Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

Reported 16 Jun 2026 by otx · Severity: medium

A ClickFix social engineering attack on an unmonitored endpoint led to a multi-stage intrusion affecting over 11 hosts. The infection chain began with a malicious HTA payload that silently installed an MSI package containing Potemkin, a custom loader with a deterministic DGA. Pot