Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

SecurityWeek

SANS ISC Handlers Diary

Threatpost

Dark Reading

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The ClickFix social engineering technique has gained popularity among threat actors, targeting thousands of devices globally. It tricks users into executing malicious commands on their devices by exploiting their tendency to solve minor technical issues. The technique often impersonates legitimate brands and combines with delivery vectors like phishing and malvertising. ClickFix campaigns typically lead users to a visual lure, such as a landing page, instructing them to run commands in the Windows Run dialog. This user interaction element helps bypass conventional security solutions. Various malware, including infostealers and remote access tools, are delivered through ClickFix attacks. The technique has evolved to target macOS users and is being sold as part of malware kits on hacker forums.

The ClickFix social engineering technique is a sophisticated attack method that exploits users' inclination to resolve minor technical issues on their devices. It primarily targets Windows and macOS users by impersonating legitimate brands and leveraging delivery vectors such as phishing emails and malvertising campaigns. The attack typically directs victims to a visually convincing landing page that instructs them to execute specific commands via the Windows Run dialog or equivalent macOS mechanisms. This user-driven execution bypasses many traditional security controls that rely on detecting automated or unauthorized code execution. Once the user runs the commands, various malware payloads are deployed, including infostealers, remote access tools (RATs), and other malicious software such as MintsLoader, ScreenConnect, DarkGate, Atomic macOS Stealer (AMOS), Latrodectus, Lampion, and Lumma Stealer. These payloads enable attackers to exfiltrate sensitive information, maintain persistent access, and potentially control the compromised systems remotely. The technique has evolved to target macOS users, expanding its reach beyond Windows environments. Additionally, ClickFix is commoditized and sold as part of malware kits on underground hacker forums, facilitating widespread adoption by threat actors. Indicators of compromise include specific file hashes, IP addresses, and URLs associated with the campaign. The attack leverages multiple MITRE ATT&CK techniques such as T1053.005 (Scheduled Task/Job: Scheduled Task), T1543 (Create or Modify System Process), T1566 (Phishing), T1204 (User Execution), and T1071 (Application Layer Protocol), among others, highlighting its multi-faceted approach to infection and persistence.

Detailed information about Think before you Click(Fix): Analyzing the ClickFix social engineering technique. Get real-time updates, technical details, and mitig

Think before you Click(Fix): Analyzing the ClickFix social engineering technique - Live Threat Intelligence - Threat Radar | OffSeq.com

Think before you Click(Fix): Analyzing the ClickFix social engineering technique

Title	Severity	Type	Source	Date

Threats Tagged 'windows run dialog'

Filter Threats

Threats Tagged 'windows run dialog'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility