Uncovering CRPx0 ClickFix campaign and Python-based Ransomware

Executive Summary

In August 2026, our team identified a new CRPx0 ransomware campaign that uses ClickFix-style social engineering to deliver a Python-based ransomware payload. The campaign begins with malicious HTML files that conceal the ClickFix content and eventually display a fake CAPTCHA verification page, instructing victims to open a terminal and paste a command copied from the webpage. Following execution, the campaign deploys the CRPx0 Loader, which prepares a Python environment and launches the ransomware payload on both Windows and macOS systems. The Loader also provides persistence, defense impairment, data collection, and system encryption capabilities.

The campaign demonstrates a multi-stage architecture that combines several techniques to move from initial user interaction to ransomware deployment. CRPx0 uses encoded HTML content to conceal the initial delivery page, OS-specific commands to deploy the Loader, and a Python-based payload that is itself encoded and compressed. On Windows, the malware attempts to bypass UAC and terminate processes and services associated with a broad range of AV and EDR products, while persistence is established through Scheduled Tasks on Windows and Launch Agents on macOS. The malware also collects selected documents and high-value files, archives them, and sends them to attacker-controlled infrastructure before encryption.

CRPx0 has also established a Ransomware-as-a-Service (RaaS) ecosystem to support the operation and scale victim acquisition through affiliates. Its affiliate offering advertises multiple capabilities, including “ClickFix Social-Engineering Delivery,” and provides affiliates with a dedicated panel for generating builds, managing operations, and reviewing payouts. This indicates that ClickFix is integrated into the group's broader ransomware service rather than being limited to a single intrusion.

CRPx0 Threat Actor

CRPx0 is a relatively new ransomware operation that emerged in spring 2026 and has rapidly expanded its activity, becoming one of the most active ransomware groups observed in recent months. Prior to its ransomware operations, actors associated with CRPx0 were reportedly involved in cryptocurrency-related fraud, including crypto flash-token schemes. The group has since transitioned to a RaaS model, enabling affiliates to conduct attacks and contributing to the rapid expansion of its operations.

Since July 2026, CRPx0 has published 47 organizations on its leak site (hxxps://crpx0[.]su). The majority of the claimed victims are based in the United States, followed by Turkey, with the remaining organizations distributed across several other countries. While the leak-site listings represent claims by the threat actor and are not necessarily independently verified, the volume and pace of publications indicate that CRPx0 is actively expanding its ransomware operations and victim base.

CRPx0 operates a structured Ransomware-as-a-Service (RaaS) affiliate program, offering affiliates a 70% share of ransom proceeds. Prospective affiliates are required to apply to the program and pay a one-time $333 registration fee. The operation also imposes restrictions on targeting organizations located in CIS countries (stated on their affiliate program website), indicating a deliberate exclusion of specific regional victims from its targeting scope.

To attract affiliates, CRPx0 advertises a range of attack capabilities, including “ClickFix Social-Engineering Delivery.” This capability is particularly relevant to the campaign analyzed in this report, where the threat actors leveraged ClickFix-based social engineering as an initial access and payload-delivery mechanism.

CRPx0 also provides affiliates with a dedicated management panel for conducting and monitoring their operations. Through the panel, affiliates can generate ransomware builds, administer campaigns, and monitor their activities and payouts.

ClickFix Campaign

In August 2026, CRPx0 launched a campaign employing a multi-stage infection chain designed to deliver its ransomware payload through ClickFix-based social engineering. The campaign begins with malicious HTML files and ultimately delivers the CRPx0 Loader, which prepares the Python runtime and executes the ransomware. Once deployed, the malware is capable of collecting data from compromised systems and encrypting files.

The initial HTML file uses Base64 encoding to conceal its content and hinder straightforward analysis by web crawlers and security scanners. When loaded, the page decodes the embedded content and replaces the current document stream with a second HTML page containing the ClickFix lure.

The page impersonates a CAPTCHA verification mechanism and instructs the victim to open a terminal and paste a command from the clipboard. By following these instructions, the victim unknowingly executes the malicious command on their system.

Following successful execution, the webpage sends a notification to the C2 server (207.180.29[.]236) containing execution statistics, including the victim's operating system, unique identifier, and affiliate ID.

The ClickFix page delivers OS-specific commands for Windows and macOS. On macOS, the command prepares a Python environment, downloads the CRPx0 Loader, and executes it as sys_service.py. On Windows, the command decodes and executes DLL, which is previously downloaded from the HTML web page. This DLL performs the equivalent setup by retrieving the required Python dependencies and launching the CRPx0 Loader as sys_service.py. This cross-platform delivery mechanism allows CRPx0 affiliates to use the same ClickFix infrastructure to deploy the ransomware operation against both Windows and macOS victims.

