ClickFix is a social engineering technique that tricks users into running malicious commands through fake browser verification prompts. Threat actors continue to evolve the method to deliver a wide range of payloads, including RATs, loaders, and infostealers. Newer variants incorporate steganographic delivery and browser-cache-seeded execution chains.
Huntress investigated multiple ClickFix variants involving malvertising, typosquatting, and SEO poisoning campaigns. Researchers identified attack chains using Node.js-based RATs such as DuskDesk, DLL sideloading with legitimate Microsoft binaries, and PNG steganography to conceal executable payloads. The investigation also revealed lateral movement activity targeting domain controllers through native Windows protocols.
Organizations should train users not to paste commands from web pages into terminals or Run dialogs. Technical controls should include application allowlisting, blocking execution from user-writable locations such as Temp, and monitoring for suspicious scheduled tasks or Run keys. Restricting local administrator privileges is also strongly recommended.
When ClickFix activity is detected, security teams should focus on suspicious behavior sequences rather than relying only on static IOCs. Look for browsers spawning cmd.exe or PowerShell, unexpected archives appearing in Temp directories, and newly created scheduled tasks. Investigate unauthorized reverse SSH tunnels and unusual network connections originating from node.exe .
Attack Narrative & Commands: The adversary utilizes a social engineering tactic (ClickFix) where a user is prompted to “fix” a browser error by running a downloaded file. In this simulation, we mimic this by having the user launch a .bat file from a folder, which in turn spawns cmd.exe to execute a PowerShell command. This creates the specific telemetry (cmd.exe spawning PowerShell and the execution of a .bat file) that the rule is designed to catch.
Attack Narrative & Commands: The adversary utilizes a social engineering tactic (ClickFix) where a user is prompted to “fix” a browser error by running a downloaded file. In this simulation, we mimic this by having the user launch a .bat file from a folder, which in turn spawns cmd.exe to execute a PowerShell command. This creates the specific telemetry (cmd.exe spawning PowerShell and the execution of a .bat file) that the rule is designed to catch.
Regression Test Script: # Simulation Script: ClickFix-style behavior # 1. Create a dummy batch file to mimic a downloaded payload $batchPath = "$env:TEMPupdate_fix.bat" "@echo off`npowershell.exe -NoProfile -ExecutionPolicy Bypass -Command `"Write-Host 'Simulating Payload Delivery...'`"" | Out-File -FilePath $batchPath -Encoding ascii # 2. Execute the batch file (This triggers the 'selection_batch' part of the rule) Write-Host "[!] Executing simulated malicious batch file..." Start-Process "cmd.exe" -ArgumentList "/c $batchPath" -Wait # 3. Simulating PowerShell spawned from explorer (This triggers 'selection_powershell') # Note: To simulate explorer.exe parentage in a script, we use a sub-shell approach Write-Host "[!] Simulating PowerShell spawning from Explorer context..." Start-Process "powershell.exe" -ArgumentList "-NoProfile -Command `"Write-Host 'Simulated PowerShell from Explorer'`""
Regression Test Script:
Cleanup Commands: # Cleanup: Remove the simulated malicious files Remove-Item -Path "$env:TEMPupdate_fix.bat" -ErrorAction SilentlyContinue Write-Host "[+] Cleanup complete."
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
