Corium Appears on Exploit.IN

A threat actor operating under the username Cassiopeia has advertised a ClickFix management panel named Corium on the Russian-language cybercrime forum Exploit.IN.

The advertisement presents Corium as a platform designed to convert website visitors and advertising traffic into malware executions through deceptive verification workflows.

Rather than selling a standalone fake CAPTCHA page, the developer advertises an integrated system covering payload management, landing-page creation, execution methods, campaign analytics, website integration, and notification mechanisms.

The screenshots accompanying the advertisement provide a view of the panel’s interface, showing how operators can configure campaigns, upload executable files, select delivery methods, and examine execution statistics.

Inside the Corium Control Panel

One of Corium’s defining characteristics is the consolidation of components that would otherwise require separate infrastructure or tools.

The panel is advertised with support for uploaded executables and ZIP archives, customizable landing pages, campaign identifiers, traffic-source tracking, custom domains, and Telegram integration.

Its file-management interface allows operators to associate individual payloads with particular delivery campaigns and deceptive page templates. The advertisement also claims that ZIP archives can be automatically extracted.

This structure reflects an important shift: malware delivery is treated as a managed campaign, with distinct files, landing pages, traffic sources, and reporting configurations.

The interface resembles the operational dashboards commonly associated with traffic distribution systems and affiliate marketing platforms, except that the conversion objective is to persuade a visitor to execute attacker-controlled code.

Multiple ClickFix Delivery Methods in One Panel

Traditional ClickFix attacks frequently rely on a fake CAPTCHA or technical-error page that instructs the visitor to copy and execute a command using a native operating-system utility.

Corium expands this approach by advertising several delivery workflows through the same administrative interface.

The developer additionally advertises 14 ready-made Windows DLL-hijacking variations involving trusted system executables, along with portable source code, build instructions, and callback functionality for reporting installations to the panel.

The advertisement specifically promotes a headless Windows execution approach associated with conhost.exe, as well as in-memory PowerShell execution. It claims these techniques can reduce visible activity and bypass certain endpoint security warnings. Those security-evasion claims remain unverified.

Importantly, none of these mechanisms alone represents a previously unknown exploitation technique. Their significance in Corium is their availability within one configurable operator interface.

Deceptive Landing Pages

Corium advertises several visual templates impersonating familiar security and verification experiences, including:

• Cloudflare Turnstile verification screens.
• Windows Update prompts referencing KB5035238.
• Microsoft Defender SmartScreen-style warnings.
• Google reCAPTCHA-style verification pages.
• hCaptcha-style verification pages.

The developer claims the templates automatically adapt to different screen resolutions and system light or dark themes.

These familiar visual elements can make malicious instructions appear to be part of an ordinary security workflow, increasing the likelihood that an unsuspecting visitor will follow them.

Website Integration: An Important Distribution Feature

One of Corium’s more operationally significant advertised capabilities is its one-line JavaScript embedding module.

According to the advertisement, the system can display a deceptive verification interface over an existing website without requiring the operator to construct a separate landing page.

The developer explicitly advertises compatibility with content management systems including WordPress, Joomla, OpenCart, and Bitrix.

The interface can display either a CAPTCHA-style modal or a full-screen landing-page overlay. A background-blur option is intended to keep the visitor’s attention on the fake verification prompt.

The advertised trigger options include displaying the prompt immediately upon page load, after the visitor’s first click, following a configurable delay, or when the visitor attempts to leave the page.

This functionality matters because compromised legitimate websites can become distribution channels for malware, allowing attackers to present malicious instructions to visitors who believe they are interacting with trustworthy pages.

A comparable distribution model has already been documented in other ClickFix frameworks. In September 2026, Sekoia published research on Exvicy, another framework advertised on Exploit.IN that used website injection and managed ClickFix delivery. Sekoia identified Exvicy as a copy of the earlier ErrTraffic framework.

Consequently, Corium’s JavaScript embedding mechanism should not be described as unprecedented. It demonstrates continued adoption of website injection as a packaged capability in the ClickFix ecosystem.

ClickFix as a Conversion Funnel

Perhaps the clearest indicator of Corium’s commercialization is its integrated analytics dashboard.

