Ongoing ClickFix Campaign

Background

There have been reports of threat actors using a social engineering technique known as ClickFix to trick potential victims into executing malicious commands under the pretense of providing “quick fixes” for common computer issues. ClickFix has reportedly targeted organisations across a broad range of sectors, including the technology, financial services, manufacturing, wholesale and retail, government, professional and legal services, utilities and energy.

What is ClickFix?

ClickFix is a relatively new social engineering technique increasingly used by threat actors in their campaign. This technique misleads targeted users into applying supposed “quick fixes” for common computer issues, such as performance issues, missing drivers or pop-up errors. Since it's initial reports in 2024, ClickFix has resulted in multiple malware distribution campaigns involving compromised websites, malicious distribution infrastructure and e-mail phishing.

Tactics, Techniques and Procedures (TTPs)

The ClickFix technique relies on clipboard hijacking, where malicious software secretly intercepts and modifies information that victims copy and paste on their devices. It typically uses dialogue boxes containing fake error messages to trick victims into copying malicious script or commands on their own clipboards using ClickFix inject before providing instructions to paste and run the malicious content. In recent months, threat actors have also been observed to use fake verification pages requesting victims to complete an action before redirecting them to their intended webpage. An example of a ClickFix campaign pop-up message is shown in Annex A.

The victims typically follow a three-step process that enables the execution of malicious PowerShell commands:

1. Open a Windows Run dialog box

2. Automatically or manually copy and paste a malicious PowerShell command into the terminal [press 'CTRL+V'] 

3. And run the prompt [press ‘Enter’] 

Because the ClickFix technique relies on users pasting the content, this is sometimes referred to as “pastejacking.” Threat actors often use the ClickFix technique as an initial infection vector to deploy malicious payloads such as infostealers, remote access trojans (RATs) or disable existing security tools. 

This delivery method bypasses many standard detection and prevention controls, as the attack does not depend on any exploit, attachment or malicious link. Instead, potential victims unknowingly run the malicious command themselves, through a trusted system shell. This method makes infections from ClickFix more difficult to detect than drive-by downloads or traditional malware droppers.

Impact

Successful execution of the ClickFix technique can lead to the deployment of various malware families, including the NetSupport RAT, Latrodectus, and Lumma Stealer, resulting in credential theft, data exfiltration, email account compromise, and potential ransomware incidents. Threat actors can utilise their access to compromised systems to perform privilege escalation and move laterally across other systems within the network.

How to Protect Your Organisations

Organisations are advised to adopt the following mitigation measures to safeguard against the ClickFix Campaign:

• Remain vigilant against fake “CAPTCHA” or “Fix It” prompts and recognise the tell-tale signs (e.g. unexpected run-dialog instructions) of the ClickFix campaign.

• Update your systems, applications and software to the latest versions and use an up-to-date anti-virus software to detect malware and malicious phishing links. 

• Implement Security Information and Event Management (SIEM) solutions to perform logging, asset visibility, and continuous system monitoring to detect anomalous network connections and malicious PowerShell commands.

• Enforce strict access control policies, ensuring users and systems only have the minimum permissions necessary. This limits the impact of a successful compromise by preventing privilege escalation and lateral movement.

• Implement application whitelisting to allow only approved software and scripts to execute, effectively blocking unknown executables and malicious PowerShell scripts typically used in ClickFix campaigns.

Administrators may wish to consider tracking and blocking the Indicators of Compromise (IOCs) associated with the ClickFix campaign. Possible IOCs associated with the ClickFix campaign are shown in the table below:

Annex A: Example of a ClickFix Campaign Pop-up Message

More information is available here:

https://www.proofpoint.com/uk/blog/threat-insight/security-brief-clickfix-social-engineering-technique-floods-threat-landscape

https://www.logpoint.com/en/blog/emerging-threats/clickfix-another-deceptive-social-engineering-technique/

https://www.kaspersky.com/blog/what-is-clickfix/53348/