An emerging ClickFix-style campaign tricks users into opening PowerShell and executing a malicious command, kicking off a complex attack chain designed to establish a foothold inside enterprise networks.
Threat actors in recent years have increasingly relied on ClickFix for social engineering campaigns. Generally, a user visits a compromised or attacker-controlled website, only to be told they need to paste a command into Windows Run or MacOS's Terminal. The command usually connects to an attacker-controlled server, which typically downloads and installs infostealers or other types of malware.
The reason it's called ClickFix is that the victim is typically presented with instructions to "fix" a problem, complete a verification step, or troubleshoot a browser issue by running a command supplied by the attacker. One variant sees the attacker drawing potential victims into a fake Zoom call through a browser; technical problems arise with sound or video, and victims are told they must paste a command to fix the issue.
Microsoft recently detailed a ClickFix-variant campaign the company dubbed "TerminalFix," in which attackers deploy fake Cloudflare CAPTCHA overlays at the start of a "sophisticated" attack chain. In order to complete the CAPTCHA, the user is told to open Windows Terminal or PowerShell and paste a malicious command (which was silently copied to the clipboard) within. Although Terminal and PowerShell aren't technically the same thing, modern Windows installs open Terminal into PowerShell by default.
While attackers can use Windows Run to launch a short downloader that retrieves additional payloads, Microsoft argues that directing users into PowerShell increases the likelihood that longer, more complex scripts execute successfully. This complexity facilitates attacks against larger enterprises easier than a "straightforward" ClickFix attack would, which stands to reason, as the campaign targets organizations across multiple industries, according to Microsoft researchers.
A Single Command Leads to a Complex Attack Chain
As for this specific campaign, the initial PowerShell command downloads and launches a zip archive containing a malicious DLL for sideloading, which kicks off the rest of the attacker's complex attack chain. It downloads payloads concealed inside PNG images, establishes dual persistence through Registry Run keys and scheduled tasks, conducts domain reconnaissance, and deploys a "Python-based reverse-tunnel C2 implant that tunnels arbitrary TCP traffic back through an encrypted WebSocket channel to attacker infrastructure," according to the Microsoft's blog post.