The control panel tracks activity across the victim interaction funnel, from initial page exposure to purported payload execution.

The screenshot displays metrics for page views, CAPTCHA clicks, executions, conversion rate, and average dwell time.

Additional charts visualize executions over time and show browser and operating-system distributions.

These metrics can help an operator compare different lures and traffic sources, evaluate which techniques produce more execution events, and adjust campaigns accordingly.

The advertisement also describes detailed visitor profiles, including operating systems, browsers, countries, languages, screen resolutions, referral sources, and timestamps.

Corium additionally advertises partner-facing statistics links, allowing traffic suppliers or other participants to review selected campaign results without receiving administrative access.

Telegram notifications are presented as another reporting mechanism, with customizable messages containing variables for the campaign, file, source, browser, operating system, IP address, and event time.

These features may reduce the operational overhead of running ClickFix campaigns. However, the screenshots do not establish Corium’s customer base, infection volume, distribution scale, or effectiveness.

What Is Actually Novel About Corium?

Despite its extensive feature list, Corium does not currently appear to introduce a fundamentally new exploitation primitive.

ClickFix, FileFix, native Windows utility abuse, deceptive CAPTCHA pages, compromised website injection, and affiliate-style distribution have all been documented before Corium’s advertisement.

The potentially distinctive aspect is how comprehensively these capabilities are presented within the same platform.

1. Delivery-Method Consolidation

Corium packages multiple user-assisted execution paths into one configurable workflow. This gives operators a broader selection of delivery mechanisms without having to maintain separate tools for each technique.

2. Website-Native Distribution

The JavaScript embed module is designed to place deceptive verification content directly over existing websites, combining the credibility of a host page with the attacker’s chosen instructions.

3. Affiliate-Style Campaign Management

Traffic-source metadata, campaign names, isolated partner statistics, and conversion analytics suggest a platform designed for repeatable, measurable distribution rather than isolated malicious landing pages.

4. Claimed DLL-Hijacking Toolkit

The advertised collection of 14 Windows DLL-hijacking variations is noteworthy as a packaged feature, but the available material does not establish whether these variants are original, reliably functional, or capable of the evasion claimed by the seller.

5. Operational Automation

Configurable execution reporting, Telegram notifications, adaptable page layouts, and browser or operating-system segmentation help turn a collection of malicious techniques into a centralized campaign-management product.

Several capabilities remain unverified. These include the seller’s claims regarding macOS support, Windows security bypasses, polymorphic payload behavior, and the effectiveness of the advertised anti-detection mechanisms.

Overall, the evidence supports describing Corium as a sign of ClickFix commercialization and operational maturity, rather than a technical breakthrough.

The Hudson Rock Connection: Monitoring ClickFix Infrastructure

Frameworks such as Corium highlight the importance of identifying malicious verification pages and their distribution infrastructure before they lead to successful infections.

In July 2026, Hudson Rock introduced a dedicated ClickFix Monitoring capability within its Cavalier Threat Feeds.

The module gives security teams visibility into detected ClickFix websites and their associated malicious behavior, including deceptive CAPTCHA interactions and clipboard-based command delivery.

Cavalier’s documented ClickFix monitoring data includes:

• Detected ClickFix websites and domains.
• CAPTCHA and clipboard-injection indicators.
• Commands presented to targeted visitors.
• Before-and-after interaction screenshots.
• Associated URLs and domain records.
• Date filtering and intelligence export.

Investigating the Payload Behind the CAPTCHA

Corium’s configurable delivery methods create a challenge for defenders: different campaigns may expose victims to different instructions or execution mechanisms, even when they are managed through a similar underlying platform.

This makes the behavior of the malicious webpage itself an important source of threat intelligence.

Cavalier allows analysts to inspect suspicious ClickFix pages, including the commands presented to visitors and visual evidence of the verification workflow.

For Corium-like campaigns, this kind of visibility can be valuable even when defenders have not obtained the operator panel, identified the final malware family, or attributed the activity to a known threat actor.

It can support earlier investigation of suspicious URLs, malicious page behavior, and potential user exposure.

How Infostealer Infections Can Help Enable ClickFix Distribution

The relationship between ClickFix and infostealers is particularly important when attackers distribute malicious content through compromised legitimate websites.

