Hackers Using ClickFix Tactics to Deploy Malware

McAfee Labs researchers have identified a sophisticated malware delivery method, “ClickFix,” using advanced social engineering to trick users into executing malicious scripts, leading to severe security breaches. This article explores the intricacies of ClickFix, its implications, and protective measures.

All about ClickFix

The ClickFix infection chain starts by luring users to seemingly legitimate but compromised websites. These sites redirect victims to domains with fake popups, instructing them to paste a script into a PowerShell terminal.

Once the script is executed in the PowerShell terminal, the malware infiltrates the victim’s system, leading to data theft, system compromise, or further malware propagation.

This method’s sophistication lies in exploiting users’ trust in seemingly authentic websites and prompts.

Two notable malware families, Lumma Stealer and DarkGate, have been leveraging the ClickFix technique.

Lumma Stealer extracts sensitive information like passwords and credit card details from infected systems. DarkGate is more advanced, providing remote access, establishing persistent backdoors, and using evasion tactics to avoid detection. This combination of malware and the ClickFix technique poses a significant challenge for cybersecurity professionals.

The Impact of Phishing Emails

McAfee Labs identified a phishing email with an HTML attachment posing as a Word document. These emails are pivotal in the ClickFix infection chain, using error prompts to trick users into downloading and executing malicious software.

The phishing email tactic is effective because it exploits users’ familiarity with common file types and error messages, presenting a seemingly legitimate problem and solution to increase the likelihood of executing the malicious script.

Upon examining the HTML attachment’s code, researchers found several base64-encoded content blocks containing the malicious script. Users were instructed to paste this script into their PowerShell terminal, which, once executed, initiates the malware download and installation process.

Encoding and disguising the malicious script within encoded blocks highlights the attackers’ sophistication, making it more difficult for automated security systems to detect and block the threat.

To defend against the ClickFix infection chain and similar threats, consider these precautions:

• Verify Email Sources: Confirm the sender’s identity before opening unexpected attachments or emails from unknown sources.
• Avoid Script Pasting: Refrain from pasting scripts or commands from untrusted sources into your terminal or command prompt.
• Update Security Tools: Keep your security software current to detect and block advanced threats effectively.
• Stay Informed: Stay updated on cybersecurity threats and educate others on best practices for online safety.

IoCs