Full Report
One of the most effective attack methods I've analyzed this year runs on legitimate tools and willing users — and AV and EDR is blind to it.
Analysis Summary
# Tool/Technique: ClickFix (Social Engineering & LOLBAS Execution)
## Overview
ClickFix is a highly effective social engineering technique and Malware-as-a-Service (MaaS) industrialized attack methodology. It tricks users into manually executing malicious commands by presenting fake technical error messages (e.g., Google Meet microphone errors, browser updates, or CAPTCHA failures). The core of the attack relies on the victim copying a malicious command to their clipboard—often via hidden JavaScript—and manually pasting it into a system utility like PowerShell or the Windows Run dialog.
## Technical Details
- **Type:** Technique / Malware-as-a-Service (MaaS)
- **Platform:** Windows, macOS
- **Capabilities:** Clipboard hijacking, credential theft, session token harvesting, fileless malware delivery, and bypassing EDR/AV through user-initiated execution.
- **First Seen:** Industrialized variants emerged/scaled significantly in 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]** (Watering hole/Fake pages)
- **[TA0002 - Execution]**
- **[T1204.002 - User Execution: Malicious File]** (User pastes and runs command)
- **[T1059.001 - Command and Scripting Interpreter: PowerShell]**
- **[TA0005 - Defense Evasion]**
- **[T1218 - System Binary Proxy Execution]** (Use of signed binaries like mshta.exe)
- **[T1027.011 - Obfuscation/Decoding: Steganography]** (Often used in payloads)
- **[TA0009 - Collection]**
- **[T1115 - Clipboard Data]** (Manipulating the clipboard via JS)
## Functionality
### Core Capabilities
- **Deceptive Lures:** Uses pixel-perfect HTML/JS templates mimicking trusted services (Google, Cloudflare, Microsoft) to claim a technical issue exists.
- **Automated Clipboard Injection:** JavaScript silently overwrites the user's clipboard with a base64-encoded or obfuscated command the moment they interact with the page.
- **Living off the Land (LOLBAS):** Leverages legitimate, signed system tools (PowerShell, `mshta.exe`, `curl`, `rundll32.exe`) to fetch and execute payloads.
### Advanced Features
- **Fileless Execution:** Payloads are frequently downloaded directly into memory, leaving no traditional file artifacts on the disk for AV to scan.
- **MaaS Infrastructure:** Kits include domain rotation, malvertising integration, and ready-made lure templates for a subscription fee (ranging from $250/month to $1,800 for lifetime).
## Indicators of Compromise
- **File Names:** Frequently uses legitimate system processes; malicious payloads often masquerade as temporary updates or system DLLs.
- **Network Indicators:**
- Traffic to known infostealer C2s (e.g., Lumma, Vidar).
- Domains mimicking legitimate services (e.g., `google-verify[.]com`, `cloudflare-captcha[.]net` - *examples of common patterns*).
- **Behavioral Indicators:**
- `Powershell.exe` or `cmd.exe` spawned with long, base64-encoded strings or calls to `mshta.exe`.
- `curl` or `wget` commands downloading scripts from non-standard domains via the command line.
- Unexpected calls to `Add-Type` or `Reflection.Assembly` in PowerShell.
## Associated Threat Actors
- **Lumma Stealer** affiliates
- **Vidar/StealC** operators
- **Common MaaS users** leveraging "ClickFix" kits
## Detection Methods
- **Behavioral Detection:** Monitor for "User-Initiated" execution of LOLBAS tools containing `Invoke-Expression` (IEX) or web-request commands.
- **EDR Tuning:** Create alerts for PowerShell commands that interact with the clipboard or involve suspicious encoding.
- **YARA Rules:** Target the specific HTML/JavaScript patterns used in the "fake error" landing pages.
## Mitigation Strategies
- **User Awareness:** Train users to never paste commands from a website into a terminal or Run dialog, regardless of the site's perceived legitimacy.
- **PowerShell Constrained Language Mode:** Restrict the ability of PowerShell to execute complex scripts and API calls.
- **ASR Rules:** Implement Attack Surface Reduction (ASR) rules to block process creations from Office communication apps or browsers that involve scripting engines.
- **Clipboard Security:** Disable or monitor programmatic clipboard access from browsers where possible.
## Related Tools/Techniques
- **Lumma Stealer:** Often the primary payload delivered by ClickFix.
- **Amadey/Vidar:** Common secondary payloads.
- **Browser-in-the-Browser (BitB):** A related phishing technique focusing on fake UI elements.