A ClickFix cluster: Observed activity from recent ClickFix campaigns

The ClickFix cluster consists of multiple malware campaigns employing three distinct delivery mechanisms that share common traits such as DLL sideloading, consistent file-naming conventions, and command-and-control dead drops. The first campaign uses remotely hosted MSI installers containing legitimate software to sideload malicious DLLs. The second campaign leverages NodeJS to run JavaScript files, while the third uses Python 3.5 to hide and execute payloads. All campaigns originate from ClickFix-themed lures and employ aggressive social engineering tactics, including direct phone contact that guides victims to compromised WordPress sites. After initial compromise, the attackers perform extensive discovery commands and Active Directory enumeration. The infrastructure and tactics overlap with the Lorem Ipsum malware family and Vanilla Tempest operations, indicating a potential ransomware deployment objective.

Successful exploitation leads to system compromise through DLL sideloading, script execution, and payload concealment. Attackers gain extensive visibility into the victim environment via discovery commands and Active Directory enumeration, enabling further lateral movement or data collection. The campaigns may culminate in ransomware deployment, posing significant risk to confidentiality, integrity, and availability of affected systems.

No official patches or fixes are applicable as this is a malware campaign rather than a software vulnerability. Mitigation should focus on user awareness to resist social engineering, blocking known malicious domains and hashes associated with the campaigns, and monitoring for indicators of compromise such as suspicious MSI installations, NodeJS and Python script executions, and unusual Active Directory queries. Organizations should also secure WordPress sites to prevent compromise used in these campaigns.