Reported by 2 outlets

Timeline

1. original reporting

   CNCMachineRMS Hides Windows APIs With Runtime Hashing and Ships With No Import Table

   cyberpress.org · 62d ago · August 12th, 2026

   Security researchers have uncovered CNCMachineRMS, a 1.14 MB x64 remote access trojan (RAT) delivered at the end of a BabaDeda-based infection chain. The malware avoids common static-analysis signals by shipping without an import table, resolving Windows APIs from hashes at runtime, and creating its strings only when needed. The attack begins with a ClickFix lure and eventually launches a legitimate, signed IBM SPSS WinWrap Basic IDE executable, WinWrapIDE.exe . Although the signed program is clean, attackers abuse its COM scripting capability to load a malicious DLL . Four decoy DLLs then load through normal Windows import resolution, helping the chain avoid suspicious LoadLibrary activity. The final decoy reads shellcode from model.dat , places it inside a large buffer padded with random data, marks the region executable, and triggers it through EnumTimeFormatsEx . This benign Windows date-formatting API calls the supplied callback, allowing the shellcode to run without a direct malicious function call in the attacker’s code. CNCMachineRMS Hides APIs Hashing That shellcode is a BabaDeda stage. On its own, it may appear harmless in a sandbox: it displays a “Not Found Storage” message and waits because it requires an external configuration file. The required file, HelperStandardizationApplication.bin , has high entropy and resembles encrypted data, but researchers found it is actually an obfuscated serialized property tree containing a script and the embedded CNCMachineRMS pa

2. update from gbhackers.com

   One ClickFix Lure Can Give Hackers a Persistent Remote Shell Through New CNCMachineRMS RAT

   gbhackers.com · 63d ago · August 12th, 2026

   A ClickFix prompt can end in a remote-access foothold. CNCMachineRMS, an undocumented x64 RAT deployed at the end of a BabaDeda loader chain that turns a user-driven execution event into persistent hands-on-keyboard access. Rather than behaving like a conventional commodity stealer, the 1.14 MB implant is an access platform and second-stage delivery mechanism: its operational […] The post One ClickFix Lure Can Give Hackers a Persistent Remote Shell Through New CNCMachineRMS RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .