Full Report
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read
Analysis Summary
# Tool/Technique: ClickFix (Malicious Copy and Paste)
## Overview
ClickFix is a sophisticated social engineering technique that gains initial access to enterprise networks by tricking users into executing malicious code via their system clipboard. Unlike traditional attacks, it does not rely on software exploits, email attachments, or direct file downloads. Instead, it presents a fake technical issue (e.g., a browser error or verification failure) and instructs the user to copy a "fix" and paste it into a trusted system utility (like PowerShell or Terminal).
## Technical Details
- **Type**: Technique / Initial Access Framework
- **Platform**: Windows (Primary), macOS (Targeted/In-reserve), Linux (Targeted/In-reserve)
- **Capabilities**: Clipboard hijacking, Evasion of browser reputation checks, Blockchain-based C2 resolution (EtherHiding), Anti-analysis server-side filtering.
- **First Seen**: Late 2023 (Active and evolving through 2026)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- **T1204.004 - User Execution: Malicious Copy and Paste** (Specific sub-technique assigned March 2025)
- **TA0002 - Execution**
- **T1059 - Command and Scripting Interpreter**
- **TA0005 - Defense Evasion**
- **T1564.010 - Control via Blockchain** (EtherHiding)
- **T1027 - Obfuscated Files or Information**
## Functionality
### Core Capabilities
- **Browser Overlay Lures**: Injects scripts into compromised websites (e.g., WordPress) to display fake Cloudflare verification pages, browser update errors, or document rendering failures.
- **Socially Engineered Execution**: Forces users to manually copy malicious commands and paste them into a system terminal, bypassing most automated file-scanning defenses.
- **Living-off-the-Land (LotL)**: Commands are executed by the user within native, signed binaries (e.g., PowerShell), making the activity appear as legitimate administrative work.
### Advanced Features
- **EtherHiding (On-chain Infrastructure)**: Uses read-only calls to smart contracts on the **Polygon blockchain** to retrieve encoded lure hostnames. This prevents takedowns as the compromised site contains no hardcoded attacker domain.
- **Multi-Stage Resolution**: Leverages decentralized or trusted platforms (Polygon RPCs, Telegram channel descriptions, Steam profiles) to resolve C2 addresses.
- **Dynamic Targeting**: Server-side checks identify the visitor's OS and version. It can suppress mobile users or hide the lure from repeat visitors (90-day cookie) to evade researchers.
## Indicators of Compromise
- **File Hashes**: *Specific hashes vary by campaign as this is a delivery framework for various info-stealers.*
- **Network Indicators**:
- `polygon-rpc[.]com` (Abused for EtherHiding)
- Encoded strings within Polygon smart contracts.
- Abused legitimate platforms: `telegram[.]org`, `steamcommunity[.]com` (used for C2 resolution).
- **Behavioral Indicators**:
- Unexplained launches of `powershell.exe`, `cmd.exe`, or macOS `Terminal`.
- Commands involving `Get-Clipboard` or IEX (Invoke-Expression) following a web session.
- Interactive users pasting large, encoded blocks of text into system shells.
## Associated Threat Actors
- **State-sponsored groups** (various)
- **Cybercrime-as-a-Service (CaaS)** operators using it as a subscription product.
## Detection Methods
- **Behavioral Detection**: Monitor for terminal processes launched with suspicious command-line arguments immediately following web browser activity. Look for "paste" events followed by script execution.
- **Endpoint Detection & Response (EDR)**: Alert on signed system binaries (PowerShell, Terminal) making unusual outbound network connections to non-standard domains or blockchain RPCs.
- **Clipboard Monitoring**: Security tools that scan the clipboard for high-entropy scripts or known malicious command patterns.
## Mitigation Strategies
- **User Education**: Train staff specifically on the "Copy-Paste" threat; emphasize that legitimate services (like Cloudflare or Microsoft) will never ask a user to paste code into a terminal to "fix" a browser issue.
- **Attack Surface Reduction**: Use policies to restrict PowerShell execution (e.g., Constrained Language Mode) and block access to known public blockchain RPC providers if not required for business.
- **Hardening**: Implement "Pasting" restrictions in sensitive environments or use GPOs to limit which users can execute interactive shells.
## Related Tools/Techniques
- **EtherHiding**: The specific blockchain-based C2 redirection method used by ClickFix.
- **ClearFake / Taibi**: Similar social engineering campaigns involving fake browser updates.
- **Information Stealers**: Lumma, Vidar, or StealC (often the final payload).