Full Report
John Hammond and Greg Linares with Huntress discuss the top tradecraft we’ve seen this year so far, from ClickFix attacks to deepfake social engineering
Analysis Summary
# Tool/Technique: ClickFix (and variants)
## Overview
ClickFix is a sophisticated social engineering technique that weaponizes the "copy and paste" function. Attackers trick users into manually executing malicious commands under the guise of "fixing" a technical issue, such as a broken CAPTCHA or a browser error. By convincing the user to perform the action, attackers bypass many automated security controls that would typically block a direct download or execution of a malicious file.
## Technical Details
- **Type:** Technique / Social Engineering
- **Platform:** Windows, macOS, Linux
- **Capabilities:** Execution of arbitrary commands, delivery of infostealers, cross-platform compatibility.
- **First Seen:** Early variants (LummaStealer) observed in 2024; significant evolution and diversification in 2025.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]**
- **[TA0002 - Execution]**
- **[T1204.002 - User Execution: Malicious File]** (Tricking user to paste into Run/Terminal)
- **[T1059 - Command and Scripting Interpreter]**
- **[TA0005 - Defense Evasion]**
- **[T1132 - Data Encoding]** (Commands often encoded or obfuscated in the clipboard)
## Functionality
### Core Capabilities
- **Weaponized Copy-Paste:** Displays a prompt containing a malicious command and instructs the user to paste it into a system utility (Run dialog, PowerShell, or Terminal).
- **Lure Diversity:** Uses fake "Broken CAPTCHA" screens, "Cloudflare Turnstile" verification failures, or "Google Chrome Update" prompts.
- **System Utility Abuse:** Primarily targets the `Win+R` (Run) dialog in Windows to execute PowerShell or CMD strings.
### Advanced Features
- **Cross-Platform Adaptation:** Specific instructions for Mac (Command+Space → Terminal) and Linux (Alt+F2).
- **FileFix Variant:** A sub-technique that instructs users to paste malicious strings directly into the Windows File Explorer address bar.
- **Protocol Handler Abuse:** Integration with the `ms-search:` (Windows search) protocol handler to trigger infection chains via MSI packages disguised as PDFs.
---
# Tool/Technique: MetaStealer
## Overview
MetaStealer is a commodity information stealer (infostealer) malware sold on underground forums. In 2025, it has been frequently observed as the final payload in ClickFix-style attack chains.
## Technical Details
- **Type:** Malware Family (Infostealer)
- **Platform:** Windows
- **Capabilities:** Credential harvesting, file exfiltration, browser data theft.
- **First Seen:** Circa 2022
## MITRE ATT&CK Mapping
- **[TA0006 - Credential Access]**
- **[T1555 - Credentials from Password Stores]**
- **[TA0009 - Collection]**
- **[T1005 - Data from Local System]**
- **[TA0010 - Exfiltration]**
- **[T1041 - Exfiltration Over C2 Channel]**
## Functionality
- **Credential Harvesting:** Steals saved passwords, cookies, and auto-fill data from web browsers.
- **System Discovery:** Collects hostnames and hardware specifications.
- **Data Exfiltration:** Sends stolen data to attacker-controlled C2 servers.
## Indicators of Compromise
- **File Names:** Fake AnyDesk installers, `document.pdf` (disguised MSI packages).
- **Behavioral Indicators:**
- Launching `powershell.exe` or `cmd.exe` via `explorer.exe` (Run dialog).
- Unexpected use of the `ms-search` protocol handler.
- Outbound connections to known commodity C2 IP ranges.
## Associated Threat Actors
- **Groups:** Various financially motivated cybercriminals; originally associated with LummaStealer distributors.
## Detection Methods
- **Behavioral Detection:** Monitor for instances where `explorer.exe` is the parent process of `powershell.exe` with highly encoded command-line arguments.
- **Clipboard Monitoring:** EDR solutions can be configured to flag or block specific CLI-related strings being copied from a web browser context.
## Mitigation Strategies
- **Technical Hardening:**
- Disable the `Win+R` Run dialog box via Group Policy (GPO).
- Disable the `Win+X` Power Menu.
- Disable "Copy to Clipboard" functionality from untrusted browser prompts where possible.
- **User Training:** Educate staff that legitimate services (Google, Cloudflare, AnyDesk) will never ask a user to copy and paste code into a command prompt or the Run dialog to "fix" a page.
## Related Tools/Techniques
- **LummaStealer:** The malware family that pioneered the ClickFix lure.
- **Deepfake Social Engineering:** AI-enabled voice/video lures used to drive users toward these infection chains.
- **ViewState Deserialization:** Used in conjunction with exposed ASP.NET machine keys for server-side compromise.