Full Report
That "friendly" prompt is a ClickFix scam. Learn about this advanced social engineering tactic that tricks users into running malicious code on their own systems, and why security resilience is your winning bet.
Analysis Summary
# Tool/Technique: ClickFix (Social Engineering Attack)
## Overview
ClickFix is an advanced social engineering technique that tricks users into manually executing malicious code on their own systems. Unlike traditional phishing that relies on malicious links or attachments, ClickFix presents the user with a "technical issue" (such as a browser error, font problem, or human verification failure) and provides a "fix" that involves copying and pasting commands into a system terminal (PowerShell or Command Prompt).
## Technical Details
- **Type:** Technique / Social Engineering Lure
- **Platform:** Windows, macOS (predominantly Windows via PowerShell/CMD)
- **Capabilities:** Bypassing browser security sandboxes, bypassing MFA (via session theft), execution of loaders, and delivery of second-stage malware.
- **First Seen:** Activity surged significantly in late 2023/early 2024; currently accounts for over 50% of observed malware loader activity according to industry reports.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059.001 - Command and Scripting Interpreter: PowerShell]
- **[TA0005 - Defense Evasion]**
- [T1132 - Data Encoding] (often used in the clipboard command)
- [T1562.001 - Impair Defenses: Disable or Modify Tools]
## Functionality
### Core Capabilities
- **Direct Command Execution:** Forces the user to bypass all browser-level protections by manually running commands in a high-privileged shell.
- **Clipboard Interaction:** The malicious website provides a "Copy" button that places a Base64-encoded or obfuscated string into the user's clipboard.
- **Shortcut Rituals:** Instructs users to use keyboard shortcuts (e.g., `Win + R`, `Ctrl + V`, `Enter`) to bypass the "security fatigue" of traditional downloads.
### Advanced Features
- **Dynamic Content Replacement:** The lure often appears as a fake overlay on legitimate-looking sites or compromised pages, imitating Google Chrome, Microsoft Word, or Adobe Reader errors.
- **MFA Bypass:** By installing infostealers, ClickFix facilitates the theft of session tokens, rendering Multi-Factor Authentication ineffective.
## Indicators of Compromise
- **File Names:** `AnyDesk.exe` (fake installers), `Fix.ps1`, `update.js`
- **Network Indicators:**
- `d-tech[.]support` (Defanged)
- `github[.]com/clickfix-repo` (Example of host abuse)
- Various ephemeral C2 domains used for initial script hosting.
- **Behavioral Indicators:**
- `PowerShell.exe` or `cmd.exe` launched via `explorer.exe` with long, Base64-encoded strings in the arguments.
- Unexpected use of `mshta.exe` or `certutil.exe` to download remote payloads.
- System clipboard content containing PowerShell `IEX` (Invoke-Expression) strings.
## Associated Threat Actors
- **TA571** (Known for massive spam campaigns delivering IcedID and Qakbot)
- **Lumma Stealer Affiliates**
- **Matanbuchus** (Loader)
- **MetaStealer** operators
## Detection Methods
- **Behavioral Detection:** Monitor for PowerShell or CMD processes initiated by `explorer.exe` or `WinR` that contain keywords like `iex`, `powershell -enc`, or `System.Net.WebClient`.
- **Clipboard Monitoring:** EDR tools can be configured to flag or block the execution of commands that originated from browser-based clipboard copies.
- **URL Filtering:** Block known "fix-it" domains and suspicious GitHub/Pastebin links often used as script repositories.
## Mitigation Strategies
- **User Education:** Train staff to never copy and paste commands from a website into a terminal, regardless of how legitimate the "error" looks.
- **Endpoint Hardening:** Implement PowerShell Constrained Language Mode and use AppLocker or Windows Defender Application Control (WDAC) to prevent unauthorized script execution.
- **Attack Surface Reduction (ASR):** Enable rules that block process creations from Office communication apps or unauthorized shells.
## Related Tools/Techniques
- **Browser-in-the-Browser (BitB):** Similar social engineering focus on visual deception.
- **OAuth Consent Phishing:** Another method of gaining access without traditional malware.
- **Lumma Stealer:** Frequently delivered via ClickFix prompts.
- **MetaStealer:** A variant often observed in fake installer ClickFix campaigns.