A social engineering tactic known as ClickFix has rapidly emerged as one of the most prevalent initial access vectors for cybercriminals. Unlike traditional phishing, which seeks to steal credentials through fake login pages or to persuade users to download suspicious attachments, ClickFix evades security software by getting victims to manually run malicious scripts on their own devices. Threat actors compromise legitimate websites, establish fraudulent domains, or distribute malicious email attachments that display counterfeit error messages. These scenarios may include:
- Fake Browser & Application Errors: Alerts that appear to come from Google Chrome, MS Word, or OneDrive, warning that a page or document failed to load.
- Imposter CAPTCHAs: Pop-ups that mimic "Verify You Are Human" checks (reCAPTCHA or Cloudflare).
- Spoofed Services: Fake error screens styled after tools like Google Meet, Discord, or GitHub.
When users click the prompt, the website automatically copies a hidden malicious code to the clipboard. The on-screen instructions then guide the victim through a simple sequence: open the Windows Run box (Win + R) or Terminal/PowerShell, paste the contents (Ctrl + V), and press Enter. The pasted code executes a background script (typically via Living-off-the-Land Binaries such as PowerShell) that silently downloads infostealers or remote access trojans (RATs), including Lumma Stealer, NetSupport RAT, or AsyncRAT. These can hijack browser passwords, crypto wallets, session cookies, and corporate accounts.
Recommendations
- Avoid clicking links and opening attachments in unsolicited emails.
- Confirm requests from senders via contact information obtained from verified and official sources.
- Users should only submit account credentials on official websites.
- Maintain robust and up-to-date endpoint detection tools on every endpoint.
- Consider leveraging behavior-based detection tools rather than signature-based tools.
- If you suspect an account has been compromised, change the account's password immediately and ensure MFA is enabled for all online accounts.
- Review the Don't Take the Bait! Phishing and Other Social Engineering Attacks NJCCIC product for more information on common phishing and social engineering attacks.