Full Report
Recorded Future's Insikt GroupⓇ has been tracking ClickFix, a social engineering technique that turns a familiar logo or verification prompt into the entry point for an attack. Here's what that research reveals about catching it, and why it's now running inside Malicious Site Monitoring, part of our newly launched Digital Risk Protection solution.
Analysis Summary
# Tool/Technique: ClickFix
## Overview
ClickFix is a sophisticated social engineering technique that bypasses traditional technical exploits by tricking users into executing malicious commands themselves. It leverages "visual trust" by mimicking familiar interfaces—such as CAPTCHA prompts, brand logos, or "verify you're human" screens—to convince victims to copy and paste a script into their system terminal (PowerShell for Windows or Terminal for macOS). The victim essentially becomes the delivery mechanism for the malware.
## Technical Details
- **Type:** Social Engineering / Malware Delivery Technique
- **Platform:** Windows, macOS
- **Capabilities:** OS-specific payload delivery, brand impersonation, credential/access facilitation, evasion of static file-based detection.
- **First Seen:** Early-to-mid 2024 (Widely reported by Insikt Group in mid-2024)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0002 - Execution]**
- **[T1204.002 - User Execution: Malicious File]** (In this case, User Execution of commands)
- **[T1059.001 - Command and Scripting Interpreter: PowerShell]**
- **[T1059.002 - Command and Scripting Interpreter: AppleScript]**
- **[TA0005 - Defense Evasion]**
- **[T1027 - Obfuscated Files or Information]**
## Functionality
### Core Capabilities
- **Browser-Based Deception:** Displays high-fidelity fake overlays (e.g., Google Chrome update errors, CAPTCHA failures) that appear native to the browser or OS.
- **Clipboard Hijacking (Instructional):** Directs the user to copy a malicious string and paste it into a command prompt under the guise of "fixing" a display or connectivity error.
- **OS Awareness:** The technique detects the visitor's User-Agent to provide tailored instructions (e.g., `Win + R` then `powershell` for Windows users).
### Advanced Features
- **Dynamic Infrastructure:** Utilizes disposable phishing domains and lookalike sites that are frequently rotated to evade domain blacklists.
- **Template Clustering:** Attackers reuse the same underlying HTML/CSS structures across multiple unrelated domains to maintain scale.
- **Evasion of Sandboxing:** Because the site contains no exploit code or direct downloads, automated sandboxes often flag the page as "clean."
## Indicators of Compromise
*Note: Specific hashes are often unique to the final payload (e.g., Lumma Stealer, Vidar), but the technique focuses on the following:*
- **Network Indicators (Defanged):**
- Phishing domains often use TLDs like `.top`, `.xyz`, or `.cfd`.
- Lookalike domains: `fix-chrome-issue[.]com`, `verify-human[.]net`.
- **Behavioral Indicators:**
- `powershell.exe` or `cmd.exe` launched via `explorer.exe` following a browser session.
- Users copying large, encoded Base64 strings from a browser and immediately pasting them into a terminal.
- Execution of `mshta.exe` or `curl | bash` patterns originating from user input.
## Associated Threat Actors
- **UNC4990** (Known for using similar "copy-paste" lures)
- **Various Stealer-as-a-Service Affiliates** (Distributing Lumma Stealer, RedLine, or Rhadamanthys)
## Detection Methods
- **Behavioral Detection:** Monitoring for suspicious parent-child process relationships (e.g., browser to terminal) and command-line arguments containing `iex(New-Object Net.WebClient).DownloadString(...)`.
- **Screenshot Analysis & OCR:** Using automated tools to identify known "ClickFix" visual templates (e.g., the specific "Click to Fix" button layout).
- **Network Monitoring:** Flagging new domains with high "content similarity" to known ClickFix templates, even if the domain name itself is benign.
## Mitigation Strategies
- **User Education:** Train employees to recognize that legitimate services (Google, Microsoft, Cloudflare) will **never** ask a user to copy-paste code into PowerShell or Terminal to "fix" a webpage.
- **Endpoint Hardening:** Restrict PowerShell execution policies and monitor for unauthorized use of `mshta.exe` or `certutil.exe`.
- **Attack Surface Reduction:** Implement ASR rules to block credential stealing from the Windows local security authority subsystem (LSASS) and to block process creations originating from suspicious scripts.
## Related Tools/Techniques
- **ClearFake:** A similar social engineering campaign using fake browser updates.
- **EtherHiding:** A technique using Binance Smart Chain smart contracts to host malicious scripts.
- **Browser-in-the-Browser (BitB):** A related visual deception technique using fake login windows.