Reported by 4 outlets

Timeline

1. original reporting

   SloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware Hackers

   cyberpress.org · 32d ago · September 11th, 2026

   Security researchers have uncovered a new remote access trojan named SloppyRAT that may help ransomware operators gain an initial foothold, collect intelligence, and move across corporate networks. Zscaler ThreatLabz identified the malware in June 2026 after observing a multi-stage ClickFix infection chain . SloppyRAT combines several modern evasion methods, including encrypted code, indirect Windows system calls, certificate pinning, and a blockchain-based backup method for locating its command-and-control (C2) infrastructure. Despite its advanced features, researchers found several coding flaws in the malware. These errors suggest SloppyRAT is still under active development. However, its existing capabilities are sufficient to support reconnaissance, remote command execution, proxying, and lateral movement before a possible ransomware deployment. SloppyRAT ClickFix Aids Ransomware The infection begins with a ClickFix-style lure that tricks victims into running a command. The command abuses the legitimate Windows finger.exe utility to retrieve a batch script from finger.linked4x[.]com . The Finger protocol normally communicates over TCP port 79. Since most enterprises do not need this protocol, defenders can reduce risk by blocking outbound port 79 traffic and restricting the use of finger.exe . SloppyRAT’s failed COM hijacking attempt (Source: zscaler) The downloaded script copies Windows curl.exe into the user’s AppData folder and renames it with a numeric filename ending

2. update from www.zscaler.com

   New. Zscaler: SloppyRAT: A New Tool For Ransomware Attacks https://www. zscaler.com/blogs/security-res earch/sloppyrat-new-tool-ransomware-a

   www.zscaler.com · 33d ago · September 10th, 2026

   Zscaler: SloppyRAT: A New Tool For Ransomware Attacks https://www. zscaler.com/blogs/security-res earch/sloppyrat-new-tool-ransomware-a

   via Mastodon https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks

3. update from gbhackers.com

   Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement

   gbhackers.com · 32d ago · September 11th, 2026

   A new Windows remote-access trojan dubbed SloppyRAT, which appears to be positioned as an intrusion-enablement tool for ransomware operations. First observed in June 2026, the malware is delivered through a multi-stage ClickFix chain and combines host reconnaissance, stealthy command execution, reverse proxying, and resilient command-and-control mechanisms to support post-compromise activity and lateral movement. Rather than […] The post Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. mentioned by www.zscaler.com

   Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement Indicators extracted from public reporting. Source: https://

   www.zscaler.com · 32d ago · September 11th, 2026

5. update from securityonline.info

   Discover how the new SloppyRAT malware uses a ClickFix infection chain to establish remote access for ransomware attacks, evading detection.

   securityonline.info · 27d ago · September 16th, 2026

   Discover how the new SloppyRAT malware uses a ClickFix infection chain to establish remote access for ransomware attacks, evading detection. via Mastodon https://securityonline.info/sloppyrat-malware-ransomware/?utm_source=mastodon&utm_medium=jetpack_social