Variations of the ClickFix | Kaspersky official blog
Source Kaspersky Security Blog
United States
Russia
China
India
United Kingdom
Germany
France
Brazil
South Africa
Japan
Australia
Mexico
Turkey
Poland
Kazakhstan
Description
Finger, DNS-lookup, captcha, and other ways ClickFix techniques is being used in real world attacks.
Impact
If successful, ClickFix attacks can lead to significant security breaches including unauthorized remote access, data theft, and malware infection. Since the malicious commands run with the user's privileges, attackers can bypass many traditional security controls that rely on blocking unauthorized code execution. Infostealers can exfiltrate sensitive corporate or personal data, while remote access Trojans enable persistent control over compromised systems. The use of legitimate system utilities complicates detection and response, increasing dwell time and potential damage. Organizations may face operational disruption, financial loss, reputational damage, and regulatory consequences. The multi-stage nature and social engineering complexity mean that even security-aware environments can be vulnerable if users are not adequately trained. Cryptocurrency users are at risk of direct financial theft through JavaScript payloads. Overall, the threat poses a medium to high risk depending on the environment and user behavior.
Defensive guidance
Mitigation requires a multi-layered approach focused on both technical controls and user education. Specifically: 1) Implement strict application control policies to restrict execution of scripting utilities like PowerShell, mshta.exe, and command-line tools unless explicitly required and monitored. 2) Disable or block the Win+R shortcut on corporate devices to prevent easy access to the Run dialog for executing arbitrary commands. 3) Deploy Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) solutions capable of detecting suspicious use of legitimate utilities and anomalous network connections, including DNS queries to unknown servers. 4) Conduct targeted security awareness training emphasizing the risks of copying and executing commands from untrusted sources, including social engineering tactics involving captchas, fake software activation, or browser extensions. 5) Monitor network traffic for unusual Finger protocol activity or DNS requests to attacker-controlled domains. 6) Use application whitelisting to prevent unauthorized scripts or executables from running. 7) Employ multi-factor authentication and least privilege principles to limit the impact of compromised accounts. 8) Regularly audit and update endpoint security solutions to detect emerging ClickFix variants. 9) Consider external managed detection and response (MDR) services if internal resources are limited. 10) Educate cryptocurrency users about the dangers of executing JavaScript from untrusted sources in browsers.
Summary
The ClickFix technique represents a sophisticated social engineering attack vector where adversaries persuade victims to manually execute malicious commands on their computers, effectively running malware with the privileges of the active user. Initially, attackers used simple pretexts such as fixing a problem or passing a captcha, typically involving PowerShell scripts. Over time, attackers have diversified their approach, employing legitimate Windows utilities like mshta.exe to execute HTML applications that fetch and run malicious payloads, and leveraging outdated but supported protocols like Finger (TCP port 79) to download malware scripts. One variant involves convincing users to run commands that perform DNS lookups via nslookup against attacker-controlled DNS servers, which respond with malicious scripts that download further payloads. Another variant uses social engineering to distribute fake browser extensions that crash and prompt users to run commands that launch malware. Additionally, attackers have exploited cryptocurrency enthusiasts by spreading instructions to execute JavaScript in browsers that redirect funds to attacker wallets. These attacks rely heavily on clipboard manipulation, user interaction, and legitimate system tools, making detection challenging. Despite no known exploits in the wild at the time of reporting, the technique's evolution and real-world use cases demonstrate its effectiveness. Defenses include blocking common execution paths like Win+R, enhancing user security awareness, deploying endpoint detection and response (XDR) solutions, and leveraging external threat detection services.