Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: a CAPTCHA that asks you to run a command
0A finance analyst clicked what looked like a normal Discord invite and ended up running a command on their own machine. Before tracing the logs, orient yourself on how this attack works.
Find the fake-CAPTCHA lure page
15The recycled invite did not open a Discord server. It bounced the browser through a throwaway host and left the analyst sitting on a page that asked them to verify themselves. Name the domain of that page.
Spot what the ClickFix prompt made the user run
15The fake verification page told the analyst to paste something into the Run dialog and press Enter. Windows recorded what that actually started. Name the process image that ran.
Trace where the loader pulled its first payload
15What the analyst pasted carried no malware of its own. It fetched it. Identify the full URL the first-stage executable was pulled from.
Identify the command-and-control address
15Once the remote-access trojan was running it called home. More than one session in this evidence has that shape. Identify the destination address of the first one.
Find what stole the browser data
10Alongside the trojan, a second payload did nothing but steal. It collected browser data and session tokens and shipped them straight out. Name the executable that sent them.
Map the user-execution step to MITRE ATT&CK
10Step back from the artifacts. One step in this chain was not something a program did, and it is the step the whole intrusion depended on. Map it to its MITRE ATT&CK sub-technique identifier.
7 tasks · 80 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allAnatsa Banker: The Trojan Hiding in a Google Play PDF Reader
A relationship manager at Larkfield Mutual installs a five-star PDF and QR reader from the Google Play store onto her managed Android handset. It is an Anatsa (TeaBot) dropper: it stages a DEX payload disguised as an app update, sidesteps sandbox checks, downloads the final banking trojan, and abuses the Accessibility service to overlay a fake bank login. Walk the EMM/MDM and web-proxy logs step by step to trace the install, the staged downloads, the C2 callback, and the final payload.
Overdue Invoice, Compromised Endpoint: Tracing a Finance Workstation Intrusion
A finance clerk at Brightwater Logistics worked through her inbox at her desk one Tuesday morning. Inside the hour her workstation, bwl-fin-wks-042, was running programs no accounts-payable machine has any business running and reaching hosts that have nothing to do with freight. You have the mail gateway records for her mailbox and the endpoint telemetry for that hour, and nothing else. Work the morning in order: establish what was delivered, what ran, what it left behind so that it would run again, and where it reported to.
Fake Window, Real Loss: Browser-in-the-Browser Steam Phishing
A Counter-Strike 2 player on the community team at Voltline Interactive clicks a phishing email offering a free in-game case from a well-known esports team. The link leads to a scam site that paints a fake browser pop-up, complete with a fake Steam URL bar, entirely in HTML. The victim types their Steam credentials into the fake window and cannot sign in minutes later. Walk the email gateway and proxy logs step by step, from the lure to the moment the password left the browser.