ClickFix Keeps Evolving: Rundll32 Ordinal Execution over WebDAV

Reported 29 Jul 2026 by otx · Severity: medium

A sophisticated ClickFix campaign variant uses social engineering to trick victims into executing commands via the Windows Run dialog. The technique leverages rundll32.exe to load remote non-DLL payloads by ordinal export #1 over WebDAV connections tunneled through HTTPS port 443