DenoRAT Malware: How the ClickFix Trojan Steals Passwords and Controls Your PC

A website tells you to press Windows keys, open the Run box and paste a command to complete a verification or fix an error. That is not troubleshooting; it can be the first stage of a DenoRAT infection.

DenoRAT is a remote access trojan and information stealer. Once active, it can control the desktop, run commands and steal browser passwords, credit cards, authentication tokens and cryptocurrency wallet data.

DenoRAT Malware Overview

DenoRAT is Windows malware written for the Deno JavaScript runtime. Its codebase contains more than 10,000 lines and uses heavy obfuscation to make analysis harder. The unusual runtime helps the campaign look different from conventional Windows executables while still giving the operator access to files, commands, browsers and the live desktop. The threat is linked to a criminal toolkit used by a group tracked as TAG-150.

The most important delivery method is ClickFix social engineering. A deceptive webpage claims that a browser check failed, a CAPTCHA needs manual verification or a system error must be repaired. It instructs the visitor to open the Windows Run dialog and paste a command. The victim therefore launches the infection personally, often believing the command came from Windows or the website’s support system.

That command can download an MSI installer, deploy the Deno runtime and launch a small loader called DinDoor. DinDoor retrieves the DenoRAT stage from attacker infrastructure. Some campaigns can continue by installing NightshadeC2, another remote-access and information-stealing payload designed to run largely in memory. The chain gives the attackers several opportunities to replace components and expand the compromise.

DenoRAT combines surveillance with direct control. Operators can run commands through Command Prompt or PowerShell, stream the desktop, move the mouse, type with the keyboard, read or replace clipboard contents, capture screenshots and manage files. At the same time, the malware targets saved credentials and payment data from Chromium- and Firefox-based browsers, Telegram and Discord session tokens and sensitive browser extensions.

The stealer component targets more than 78 extensions, including password managers, authenticator tools and cryptocurrency wallets. Examples include Bitwarden, 1Password, LastPass, Dashlane, Google Authenticator, Authy, MetaMask, Phantom, Trust Wallet and Exodus. DenoRAT also attempts to bypass Chrome App-Bound Encryption so locally protected credentials can still be extracted. An infected user should assume that passwords, session cookies, wallet access and copied secrets are exposed.

How the DenoRAT ClickFix Attack Works

Step 1: A deceptive page invents a verification problem

The visitor sees a fake CAPTCHA, browser error, video problem or security check. The page claims that a short keyboard procedure will restore access. Its instructions are not generated by Windows and should not be trusted.

Legitimate CAPTCHAs never require commands in Run, PowerShell, Terminal or Command Prompt.

Step 2: The victim pastes and executes a hidden command

The page may copy a command to the clipboard and tell the user exactly which keys to press. Pasting into the Run dialog executes code with the user’s permissions instead of merely entering a verification answer.

The command can be visually confusing or launch a trusted Windows component so the download happens without a normal installer page.

Step 3: An MSI package installs Deno and the DinDoor loader

The initial command retrieves an installer that adds the Deno runtime and starts DinDoor. The loader’s role is to contact criminal infrastructure and fetch the current DenoRAT stage.

Using multiple stages lets the attackers change the final payload while keeping the same ClickFix lure.

Step 4: DenoRAT establishes persistence and command access

A Registry Run entry can start the malware at each login. DenoRAT registers the infected computer with campaign identifiers and communicates through web requests and persistent connections.

The operator can then run shell commands, browse files and interact with the live desktop.

Step 5: Browsers, extensions and sessions are harvested

Saved passwords, cookies, credit card details and autofill data are collected from supported browsers. Wallet extensions, password managers, authenticator extensions and messaging tokens are also targeted.

A stolen session cookie may let an attacker enter an account without typing the password or completing the usual login flow.

Step 6: Additional payloads and hands-on activity follow

The controller can deploy NightshadeC2 or other malware, monitor the user and move stolen information out of the system. Access may be used for account theft, cryptocurrency theft, business compromise or later ransomware.

Because the attacker can operate interactively, the incident is broader than removing one malicious file.

What DenoRAT Can Steal or Control

• Saved passwords, cookies, autofill information and credit card data from supported browsers.
• Cryptocurrency wallet extensions and locally stored wallet information.
• Password-manager and authenticator browser extensions.
• Telegram and Discord session tokens.
• Clipboard contents, screenshots and files stored on the computer.
• The mouse, keyboard and live desktop through remote control.
• System details such as username, hostname, Windows version, hardware and administrator status.
• A channel for commands and additional malware downloads.

