP addresses can be reallocated. The IP address and domains may contain malicious content, so consider the risks before opening them in a browser.

Table 1: Indicators for this threat