Full Report
Move past basic credential harvesting. Discover how modern attackers use ClickFix, BitB, and OAuth consent phishing—and how to train your users with Huntress SAT.
Analysis Summary
# Tool/Technique: ClickFix (and Evolved Phishing Tradecraft)
## Overview
ClickFix is a sophisticated social engineering technique that bypasses traditional browser security controls and "download anxiety." Instead of delivering a malicious executable, it manipulates users into manually executing malicious code via native system tools (like the Windows Command Prompt or Terminal) under the guise of solving technical issues or passing a CAPTCHA.
## Technical Details
- **Type:** Technique / Social Engineering Framework
- **Platform:** Windows (primarily), macOS (specifically Go-based crypto-drainers)
- **Capabilities:** Command execution, credential theft, infostealer deployment, RAT/RMM installation, crypto-wallet draining.
- **First Seen:** Active through 2024–2026 (Modern evolved tradecraft).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File (via Command Line)]
- [T1059 - Command and Scripting Interpreter]
- **[TA0005 - Defense Evasion]**
- [T1553 - Subvert Trust Controls] (Bypassing browser warnings)
## Functionality
### Core Capabilities
- **Social Engineering Interception:** Uses fraudulent overlays (DocuSign, CAPTCHA, or "Fix it" prompts) to intercept user workflow.
- **Keyboard Shortcut Weaponization:** Guides users through a sequence of `Win + R` (Run dialog), `Ctrl + V` (Paste), and `Enter` to execute commands.
- **Bypassing Gatekeeper/SmartScreen:** Since the user manually pastes the command into a native system process, the browser never triggers a "suspicious download" warning.
### Advanced Features
- **FileFix / TerminalFix / DownloadFix:** Variants that adapt based on the target OS or the specific native tool being exploited.
- **ConsentFix:** A related technique targeting OAuth consent flows to hijack Microsoft 365 accounts without needing the user's password.
- **AI-Assisted Phishing:** Use of tools like Google Gemini to generate clean, link-free phishing lures that evade traditional email filters.
## Indicators of Compromise
- **File Names:** Often disguised as legitimate system updates or document verification tools.
- **Network Indicators (Defanged):**
- `phishingdefense[.]org` (Used for simulations/training)
- Various attacker-controlled domains hosting the clipboard content or secondary payloads.
- **Behavioral Indicators:**
- Unusual `cmd.exe` or `powershell.exe` child processes spawned from the `Run` dialog.
- High frequency of "Paste" actions followed immediately by execution in a terminal environment.
- Unexpected outbound connections from system tools to unknown external IPs.
## Associated Threat Actors
- Broadly used by Cybercriminal groups specializing in:
- Infostealers (Redline, Lumma)
- Crypto-drainers (Go-based macOS variants)
- Initial Access Brokers (IABs)
## Detection Methods
- **Behavioral detection:** Monitoring for PowerShell or CMD strings containing `IEX` (Invoke-Expression), `Base64` encoded commands, or direct web requests (e.g., `curl`, `wget`, `Invoke-WebRequest`) initiated by users.
- **EDR/ITDR:** Monitoring for unauthorized OAuth app registrations (Consent Phishing) and suspicious browser-to-terminal process trees.
- **Chokepoint Strategy:** Identifying the specific point where a user interaction leads to an administrative system command.
## Mitigation Strategies
- **User Education:** Move beyond "check the URL" training to teach users never to copy-paste commands into the Terminal/Run box from a website.
- **System Hardening:** Restrict PowerShell execution policies and use Attack Surface Reduction (ASR) rules to block process creation from Office or browsers.
- **Identity Security:** Implement strict OAuth application consent policies (admin consent required) to prevent ConsentFix attacks.
- **MFA:** While ClickFix bypasses some MFA, robust Phishing-Resistant MFA (FIDO2) remains a critical layer.
## Related Tools/Techniques
- **BitB (Browser-in-the-Browser):** Using fake browser windows to steal credentials.
- **OAuth Consent Phishing:** Tricking users into granting permissions to a malicious third-party app.
- **Device Code Phishing:** Exploiting the device pairing flow to gain access to corporate accounts.