CRPx0 Loader

On Windows systems, the malicious DLL prepares a Python execution environment by downloading the Python runtime and required get-pip dependencies. It then executes the CRPx0 Loader, named sys-service.py, from the %TEMP%\Low_Graphics_Cache\ directory. This approach allows the malware to establish the required runtime environment on systems where Python is not otherwise installed.

Initially, the Loader is in an encoded and compressed form. During execution, it decodes and decompresses an embedded payload, which is subsequently loaded as the main malware component.

The resulting payload provides functionality for data collection and exfiltration to attacker-controlled C2 infrastructure, persistence, and EDR/AV evasion. It also contains functionality for encrypting compromised systems, including domain-wide encryption across the victim's network.

Defense Impairment

To evade detection and blocking by endpoint security solutions, the CRPx0 Loader implements several defense impairment techniques. The first stage attempts to bypass Windows User Account Control (UAC) and relaunch the current payload with elevated privileges. The malware creates a temporary registry entry under HKCU\Software\Classes\ms-settings\shell\open{random_suffix}\command, containing a command that launches the current Python interpreter and script. It then executes fodhelper.exe, a legitimate Windows executable that can be launched with elevated privileges without displaying a standard UAC prompt. The registry modification causes fodhelper.exe to execute the attacker-controlled command instead of its intended action, resulting in execution of the payload with elevated privileges. After a short delay, the malware removes the registry keys created during the process.

The Loader then attempts to disable endpoint security products by terminating associated processes and services. The presence of both process and service names indicates that the malware attempts to impair endpoint protection across a broad range of security vendors rather than targeting a single product.

Disabled Processes:

MsMpEng.exe, NisSrv.exe, SecurityHealthSystray.exe, Sense.exe, MsSense.exe, AvastSvc.exe, AvastUI.exe, AVGSvc.exe, AVGUI.exe, avp.exe, kavfs.exe, kes.exe, ekrn.exe, egui.exe, eamonm.exe, eProxy.exe, ccSvcHst.exe, NortonSecurity.exe, SymCorpUI.exe, rtvscan.exe, McAfeeAP.exe, mfevtps.exe, mcshield.exe, masvc.exe, mfeann.exe, bdagent.exe, bdsvc.exe, bdredline.exe, SophosUI.exe, SophosFS.exe, SavService.exe, swi_service.exe, sophos_av.exe, pccntmon.exe, TmProxy.exe, TMBMSRV.exe, TmPfw.exe, tmccsf.exe, mbam.exe, mbamtray.exe, mbamservice.exe, CSAgent.exe, CSFalconService.exe, S1Agent.exe, SentinelWorker.exe, SentinelService.exe, cb.exe, CbDefense.exe, RepMgr.exe, CylanceSvc.exe, CylanceUI.exe, WRSA.exe, WRSVC.exe, WRCoreService.exe, cmdagent.exe, comodo.exe, cfp.exe, fsav32.exe, fsma32.exe, fsm32.exe, fsgk32.exe, a2daemon.exe, a2guard.exe, a2service.exe, fortiedr.exe, fortiservice.exe, forticlient.exe, Traps.exe, cytool.exe, panw_edr.exe, vprd.exe, VipreSvc.exe, VipreEndpoint.exe.

Disabled Services:

WinDefend, Sense, WdNisSvc, SecurityHealthService, wscsvc, MpsSvc, avast! Antivirus, AVG Antivirus, avast! Firewall, AVP, KAVFS, KES, ekrn, eamon, eProxy, Symantec AntiVirus, Norton Security, ccEvtMgr, ccSetMgr, rtvscan, McAfee McShield, McAfeeFramework, McAfeeEngineService, McAfeeAP, bdagent, BitDefender_ScanServer, BitDefender_UpdateServer, Sophos Anti-Virus, SavService, SophosClean, SophosConsole, swi_service, TmCCSF, TmProxy, TMMyWeb, TmPfw, MBAMService, MBAMAgent, S1Management, SentinelService, CSAgent, CSFalcon, CylanceSvc, WRCoreService, WRSA, cmdagent, F-Secure Software, F-Secure Network, FSGK32, EmsisoftSecurityService, EmsisoftProtectionService, FortiEDR, FortiClient, Traps, PaloAltoEDR, VipreSvc, VipreEndpoint.

The Loader also implements self-deletion and cleanup functionality to remove artifacts from the compromised system. It creates a randomly named VBScript file in %TEMP%, which uses the Windows FileSystemObject to overwrite targeted files with a single space and recursively remove the targeted files or directories. Once the cleanup operation is completed, the VBScript deletes itself.

