ClickFix Cluster Analysis: Tactics Across Recent Campaigns

Summary

Adversaries are using ClickFix social engineering tactics to deliver malicious payloads through MSI packages, NodeJS, and Python scripts. These campaigns rely on techniques including DLL sideloading, scheduled tasks for persistence, and web-based dead drops for command-and-control. The activity reflects increasingly sophisticated delivery methods designed to establish an initial foothold.

Investigation

The Field Effect team identified three separate campaign variants: MSI-based sideloading, NodeJS-driven execution, and a Python-based technique using blockchain-backed domain retrieval. The investigation uncovered shared infrastructure, particularly the use of Digital Point forum profiles as dead drop resolvers. The presence of Supper backdoor TTPs also suggests a possible connection to Vanilla Tempest.

Mitigation

Defensive priorities should include application control policies that restrict PowerShell, CMD, and Terminal execution for non-privileged users. Organizations should provide social engineering training focused specifically on ClickFix and copy-paste lures. Deploying advanced MDR capabilities is also recommended to detect unusual command execution patterns.

Response

If ClickFix activity is detected, responders should identify the initial infection vector, such as a browser-based lure, and isolate affected endpoints immediately. Host discovery should determine whether the system is domain-joined and assess signs of lateral movement or credential theft. Scheduled tasks and registry Run keys should also be reviewed for persistence.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands: An adversary has successfully executed a ClickFix social engineering attack. To facilitate lateral movement and ensure persistent access, the attacker first needs to determine if the device is Azure AD joined or Hybrid joined to decide on the next stage of credential theft. They run dsregcmd.exe /status for reconnaissance. Following this, they use a PowerShell one-liner to download a malicious Node.js-based stager from a remote server using Invoke-WebRequest. This mimics the behavior of automated post-compromise scripts used in recent observed campaigns.

• Regression Test Script:

  # Simulation Script: ClickFix Post-Compromise Behavior
  
  Write-Host "[+] Starting Simulation: ClickFix TTPs" -ForegroundColor Cyan
  
  # Step 1: Reconnaissance - Check device registration status
  Write-Host "[*] Executing: dsregcmd.exe /status" -ForegroundColor Yellow
  Start-Process "dsregcmd.exe" -ArgumentList "/status" -Wait
  
  # Step 2: Payload Delivery - Use Invoke-WebRequest to simulate downloading a stager
  # We use a benign URL (google.com) to avoid actual malicious traffic during testing
  Write-Host "[*] Executing: PowerShell Invoke-WebRequest" -ForegroundColor Yellow
  powershell.exe -Command "Invoke-WebRequest -Uri 'https://www.google.com' -OutFile '$env:TEMPsim_payload.txt'"
  
  # Step 3: Command Execution - Use Invoke-Expression to simulate script execution
  Write-Host "[*] Executing: PowerShell Invoke-Expression" -ForegroundColor Yellow
  powershell.exe -Command "Invoke-Expression 'Write-Output "Simulated Payload Executed"'"
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  Write-Host "[+] Cleaning up simulation artifacts..." -ForegroundColor Cyan
  if (Test-Path "$env:TEMPsim_payload.txt") {
      Remove-Item "$env:TEMPsim_payload.txt" -Force
      Write-Host "[*] Removed: $env:TEMPsim_payload.txt"
  }
  Write-Host "[+] Cleanup Complete." -ForegroundColor Green