ClickFix Tradecraft Evolves Beyond Clipboard-Based Attacks

Summary

ClickFix is a social engineering technique that tricks users into running malicious commands through fake browser verification prompts. Threat actors continue to evolve the method to deliver a wide range of payloads, including RATs, loaders, and infostealers. Newer variants incorporate steganographic delivery and browser-cache-seeded execution chains.

Investigation

Huntress investigated multiple ClickFix variants involving malvertising, typosquatting, and SEO poisoning campaigns. Researchers identified attack chains using Node.js-based RATs such as DuskDesk, DLL sideloading with legitimate Microsoft binaries, and PNG steganography to conceal executable payloads. The investigation also revealed lateral movement activity targeting domain controllers through native Windows protocols.

Mitigation

Organizations should train users not to paste commands from web pages into terminals or Run dialogs. Technical controls should include application allowlisting, blocking execution from user-writable locations such as Temp, and monitoring for suspicious scheduled tasks or Run keys. Restricting local administrator privileges is also strongly recommended.

Response

When ClickFix activity is detected, security teams should focus on suspicious behavior sequences rather than relying only on static IOCs. Look for browsers spawning cmd.exe or PowerShell, unexpected archives appearing in Temp directories, and newly created scheduled tasks. Investigate unauthorized reverse SSH tunnels and unusual network connections originating from node.exe.

Simulation Execution

• Attack Narrative & Commands: The adversary utilizes a social engineering tactic (ClickFix) where a user is prompted to “fix” a browser error by running a downloaded file. In this simulation, we mimic this by having the user launch a .bat file from a folder, which in turn spawns cmd.exe to execute a PowerShell command. This creates the specific telemetry (cmd.exe spawning PowerShell and the execution of a .bat file) that the rule is designed to catch.

• Regression Test Script:

  # Simulation Script: ClickFix-style behavior
  # 1. Create a dummy batch file to mimic a downloaded payload
  $batchPath = "$env:TEMPupdate_fix.bat"
  "@echo off`npowershell.exe -NoProfile -ExecutionPolicy Bypass -Command `"Write-Host 'Simulating Payload Delivery...'`"" | Out-File -FilePath $batchPath -Encoding ascii
  
  # 2. Execute the batch file (This triggers the 'selection_batch' part of the rule)
  Write-Host "[!] Executing simulated malicious batch file..."
  Start-Process "cmd.exe" -ArgumentList "/c $batchPath" -Wait
  
  # 3. Simulating PowerShell spawned from explorer (This triggers 'selection_powershell')
  # Note: To simulate explorer.exe parentage in a script, we use a sub-shell approach
  Write-Host "[!] Simulating PowerShell spawning from Explorer context..."
  Start-Process "powershell.exe" -ArgumentList "-NoProfile -Command `"Write-Host 'Simulated PowerShell from Explorer'`""

• Cleanup Commands:

  # Cleanup: Remove the simulated malicious files
  Remove-Item -Path "$env:TEMPupdate_fix.bat" -ErrorAction SilentlyContinue
  Write-Host "[+] Cleanup complete."