Collection

The CRPx0 Loader implements file collection functionality to identify and exfiltrate potentially valuable data from compromised systems. It searches the system for files matching predefined high-value keywords and file extensions, selecting up to five random documents and 10 high-value files.

Document Extensions:

.doc, .docx, .pdf, .csv, .xlsx, .pptx, .txt

High Value Keywords:

password, passwd, login, credential, secret, token, bank, wallet, crypto, bitcoin, ethereum, metamask, invoice, tax, financial, salary, payment, passport, license, ssn, social, identity, ssh, vpn, config, backup, database, db, private, confidential, key, seed, recovery, .kdbx, .keychain, .pem, .key, .env, .pfx, .p12

High Value Extensions:

.kdbx, .keychain, .pem, .pfx, .p12, .p12, .env, .key, .ovpn, .keystore

Skipped Directories:

node_modules, __pycache__, venv, .git, AppData, Program Files, Program Files (x86), Windows, .cache, .npm, .vscode, .docker

The selected files are collected into a ZIP archive named data_54b7e0_{OPERATION_ID}.zip, which is subsequently uploaded to the attacker-controlled C2 server. The use of both keyword- and extension-based filtering allows the malware to prioritize files that are more likely to contain sensitive or operationally valuable information.

Persistence

The CRPx0 Loader establishes persistence through platform-specific mechanisms on both macOS and Windows systems.

On macOS, the malware creates a Launch Agent at ~/Library/LaunchAgents/com.apple.sync.plist. The configuration instructs macOS to execute the Python interpreter with the malware's application path when the user logs in or the Launch Agent is loaded.

On Windows, the Loader creates a Scheduled Task named ‘OneDrive Sync Maintenance’. The task is configured to execute the Python interpreter together with the CRPx0 Loader, allowing the malware to automatically restart after system events such as user logon.

The names of persistence mechanisms on both platforms are designed to resemble legitimate system components and may help conceal the persistence mechanism.

Ransomware Functionality

The Python payload contains the core local encryption routine. It begins with environment preparation, verifying the existence of a pre-generated scan report containing target files. If the required cryptography library is missing, the malware dynamically attempts to install it via pip into a temporary directory, ensuring it can execute even on stripped-down or isolated environments.

For cryptographic setup, the function generates a unique, random symmetric Fernet key for the current infection session. Before encrypting any files, it aggressively attempts to send this key to the C2 server. Regardless of whether this "handshake" succeeds, it encrypts the symmetric key using a hardcoded RSA public key. This RSA-encrypted blob is later embedded into the header of every encrypted file, ensuring that only the attacker holding the corresponding private key can ever recover the symmetric key needed for decryption.

The core encryption loop is highly optimized for speed and stealth. It reads the target file paths from the scan report, shuffles them to avoid predictable disk access patterns, and processes them concurrently using a multi-threaded ThreadPoolExecutor. To maximize speed and evade early detection, it employs partial encryption: it reads and encrypts only the first 1MB of each file, leaving the rest of the file data intact but rendering the file corrupted and unusable. It also employs anti-forensic techniques by preserving the original file's access and modification timestamps before deleting the original.

Eventually, the function handles post-encryption actions and transitions to lateral movement. It alters the user's desktop wallpaper, drops ransom notes (HOW TO RECOVER.txt and HOW TO RECOVER.html) into the affected directories, and sends a final telemetry report to the C2 server detailing the encryption statistics (percentage complete, total size). The routine concludes by calling the network-wide propagation function, shifting the attack from local file encryption to active lateral movement.

Next, payload implements a highly aggressive, multi-stage ransomware and worm propagation module designed to compromise an entire Active Directory domain or local network. For reconnaissance, it identifies the current domain, enumerates Domain Controllers via nltest, and discovers other network hosts using net view, local /24 subnet scanning, and ARP cache parsing to build a comprehensive list of target IP addresses.

Once targets are identified, the malware attempts to encrypt files across network shares without initially needing to execute code on the remote machines. It connects to SMB port 445 on each target, enumerates accessible shared folders and recursively searches for user files. It encrypts files up to 5MB in size using the Fernet key, deliberately skipping critical system extensions (like .exe, .dll, or .sys) to prevent crashing the remote operating system. The encrypted data is written to a new file with a custom header containing the RSA-encrypted Fernet key, renamed with a specific extension, and the original files are deleted.

