The ClickFix campaign variant uses social engineering to induce victims to run commands via the Windows Run dialog, leveraging rundll32.exe to execute remote payloads over WebDAV tunneled through HTTPS port 443. Payloads are invoked by ordinal export #1, not by named functions, complicating detection. The campaign features evolving obfuscation methods including WMI process spawning, caret insertion, and runtime string assembly to evade automated detection. It also abuses trusted Windows binaries such as pcalua.exe to disrupt process lineage tracking. No files are written to disk during the attack, making traditional file-based detection ineffective. The campaign has successfully exfiltrated browser credentials and sensitive documents. The most advanced variants have bypassed automated EDR detection and were identified only through focused threat hunting on ordinal execution techniques.

The campaign enables attackers to execute remote payloads without dropping files to disk, evading many traditional detection mechanisms. It results in credential theft and exfiltration of sensitive documents (approximately 13MB). The use of trusted Windows binaries and obfuscation techniques complicates detection and forensic analysis. The threat has not been observed exploiting a specific vulnerability but relies on social engineering and abuse of legitimate Windows functionality.

No official patch or fix is available as this is a social engineering and living-off-the-land technique rather than a software vulnerability. Mitigation should focus on user awareness training to resist social engineering attempts, monitoring for unusual use of rundll32.exe and pcalua.exe, and proactive threat hunting for ordinal execution patterns and WebDAV connections over HTTPS. Endpoint detection and response (EDR) solutions should be tuned to detect these behaviors, although the most obfuscated variants may evade automated detection. Network controls could consider monitoring or restricting WebDAV traffic tunneled over HTTPS if feasible. Since no files are dropped, file-based detection is ineffective.