One possible entry point is stolen administrative access to a content management system.

An infostealer infection can expose credentials belonging to website administrators, developers, or third-party service providers. Attackers may subsequently abuse those credentials to modify websites and inject malicious scripts.

This creates a cycle in which an infostealer infection can help enable the distribution of additional malware.

Case Study: The Artlist ClickFix Incident

Hudson Rock previously documented this connection in a July 2026 investigation involving the digital asset platform Artlist.

In that case, attackers compromised a legitimate Artlist subdomain and introduced malicious code that displayed deceptive CAPTCHA content.

Hudson Rock and collaborating researcher Matt Kirkland traced the initial access back to an August 2023 infostealer infection involving a freelance developer who had downloaded a pirated Adobe Acrobat installation.

The infection exposed privileged WordPress credentials associated with a Senior Content Executive. Those credentials were subsequently linked to the compromise of the website.

The attackers injected a malicious script using an EtherHiding mechanism, allowing the compromised website to deliver ClickFix content.

The case illustrates how compromised identities and legitimate website infrastructure can intersect in a single malware-distribution operation.

Corium’s advertised JavaScript embedding capability makes this broader attack pattern relevant. A compromised website with attacker-controlled JavaScript could potentially be used to present a Corium-style verification overlay to visitors.

This is an assessment of a plausible distribution model, not evidence that Corium was involved in the Artlist or Solaric incidents.

Defensive Implications

The emergence of more fully featured ClickFix management platforms reinforces the need to monitor the entire distribution chain.

Relying exclusively on known malware file hashes or individual malicious commands may provide incomplete visibility into campaigns that can switch landing pages, delivery workflows, and payloads.

Security teams should consider several complementary defensive measures:

• Monitor ClickFix infrastructure: Identify suspicious verification pages, malicious clipboard behavior, and websites displaying unexpected command-execution instructions.
• Investigate suspicious execution: Correlate browser activity with unexpected launches of PowerShell, Windows command interpreters, terminal utilities, and suspicious use of native Windows protocols.
• Protect website administration: Monitor CMS changes, unauthorized scripts, third-party dependencies, and suspicious administrator activity.
• Monitor exposed credentials: Identify compromised WordPress, hosting, and administrative accounts exposed through infostealer infections.
• Correlate multiple signals: Combine website intelligence, endpoint telemetry, suspicious infrastructure, and credential exposure to investigate the complete attack chain.
• Educate users: Legitimate CAPTCHA challenges should not require visitors to execute arbitrary terminal commands or install software.

Integrating ClickFix Intelligence Through the Cavalier API

Hudson Rock also makes the ClickFix intelligence available through Cavalier’s REST API.

The documented GET /json/v3/threat-feeds/clickfix endpoint provides access to detected ClickFix sites and associated indicators, while the GET /json/v3/threat-feeds/clickfix/{domain} endpoint supports domain-specific lookups.

These feeds can be integrated with existing threat intelligence workflows and security controls, helping organizations investigate suspicious domains and act on known malicious infrastructure.

Such monitoring is particularly useful against modular distribution platforms: defenders do not necessarily need advance knowledge of the operator’s chosen malware family to detect suspicious ClickFix delivery behavior.

Conclusion: ClickFix Is Becoming More Industrialized

Corium provides another example of the continuing commercialization of ClickFix-based malware delivery.

Its advertised features combine established social-engineering techniques with a centralized control panel, multiple payload delivery options, embedded website overlays, campaign analytics, and partner reporting.

Although the available evidence does not demonstrate a genuinely novel exploit or independently validate the seller’s evasion claims, the platform’s design is operationally significant.

It reflects a broader movement toward reusable, configurable malware-distribution infrastructure that can be operated and measured with the sophistication of commercial traffic platforms.

For defenders, the challenge extends beyond identifying a particular payload. It involves recognizing malicious user-interaction patterns, identifying compromised websites, and connecting the distribution infrastructure to the credentials and systems that enabled it.

Hudson Rock’s ClickFix Monitoring and infostealer intelligence offer complementary visibility into these stages, helping analysts investigate malicious delivery activity and the compromised identities that may sit behind it.