Full Report
New RL research explains why ClickFix attacks are multiplying — and why reliable detection requires going beyond AV and EDR.
Analysis Summary
# Tool/Technique: ClickFix
## Overview
ClickFix is a sophisticated social engineering technique and delivery mechanism that tricks users into executing malicious commands via their system's clipboard. The attack typically presents a fake error message (such as a CAPTCHA failure or a browser update error) and instructs the user to copy a "fix" command and paste it directly into a terminal or "Run" dialog. This bypasses traditional security boundaries by turning the trusted user into the execution vector.
## Technical Details
- **Type:** Technique / Social Engineering Framework
- **Platform:** Windows (primarily), macOS (potential via terminal lures)
- **Capabilities:** Bypasses AV/EDR, executes in-memory payloads, facilitates Malware-as-a-Service (MaaS) delivery.
- **First Seen:** 2023
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (Watering hole or lure sites)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File (User pasting and running commands)
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1218 - System Binary Proxy Execution (mshta.exe, wscript.exe)
- **TA0005 - Defense Evasion**
- T1134 - Access Token Manipulation
- T1027 - Obfuscated Files or Information
- T1564.011 - Hide Artifacts: Living off the Land Binaries (LOLBins)
## Functionality
### Core Capabilities
- **Clipboard Hijacking:** The attack relies on the user clicking a button that copies a malicious Base64-encoded or obfuscated string to the system clipboard.
- **User-Driven Execution:** Relies on the user opening the Windows "Run" dialog (Win+R) or PowerShell and pasting the command, which avoids triggering alerts associated with automated file execution.
- **LOLBin Utilization:** Uses legitimate Windows binaries like `PowerShell.exe`, `mshta.exe`, `wscript.exe`, and `curl` to fetch and execute secondary payloads.
### Advanced Features
- **MaaS Infrastructure:** Distributed as attack kits ($250/mo - $1,800 lifetime) with built-in obfuscators and rotating C2 infrastructure.
- **Blockchain C2:** Some variants utilize Ethereum smart contracts for Command and Control, making the infrastructure immune to traditional domain takedowns.
- **Anti-Analysis:** Commands often include checks for sandboxes or virtual machine environments before deploying the final payload.
## Indicators of Compromise
- **File Hashes:** Specific hashes vary due to MaaS rotation; focus on PowerShell script fragments.
- **File Names:** Frequently uses temporary names or mimics system files (e.g., `fix.ps1`, `update.js`).
- **Network Indicators:**
- C2 domains often use top-level domains (TLDs) like `.top`, `.xyz`, or `.pw`.
- Use of decentralized storage or blockchain gateways (e.g., `ipfs[.]io`, `gateway[.]pinata[.]cloud`).
- **Behavioral Indicators:**
- `cmd.exe` or `powershell.exe` being launched via `explorer.exe` with long, Base64-encoded command line arguments.
- Unexpected use of `mshta.exe` reaching out to external URLs.
## Associated Threat Actors
- **Lumma Stealer Affiliates**
- **ACRStealer Operators**
- **Various MaaS (Malware-as-a-Service) subscribers**
## Detection Methods
- **Behavioral Detection:** Monitor for "PowerShell-from-Clipboard" patterns—specifically when a shell is launched with a long command-line argument immediately following a browser interaction.
- **YARA Rules:** ReversingLabs suggests using YARA to identify the HTML/JS templates used in ClickFix lure pages (e.g., searching for specific "Copy and Paste" instruction strings in web code).
- **Endpoint Monitoring:** Flagging unusual `mshta.exe` or `wscript.exe` network connections.
## Mitigation Strategies
- **User Education:** Train employees to never copy-paste commands from websites into a terminal or Run prompt, regardless of how legitimate the "error" looks.
- **Attack Surface Reduction:** Restrict the execution of PowerShell for non-administrative users or enforce Constrained Language Mode.
- **Binary Blocking:** Disable or strictly monitor LOLBins like `mshta.exe` and `wscript.exe` if they are not required for business operations.
## Related Tools/Techniques
- **Lumina Stealer:** Often the final payload delivered by ClickFix.
- **EtherHiding:** A technique using smart contracts to hide malicious scripts, frequently paired with ClickFix lures.
- **ClearFake:** A similar social engineering campaign using fake browser update overlays.