ClickFix Malware Campaign Returns With New Delivery Tactics

Summary

A new ClickFix campaign has been identified using fake Cloudflare verification pages to target both macOS and Windows users. The campaign utilizes malicious domains to host deceptive content and distribute malware. The specific malware payload could not be retrieved during this investigation due to server errors and resolution failures.

Investigation

The investigator analyzed the traffic generated by the fake verification pages and identified a chain of URLs hosted on a specific malicious domain. Attempts to retrieve the malware for Windows resulted in a 403 Forbidden error, while the macOS-specific command led to a domain that failed to resolve. The investigation focused on the URL patterns and the hosting infrastructure used for the deceptive scripts.

Mitigation

Users should be educated to recognize fake verification pages and avoid executing commands or downloading files suggested by unexpected browser prompts. Organizations should implement web filtering to block known malicious domains identified in this campaign. Monitoring for unusual process executions following web-based interactions is also recommended.

Response

Upon detection of communication with the identified malicious domains, isolate the affected host from the network. Conduct a forensic analysis of the endpoint to determine if any commands were executed or if malware was successfully downloaded. Review web proxy logs to identify other potentially compromised internal hosts communicating with the identified infrastructure.

Simulation Execution

• Attack Narrative & Commands: The adversary has successfully social-engineered a user into visiting a fake “Cloudflare Verification” page. As the page loads, the browser automatically makes several requests to the attacker-controlled domain js-static.cfd to pull in deceptive visual elements (fonts and logos) and the core malicious logic (embed.js). This simulation uses curl to mimic the browser’s GET requests for these specific URLs to trigger the proxy-based detection rule.

• Regression Test Script:

  #!/bin/bash
  # ClickFix Campaign Simulation Script
  # Purpose: Generate telemetry matching the Sigma rule patterns
  
  echo "[*] Starting ClickFix Simulation..."
  
  # Target Domain: js-static.cfd
  # Simulating various URLs identified in the detection logic
  
  echo "[+] Simulating: Loading malicious embed script..."
  curl -s -o /dev/null "http://js-static.cfd/embed.js?v=24"
  
  echo "[+] Simulating: API telemetry hit..."
  curl -s -o /dev/null "http://js-static.cfd/api/s/hit"
  
  echo "[+] Simulating: Loading fake Cloudflare assets (Logo/Fonts)..."
  curl -s -o /dev/null "http://js-static.cfd/static/CF-Logo%201.png"
  curl -s -o /dev/null "http://js-static.cfd/static/fonts/jetbrains-mono-600.woff2"
  
  echo "[+] Simulating: API track event..."
  curl -s -o /dev/null "http://js-static.cfd/api/track/event"
  
  echo "[*] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # No persistent changes made to the system. 
  # If files were downloaded, remove them.
  rm -f embed.js CF-Logo*.png
  echo "[*] Cleanup complete."