Full Report
Doris searched for ChatGPT and ended up in a BEC scam. See how ClickFix, a stolen session cookie, and a hidden inbox rule chain into an OH $#!T moment.
Analysis Summary
# Incident Report: ClickFix to BEC Session Hijacking
## Executive Summary
A user ("Doris") was compromised after clicking a malicious sponsored search result for ChatGPT, which led to a "ClickFix" social engineering attack. By executing a malicious command under the guise of fixing a browser error, the attacker stole an active Microsoft 365 session cookie, bypassing Multi-Factor Authentication (MFA). The threat actor then performed mailbox manipulation to intercept a legitimate financial transaction, completing a Business Email Compromise (BEC) cycle within 24 hours.
## Incident Details
- **Discovery Date:** October 2026 (Reported)
- **Incident Date:** Within a 24-hour window circa October 2026
- **Affected Organization:** Not disclosed (Referred to as "Doris")
- **Sector:** Likely Professional Services/Finance (involved in invoicing)
- **Geography:** Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** T-0h
- **Vector:** Search Engine Poisoning (Sponsored Result) / Social Engineering
- **Details:** The user searched for ChatGPT and clicked a sponsored link. The site presented a fake "prove you're not a robot" error, instructing the user to copy-paste a command into the Windows Power User (PowerShell) prompt—a technique known as **ClickFix**.
### Lateral Movement
- **Date/Time:** T+1h to T+4h
- **Details:** The attacker used the executed command to exfiltrate session cookies. With these cookies, the attacker accessed the victim's Microsoft 365 account, bypassing MFA. Movement was strictly within the SaaS environment (Identity/Email) rather than the local network.
### Data Exfiltration/Impact
- **Date/Time:** T+4h to T+24h
- **Details:** The attacker monitored the inbox for financial communications. They identified a legitimate pending invoice, rerouted the communication using hidden rules, and provided fraudulent payment instructions to a client/vendor.
### Detection & Response
- **Detection:** Huntress SOC identified suspicious `curl` commands on the endpoint and anomalous M365 activity (mismatched browsers and VPN IP addresses).
- **Response:** Remediation of the local endpoint and purging of unauthorized M365 mailbox rules.
## Attack Methodology
- **Initial Access:** ClickFix (Malicious PowerShell command execution via social engineering).
- **Persistence:** Hidden Microsoft 365 inbox rules (redirecting/deleting emails to hide attacker activity).
- **Privilege Escalation:** Not applicable (Session hijacking provided full user-level access immediately).
- **Defense Evasion:** Use of legitimate system tools (`PowerShell`, `curl`); session hijacking to bypass MFA; hidden mailbox rules to evade user detection.
- **Credential Access:** Session Cookie Theft (Pass-the-Cookie).
- **Discovery:** Mailbox searching for keywords like "invoice," "payment," or "wire."
- **Lateral Movement:** Pivot from endpoint compromise to Cloud Identity (M365).
- **Collection:** Interception of email correspondence.
- **Exfiltration:** Exfiltration of session tokens to C2.
- **Impact:** Financial fraud via Business Email Compromise.
## Impact Assessment
- **Financial:** High potential (Attempted redirection of business invoices).
- **Data Breach:** Compromise of full mailbox contents and active session tokens.
- **Operational:** Minimal disruption to uptime, but high disruption to accounting workflows.
- **Reputational:** Risk to client trust due to intercepted billing communications.
## Indicators of Compromise
- **Network:** Traffic to known VPN providers associated with attacker logins; defanged C2 domains (e.g., `hxxps[:]//clckfix-assets[.]com`).
- **File/Host:** Execution of `cmd.exe /c` or `powershell.exe` involving `curl` commands initiated by a browser process.
- **Behavioral:** Mismatched User-Agent strings (e.g., a Chrome session suddenly used by a headless browser or different OS); new Outlook rules moving mail to "RSS Subscriptions" or "Deleted Items."
## Response Actions
- **Containment:** Revoked all active Microsoft 365 sessions and reset the user's password.
- **Eradication:** Deleted malicious inbox rules and cleared local temporary browser files/malicious scripts.
- **Recovery:** Restored normal email flow and alerted the accounting department to verify all recent wire instructions.
## Lessons Learned
- **The "MFA is Enough" Myth:** Session hijacking (Pass-the-Cookie) renders traditional MFA ineffective once the session is established.
- **Human Element:** Attackers are moving away from complex exploits toward high-pressure social engineering ("Fix your browser to continue").
- **Visibility Gaps:** Endpoint monitoring alone would miss the mailbox rules; identity monitoring alone might miss the initial PowerShell execution.
## Recommendations
- **User Training:** Specifically educate staff on the "ClickFix" tactic—no legitimate site will ask a user to paste code into a command prompt.
- **Technical Controls:** Implement Token Binding or Continuous Access Evaluation (CAE) in M365 to limit the utility of stolen cookies.
- **Monitoring:** Deploy integrated EDR and MDR solutions that correlate endpoint telemetry with SaaS identity logs (e.g., Huntress).
- **Policy:** Restricted PowerShell execution policies for non-administrative users.