Full Report
Discover how the ClickFix social engineering attack exploits human psychology to bypass security. Learn how hackers use this tactic and how to protect against it.
Analysis Summary
# Tool/Technique: ClickFix Social Engineering
## Overview
ClickFix is a sophisticated social engineering technique that tricks users into executing malicious commands on their local machines. Instead of traditional methods like credential harvesting or malicious attachments, ClickFix presents a fake technical error (e.g., a "Google Chrome update" error or a "failed CAPTCHA") and provides a "Fix" button. When clicked, it copies a malicious PowerShell script to the user's clipboard and instructs them to paste and execute it via the Windows Run dialog or PowerShell terminal, bypassing many browser-based security controls.
## Technical Details
- **Type:** Social Engineering Technique / Malware Delivery Vector
- **Platform:** Windows (Primary target), macOS (Potential via Terminal)
- **Capabilities:** Bypasses browser sandboxing, evades email filters (no attachments), facilitates Infostealer deployment, and enables initial access for ransomware.
- **First Seen:** Early 2024 (Increased prevalence documented in 2025-2026 reports)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link
- **TA0002 - Execution**
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1204.002 - User Execution: Malicious File/Link (User-initiated command execution)
- **TA0005 - Defense Evasion**
- T1132.001 - Data Encoding: Standard Encoding (Script obfuscation)
- T1027 - Obfuscated Files or Information
## Functionality
### Core Capabilities
- **Clipboard Hijacking:** Automatically copies a Base64-encoded or obfuscated PowerShell command to the user's clipboard when they click a "Fix" or "Verify" button.
- **Human-in-the-Loop Execution:** Relies on the user to manually open a terminal (Win+R -> cmd/powershell) and paste the command, which effectively bypasses "Mark of the Web" (MotW) protections that apply to downloaded files.
- **Dynamic Lures:** Uses overlays that mimic legitimate software errors from Google Chrome, Microsoft Word, or CAPTCHA providers.
### Advanced Features
- **MFA Bypass via Session Theft:** The technique is primarily used to deliver infostealers that exfiltrate session cookies, allowing attackers to bypass Multi-Factor Authentication (MFA) by hijacking active sessions.
- **Automated Infrastructure:** Integrated into Malware-as-a-Service (MaaS) panels, allowing various threat actors to deploy the lure via compromised websites.
## Indicators of Compromise
- **File Names:** Frequently downloads and executes temporary files like `fix.ps1`, `update.exe`, or random-string `.exe` files in `%TEMP%`.
- **Network Indicators:**
- `github[.]com/clonercds/` (Example of hosting malicious payloads)
- `update-service[.]net` (Defanged C2)
- `worker-verify[.]org` (Defanged)
- **Behavioral Indicators:**
- `explorer.exe` spawning `cmd.exe` or `powershell.exe` via the Run dialog.
- PowerShell commands containing `Invoke-Expression`, `IEX`, or `[System.Convert]::FromBase64String`.
- Unusual clipboard activity monitored via security tools.
## Associated Threat Actors
- **Lumma (LummaStealer) Affiliates**
- **Vidar Stealer operators**
- **TA571** (Known for large-scale spam and infection chains)
- **Ransomware groups** (Using it for initial access into corporate environments)
## Detection Methods
- **Behavioral Detection:** Monitor for instances where `powershell.exe` is launched with a command line containing `Get-Clipboard` or `pbpaste`.
- **EDR Alerts:** Trigger on PowerShell scripts attempting to connect to external IPs immediately after being launched via `explorer.exe`.
- **YARA Rule Concept:**
`rule ClickFix_PowerShell_Pattern { strings: $s1 = "powershell.exe -w hidden -c" $s2 = "FromBase64String" $s3 = "Set-Clipboard -Value $null" condition: all of them }`
## Mitigation Strategies
- **User Awareness:** Educate staff that legitimate software updates or CAPTCHAs will **never** ask a user to copy-paste commands into a terminal.
- **Hardening:** Disable or restrict PowerShell for non-administrative users via AppLocker or Windows Defender Application Control (WDAC).
- **Clipboard Monitoring:** Deploy security tools that can flag when a browser process writes executable script patterns to the system clipboard.
- **Attack Surface Reduction:** Use "Block process creations originating from RPC and SMB commands" and other ASR rules.
## Related Tools/Techniques
- **ClearFake:** A similar social engineering campaign using fake browser updates.
- **EtherHiding:** A technique using blockchain metadata to host malicious update URLs.
- **HTML Smuggling:** Often used in tandem to hide the initial malicious payload within a legitimate-looking HTML file.