ClickFix Phishing Campaign Disguised as a Claude Installer

Summary

A phishing campaign used the ClickFix technique to distribute a malicious MSIX bundle disguised as the Claude AI installer. Initial execution relied on mshta launched through the Windows Run utility with a specially crafted URL. The downloaded payload contained an HTA file that built an obfuscated PowerShell stage, bypassed AMSI, retrieved additional PowerShell content, and executed a process injection routine using encrypted shellcode. The activity was observed across customer environments in both Europe and the United States and was detected through Rapid7 InsightIDR coverage.

Investigation

Rapid7 analysts identified mshta execution linked to the RunMRU registry key and captured the URL download-version.1-5-8.com/claude.msixbundle. Analysis showed that the MSIX archive included an HTA file that decoded obfuscated strings, assembled a PowerShell command, overwrote the AMSI context, and ultimately injected shellcode through native Windows API calls. Researchers also found that several follow-on PowerShell stages were downloaded from dynamically generated URLs derived from a hash built from the victim’s computer name and username.

Mitigation

Defenders should monitor the RunMRU registry key for suspicious mshta entries and block mshta execution when it originates from untrusted sources. Organizations should also restrict downloads of MSIX packages from unknown domains and enforce application allow-listing for PowerShell execution. AMSI protections should remain enabled, and PowerShell logging should be configured to capture encoded or obfuscated command activity for investigation.

Response

When this activity is detected, security teams should isolate the affected endpoint, preserve the command-line artifacts, and conduct forensic analysis of the downloaded PowerShell stages and any injected processes. Credentials used on the impacted system should be reset, and browser history should be reviewed to trace the initial lure. Detection logic should also be updated to include the observed domains, hashes, and related execution patterns.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Objective: Execute a malicious PowerShell payload that is both base‑64 encoded and embedded with .NET assembly calls to perform process injection, mimicking a typical “living‑off‑the‑land” attack.
  2. Steps:
     • Create a small .NET assembly (C#) that calls OpenProcess and WriteProcessMemory (simulated via PowerShell’s [System.Runtime.InteropServices.Marshal]).
     • Encode the PowerShell script containing Invoke-Expression, FromBase64String, and a reference to System.Management.Automation.AmsiUtils (used to bypass AMSI).
     • Append a dummy marker 0x41414141 to emulate “padding” often seen in obfuscation.
     • Launch the script using powershell.exe with the full command line visible (so the detection rule can see the strings).

• Regression Test Script:

  # ==============================================================
  # Simulated malicious PowerShell execution to trigger Sigma rule
  # ==============================================================
  # 1. Build a simple .NET payload (inline, for demo purposes)
  $cs = @'
  using System;
  using System.Runtime.InteropServices;
  public class Injector {
      [DllImport("kernel32.dll", SetLastError = true)]
      public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);
      [DllImport("kernel32.dll", SetLastError = true)]
      public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesWritten);
  }
  '@
  Add-Type -TypeDefinition $cs -Language CSharp
  
  # 2. Craft the malicious PowerShell snippet
  $malicious = @'
  $b64 = "aW1wb3J0IHN5c3RlbS5JTy5TY3JpcHQgJ1Rlc3QnLCBJVkU="
  $decoded = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($b64))
  Invoke-Expression $decoded
  $dummy = 0x41414141
  '@
  
  # 3. Encode the snippet (Base64, UTF-16LE as PowerShell expects)
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($malicious)
  $encoded = [Convert]::ToBase64String($bytes)
  
  # 4. Launch PowerShell with the encoded command
  $cmd = "powershell.exe -NoProfile -WindowStyle Hidden -EncodedCommand $encoded"
  Write-Host "Launching malicious PowerShell..."
  Start-Process -FilePath "powershell.exe" -ArgumentList "-NoProfile -EncodedCommand $encoded" -WindowStyle Hidden
  
  # Note: The above command line will contain the strings:
  #   Invoke-Expression, FromBase64String, System.Management.Automation.AmsiUtils, 0x41414141
  # which satisfy the Sigma detection condition.

• Cleanup Commands:

  # Terminate any stray PowerShell instances launched by the test
  Get-Process -Name powershell | Where-Object {$_.StartInfo.Arguments -match "EncodedCommand"} | Stop-Process -Force
  
  # Remove any temporary modules or variables (if they were persisted)
  Remove-Variable -Name b64, decoded, dummy -ErrorAction SilentlyContinue

End of Report