What to Do If You Followed the ClickFix Instructions

1. Disconnect the computer from the internet. Disable Wi-Fi and unplug Ethernet to interrupt remote commands and data theft.
2. Do not use the infected PC to secure accounts. Switch to a clean phone or computer for password changes and financial checks.
3. Tell workplace IT immediately. Provide the webpage address, time of execution and the exact steps you followed. Business credentials and shared resources may be exposed.
4. Run the complete Windows malware-removal procedure below. DenoRAT uses multiple components and persistence, so a quick scan or deleting browser history is not enough.
5. Change important passwords after cleanup. Prioritize primary email, password manager, banking, work accounts, social media and cryptocurrency services.
6. Revoke sessions and application tokens. Sign out all devices, remove unknown connected apps and regenerate backup codes where appropriate.
7. Secure cryptocurrency wallets. Move assets to a newly created wallet from a clean device if seed phrases, extensions or signing sessions may have been exposed.
8. Review the system for follow-on compromise. Check new users, startup entries, scheduled tasks, remote tools, browser extensions and unexpected security exclusions.

Signs That May Point to a DenoRAT Infection

DenoRAT is designed to remain quiet, so there may be no obvious pop-up or performance problem. Treat the executed ClickFix command itself as sufficient reason to investigate. Do not wait for a visible symptom before disconnecting the PC.

• A fake CAPTCHA or error page instructed you to paste a command into Windows.
• Deno or an unfamiliar MSI package appeared without a deliberate installation.
• Security software reports a RAT, credential stealer, DLL injection or suspicious PowerShell activity.
• The mouse or windows move without your input.
• Browser, Telegram, Discord or wallet accounts show unfamiliar sessions.
• Passwords, recovery settings or cryptocurrency balances change unexpectedly.
• A new startup entry silently launches Deno or conhost-related activity at login.

How to Avoid ClickFix Malware

Never paste commands from a webpage into Run, PowerShell, Terminal or Command Prompt. A website can ask you to select images, enter a code or confirm a checkbox, but it has no legitimate reason to make you execute operating-system commands to prove you are human.

If a page claims a browser component is broken, close it and update the browser through its own menu or the official developer site. Do not install a codec, certificate, verification tool or update supplied by the page that reported the problem.

Organizations can reduce the risk by limiting script and MSI execution, monitoring suspicious use of Run and PowerShell, blocking newly registered delivery domains and training users on the exact ClickFix pattern. Reporting the page quickly helps administrators examine the device before credentials are used elsewhere.

Frequently Asked Questions

Is DenoRAT only a password stealer?

No. It steals credentials and tokens, but it is also a full remote access trojan. An operator can view the desktop, control input, run commands, move files and install additional malware.

Does closing the fake CAPTCHA stop the infection?

Closing the page prevents further interaction only if no command was run. Once the pasted command installs the loader, the malware can persist independently of the browser page.

The Bottom Line

DenoRAT is a dangerous ClickFix-delivered trojan that turns a fake verification instruction into persistent remote access and broad credential theft. It targets browsers, wallets, password managers, authenticators and messaging sessions.

If you pasted and ran the command, disconnect the PC, remove the malware completely and secure accounts from a clean device. Do not treat the incident as solved simply because the deceptive webpage disappeared.

If you suspect your computer is infected with malware — slow performance, pop-ups, redirects, or programs you don’t recognize — follow the free step-by-step removal guide below to clean it completely.

Remove Malware from Windows [Step-by-Step Guide]

• STEP 1: Uninstall malicious programs from Windows
• STEP 2: Reset browsers back to default settings
• STEP 3: Use Rkill to terminate suspicious programs
• STEP 4: Use Malwarebytes to remove Trojans and unwanted programs
• STEP 5: Use HitmanPro to remove rootkits and other malware
• STEP 6: Use AdwCleaner to remove malicious browser policies and adware
• STEP 7: Perform a final check with ESET Online Scanner

STEP 1: Uninstall malicious programs from Windows

First, we’ll manually check your computer for unknown or malicious programs. Adware and browser hijackers often have a working uninstall entry — removing them this way takes care of the easy part before we run the scanners.

With the malicious programs removed, you’re ready for the next step in this guide.

STEP 2: Reset browsers back to default settings

In this step, we will remove spam notifications,  malicious extensions, and change to default any settings that might have been changed by malware.
Please note that this method will remove all extensions, toolbars, and other customizations but will leave your bookmarks and favorites intact. For each browser that you have installed on your computer, please click on the browsers tab below and follow the displayed steps to reset that browser.