Finally, the code attempts to copy and execute the malware payload on the discovered hosts to establish persistence and ensure the encryption process runs locally on each machine. On Windows, it uses SMB to drop the payload into the remote C$\Windows\Temp directory and executes it via wmic or scheduled tasks. On Linux/macOS, it leverages SSH keys found in known_hosts to copy and execute the payload via scp and ssh. If direct execution fails across the domain, it falls back to a viral GPO (Group Policy Object) attack by writing a malicious startup.bat script to the domain's SYSVOL share, ensuring the payload runs automatically whenever any machine in the domain boots or refreshes its policies. Throughout the entire attack, it continuously sends telemetry and status updates back to the C2 server.

Outlook

Despite its recent emergence, CRPx0 has already demonstrated the ability to combine ClickFix-based social engineering, cross-platform malware delivery, defense impairment, data theft, and domain-wide encryption into a single attack chain. The inclusion of “ClickFix Social-Engineering Delivery” in its affiliate offering suggests that this technique is likely to remain an important part of the group's future campaigns.

At the time of our analysis, the CRPx0 Python Loader was hardly detectable by classical antivirus solutions. This increases the importance of behavioral and data-level detection, particularly for attacks that successfully bypass endpoint controls. Organizations should monitor for suspicious clipboard-based command execution, Python interpreters launched from temporary or user-writable directories, fodhelper.exe execution associated with registry modifications, attempts to terminate security products, and subsequent file collection or encryption activity.

The campaign also demonstrates that endpoint detection alone may not be sufficient to prevent the impact of a successful ransomware intrusion. CRPx0 combines defense evasion with data theft and domain-wide encryption, meaning that even when the initial malware is difficult to detect, changes to organizational data and recovery points can provide an additional opportunity to identify the attack and limit its impact. Solutions such as Elastio's Ransomware Recovery and Detection can complement existing endpoint and network controls by inspecting data for ransomware activity and continuously identifying verified clean recovery points. Elastio's approach is designed to detect threats within live data, replicated data, and backups and provide evidence that recovery can be performed from a clean point.

For organizations facing threats such as CRPx0, combining traditional prevention and detection controls with data-level ransomware detection and validated recovery can reduce the risk of prolonged disruption. In particular, continuously verifying the last known clean recovery point can help organizations avoid restoring compromised backups after a domain-wide encryption event. As CRPx0 continues to evolve its tooling and affiliate infrastructure, organizations should maintain layered detection capabilities while ensuring that recovery mechanisms are regularly validated and that clean recovery points remain available.

Indicators of Compromise

Type	Value
IP Address	207.180.29.236
Onion Domains	tlxoddx4odmc2qvsmtsbgwwsv5j45osb5sox7mz6izxliuju5mkulzad.onion
	xburs4nr6cbuktokhqwefeh5hsjakz6usll5o7z5uhrfcnolakj4ptad.onion
	kqi5yty6ipuhwz4anutty6hob6et7dvnnxg6kcnulwedjaz5oton2zyd.onion
Domains	option.spark198.com
	crpx0.su
	crpxoxo.pw
TOX ID	17EB54B8455144E088C7E77F88A97221C319F0CFE4FE306853EEB113EE8DB5607BB6EE481C7C
Session ID	050546f6719172e04151c31acb37a242fa3eeff5766aa57331d26cc06e83e9e25b
File Hashes	f187b1d7d1757a1115207f0ae93130946925acb3af39cf1bf242a2443da4ded0
	7e6d5f6d00c8f2cfadf3fb0c9abbb19f5e291e80729db1c839c78fa4a5bad46c
	376cb49c86098078df3e7cdb563bd4ca8afa81356c4fdb098f56b59066c8cdab
	28685dff00aa1752b62a8580955b2530d63092bdcc0528b872a668cddad78c11
	5856f684c90dba657f5cd77dd337d81fd7503b5225e1843341c1f483eebc9560
	0dc6a5ce14838813e297a83e3c3c0868c7a211ee2da9c9705e5a282e65f089fe
	ebb58e0cc4d8e081707f843508b13cc45c6f8c3dfff42f27c4fc4bc70493f0d7
	bac340524549410f51b060f21abb7db30c0c5378edd2e3ac15b526e141417e89
	8af1afc82c0d578a54cc34d09544a0695ec2b0d5f244bf1f1bb4993ee7614734
	55a81d88fff3dc3de0e42724b0a992d4ef382b0e1a82187abf9d635ab89b2bae
	290d41e7436238066a8aacbd63a805aeeefc00d8798116dc702eccf6df3eae37
	6e59b6c75be99a538ab4c94a17698681695c7a6a2a6cf8161a5bf4bdee1299dc
	ef431e36a8ac12051af588d800e1d8128d583a9d4c68187709263a13564081cd
	006bca7fca78e4cb9a9629c007d629d08f0ef64a58cf045860e5668b774b4539
	3e70629521334cd25bd97522f8fc52703bed32e6a915c19ed741d72c9cb3b77a