THREATOPS

THREAT OPS › Threat News › Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack

lowhuntressPublished 2026-06-16

A ClickFix infection drops Potemkin loader and RMMProject RAT, leading to browser theft, hidden remote desktop, and lateral movement across over 11 hosts.

Original source: https://www.huntress.com/blog/potemkin-loader-rmmproject-clickfix-attack