STEP 3: Use Rkill to terminate suspicious programs

Next, we’ll download and run Rkill to stop any suspicious processes running in the background. This prevents the malware from interfering with the removal tools in the following steps.

RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools.

1. Download Rkill.

   You can download RKill to your computer from the below link. When at the download page, click on the Download Now button labeled iExplore.exe. We are downloading a renamed version of Rkill (iExplore.exe) because some malware will not allow processes to run unless they have a certain filename.

   

   RKillStops malware processes so other tools can run

   Download RKillOpens the BleepingComputer download page in a new tab.

2. Run RKill.

   After downloading, double-click the iExplore.exe icon to kill malicious processes. In most cases, downloaded files are saved to the Downloads folder.
   The program may take some time to search for and end various malware programs.

   

   When it is finished, the black window will close automatically and a log file will open. Do not restart your computer. Proceed to the next step in this guide.

STEP 4: Use Malwarebytes to remove Trojans and unwanted programs

Now we’ll install Malwarebytes and run a full scan to detect and remove infections, adware, and potentially unwanted programs from your computer.

Malwarebytes is one of the most popular and trusted anti-malware tools for Windows — and it’s completely free for removing infections. It catches threats that many antivirus programs miss, including adware, browser hijackers, and trojans. Follow the steps below to scan and clean your PC in just a few minutes.

1. Download Malwarebytes

   Click the button below to download the latest version of Malwarebytes for Windows from the official source. The free version is all you need — it will scan your computer and remove adware, browser hijackers, and other malicious software at no cost.

   

   Malwarebytes Free for WindowsScans and removes malware at no cost

   Download MalwarebytesOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium

2. Install Malwarebytes

   When the download finishes, open your Downloads folder and double-click the MBSetup file. If Windows shows a User Account Control pop-up, click “Yes” to allow the installation.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   • Choose where you’re installing the program — “Personal Computer” or “Work Computer” — then click Next.

     

   • Malwarebytes will now install on your device. This usually takes under a minute.

     

   • When installation is complete, the “Welcome to Malwarebytes” screen will open automatically.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Enable “Scan for Rootkits”

   Before scanning, turn on rootkit detection so Malwarebytes can find even the most hidden threats. Click the Settings gear icon on the left side of the screen.

   

   In the settings menu, find “Scan for rootkits” and click the toggle so it turns blue.

   

   Done? Click “Dashboard” in the left pane to return to the main screen.

5. Start the Scan

   Click the blue Scan button. Malwarebytes will automatically update its virus database and start checking your computer for malware.

   

6. Wait for the Scan to Finish

   The scan checks your entire system for browser hijackers and other malicious programs, so it can take 5 to 20 minutes depending on your computer. Feel free to do something else — just check back occasionally to see the progress.

   

7. Quarantine the Detected Threats

   When the scan is done, you’ll see a list of everything Malwarebytes found — malware, adware, and potentially unwanted programs. Click the “Quarantine” button to remove all of them at once.

   

   Malwarebytes will now remove the malicious files and registry entries and move them safely into quarantine.

   

8. Restart Your Computer

   Some threats can only be fully removed after a reboot. If Malwarebytes asks you to restart, click Yes. Once you’re logged back in, Malwarebytes has finished removing the threats it found.

   

STEP 5: Use HitmanPro to remove rootkits and other malware

Next, we’ll run a second-opinion scan with HitmanPro to catch Trojans, rootkits, and other malicious programs that may have survived the previous step.

HitmanPro is a second-opinion scanner — it’s designed to catch what your main antivirus might have missed. Instead of relying on a single detection engine, it checks the behavior of files in the locations where malware usually hides. Anything suspicious gets sent to the cloud, where it’s analyzed by two of the best antivirus engines available: Bitdefender and Kaspersky.

Good news: scanning is completely free, with no limits. You only need a license when it’s time to remove what was found — and even then, you can activate a free one-time 30-day trial to clean your PC at no cost. (A full license is $24.95 per year for 1 PC.)

1. Download HitmanPro

   Click the button below to download HitmanPro. Remember — the scan is free, so you have nothing to lose by checking your PC.

   

   HitmanProSecond-opinion malware scanner from Sophos

   Download HitmanProFree scan. Removing threats needs the free 30-day trial. Opens the official HitmanPro page in a new tab.

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click “Next” to begin the system scan. No lengthy setup required — it goes straight to work.

   

   

4. Wait for the Scan to Finish

   HitmanPro will now check your computer for malicious programs. This usually takes just a few minutes thanks to its cloud-based scanning.
   

5. Review the Results and Click “Next”

   When the scan is done, HitmanPro will show you everything it found. Click “Next” to remove the detected threats.

   

6. Click “Activate Free License”

   To remove the malicious files, click the “Activate free license” button. This starts your free 30-day trial — no payment details needed — and unlocks the full cleanup.
   

   When the removal is complete, HitmanPro will show a summary of everything it cleaned. Click Next, then click Reboot if prompted. If there’s no reboot prompt, just click Close — your PC is clean.

STEP 6: Use AdwCleaner to remove malicious browser policies and adware

We’ll now use AdwCleaner to remove malicious browser policies and unwanted browser extensions — the leftovers that keep hijacking your browser settings even after the malware itself is gone.

AdwCleaner is a free on-demand scanner that specializes in adware, browser hijackers, and unwanted toolbars — the exact threats that mainstream antivirus programs often miss. It also includes tools that repair the damage malware leaves behind, like hijacked browser settings and malicious policies. It’s a quick scan that’s well worth running.

1. Download AdwCleaner

   Click the button below to download AdwCleaner — it’s free, portable, and requires no installation.

   

   Malwarebytes AdwCleanerRemoves adware and unwanted programs at no cost

   Download AdwCleanerOpens the official download page in a new tab.

2. Run AdwCleaner

   Open your Downloads folder and double-click the file named “adwcleaner.exe“. There’s no installation — the program starts right away.
   

   If Windows asks whether you want to allow AdwCleaner to run, click “Yes“. When the license agreement appears, click I agree to continue.

   

3. Enable “Reset Chrome policies”

   This setting removes malicious browser policies — a trick malware uses to lock your browser settings so you can’t change them back. Click “Settings” on the left side of the window, then turn on “Reset Chrome policies“.

   

4. Start the Scan

   Click “Dashboard” on the left side of the window, then click the “Scan” button.

   

5. Wait for the Scan to Finish

   AdwCleaner will now check your computer for adware and other malware. This usually takes only a few minutes — it’s one of the fastest scanners around.

   

6. Quarantine the Detected Threats

   When the scan finishes, AdwCleaner will list everything it found. Click the “Quarantine” button to remove all the malicious items at once.

   

7. Click “Continue” to Finish the Cleanup

   Save any open work first — AdwCleaner needs to close your open programs before it can clean. When you’re ready, click the “Continue” button.
   

   AdwCleaner will now delete all detected malware from your computer. If it asks you to restart your PC, allow it — your computer will be clean when you log back in.

STEP 7: Perform a final check with ESET Online Scanner

Finally, we’ll run ESET Online Scanner as a last sweep to confirm nothing was missed. If this scan comes back clean, your computer is malware-free.

ESET Online Scanner is a free second-opinion scanner that performs a deep, full-system check for viruses, trojans, rootkits, and other malware. We use it as the final step because it’s thorough — if anything slipped past the previous scans, ESET will find it. A clean result here means your computer is malware-free.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   

   ESET Online ScannerFree one-time malware scan from ESET

   Download ESET Online ScannerOpens the official download page in a new tab.

2. Run the Installer

   When the download finishes, open your Downloads folder and double-click “esetonlinescanner.exe“.
   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   On the Terms of use screen, click Accept.
   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.
   

4. Start a Full Scan

   Click Full Scan — this checks your entire computer, not just the common hiding spots.

   

   Select Enable for Detection of Potentially Unwanted Applications — this lets ESET catch adware and bundled junk programs, not just viruses. Then click Start scan.

   

5. Wait for the Scan to Finish

   ESET will now check every file on your computer. Because it’s a full scan, this can take a while — often an hour or more, depending on how much data you have. Leave it running in the background and check on it from time to time.

   

6. Review the Results

   When the scan completes, the Found and resolved detections screen appears. Any threats found were automatically cleaned and quarantined — there’s nothing extra you need to do. Click View detailed results if you want to see exactly what was removed.
   

   If ESET found nothing — congratulations, your computer has passed the final check and is malware-free.

That’s it — your Windows computer is now clean. The Trojans, adware, and any other malware have been removed.

Keep your PC protectedStop the next infection before it starts

If your antivirus let this threat through, it may not be enough on its own. Malwarebytes Premium adds real-time protection that blocks malware, ransomware, and malicious websites before they can infect your computer.See Malwarebytes Premium

If you are still having problems with your computer after completing these instructions, then please follow one of the steps:

• Run a computer scan with ESET Online Scanner
• Ask for help in our Windows Malware Removal Help & Support forum.