Full Report
Learn how ClickFix techniques like FileFix, TerminalFix, and DownloadFix trick users into compromising. Then, learn proven detection methods using chokepoint strategies and behavioral analytics.
Analysis Summary
# Tool/Technique: ClickFix (and variants FileFix, TerminalFix)
## Overview
ClickFix is a sophisticated social engineering and malicious copy-and-paste technique designed to bypass traditional security controls by tricking users into manually executing malicious code. The attack presents victims with a fake error message (often disguised as a Cloudflare verification or a browser document error) and provides "instructions" to fix the issue. These instructions involve copying a malicious command to the clipboard and pasting it directly into native system utilities like the Windows Run dialog, PowerShell, or Terminal.
## Technical Details
- **Type:** Technique / Social Engineering Framework
- **Platform:** Windows, macOS, Linux
- **Capabilities:** Clipboard hijacking, defense evasion (via user-initiated execution), credential theft, and delivery of follow-on malware (e.g., Stealers, RATs).
- **First Seen:** Approximately late 2023 / early 2024 (Significant surge noted in 2025).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566 - Phishing
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- T1059.001 - Command and Scripting Interpreter: PowerShell
- **TA0005 - Defense Evasion**
- T1132 - Data Encoding (Base64)
- T1564.003 - Hidden Window
## Functionality
### Core Capabilities
- **Social Engineering Lures:** Uses highly convincing fake interstitials (e.g., Cloudflare "Verify You Are Human") or "Problem Report" pop-ups.
- **Clipboard Manipulation:** Automatically copies a malicious, often Base64-encoded, command to the user's clipboard upon a button click.
- **Manual Execution Path:** Relies on the user to open a trusted system tool (Win+R for Windows, Terminal for macOS/Linux) and paste the command, effectively bypassing browser-based security sandboxes.
### Advanced Features
- **FileFix Variant:** Instead of the Run dialog, it tricks users into pasting malicious paths or commands into the Windows File Explorer address bar.
- **Cross-Platform Adaptation:** Variants target macOS (abusing AppleScript/Terminal) and Linux (targeting government and defense sectors).
- **Headless Execution:** Uses `conhost.exe` or hidden PowerShell windows to execute follow-on payloads without leaving a visible trace for the user.
## Indicators of Compromise
- **File Names:** `conhost.exe` (abused), `powershell.exe` (abused).
- **Network Indicators:**
- `lumma[.]io` (Associated Stealer C2)
- `vidar[.]com` (Associated Stealer C2)
- Fake Cloudflare domains (e.g., `cloudflare-verify[.]tk`)
- **Behavioral Indicators:**
- `explorer.exe` spawning `powershell.exe` with long, Base64-encoded strings.
- Unusual clipboard activity followed immediately by the launch of `cmd.exe` or `powershell.exe`.
- Usage of `mshta.exe` or `bitsadmin.exe` to pull down secondary payloads.
## Associated Threat Actors
- **Lumma Stealer Affiliates**
- **BlueNoroff** (DPRK-linked, specifically for macOS variants)
- **APT36** (Transparent Tribe, specifically for Linux variants)
## Detection Methods
- **Behavioral Detection:** Monitor for native system processes (Run dialog, PowerShell) being launched with command lines containing `iex`, `powershell -enc`, or `mshta` immediately following browser activity.
- **Chokepoint Strategy:** Detect the specific "narrow passage" where the attacker must transition from the browser to the OS (e.g., monitoring parent-child process relationships involving `explorer.exe` and web browsers).
- **Clipboard Monitoring:** Implementing EDR rules that flag when a browser process modifies the clipboard with high-entropy or encoded strings.
## Mitigation Strategies
- **User Awareness Training:** Educate users that no legitimate service (Google, Cloudflare, Microsoft) will ever ask a user to "Copy and Paste" code into a Run dialog or Terminal to fix an error.
- **Attack Surface Reduction (ASR):** Implement rules to block process creations from Office communication apps or browsers that attempt to launch command prompts.
- **Restricting Scripting:** Disable or strictly control PowerShell and Windows Script Host (WSH) for non-administrative users where possible.
## Related Tools/Techniques
- **Browser-in-the-Browser (BitB):** Similar visual deception for credential harvesting.
- **SEO Poisoning:** Frequently used to drive victims to ClickFix-enabled websites.
- **Malvertising:** Used to distribute links to the initial compromise pages.