ClickFix Deception: A Social Engineering Tactic to Deploy Malware

Authored by Yashvi Shah and Vignesh Dhatchanamoorthy

McAfee Labs has found a extremely uncommon technique of malware supply, referred to by researchers because the “Clickfix” an infection chain. The assault chain begins with customers being lured to go to seemingly respectable however compromised web sites. Upon visiting, victims are redirected to domains internet hosting pretend popup home windows that instruct them to stick a script right into a PowerShell terminal.

The “ClickFix” an infection chain represents a classy type of social engineering, leveraging the looks of authenticity to control customers into executing malicious scripts. These compromised web sites are sometimes rigorously crafted to look real, growing the probability of consumer compliance. As soon as the script is pasted and executed within the PowerShell terminal, it permits the malware to infiltrate the sufferer’s system, doubtlessly resulting in information theft, system compromise, or additional propagation of the malware.

We’ve noticed malware households akin to Lumma Stealer and DarkGate leveraging this method. Right here is the heatmap exhibiting the distribution of customers affected by the “Clickfix” method:

Determine 1:Prevalence for the final three months

Darkgate ingesting by way of “ClickFix”

DarkGate is a classy malware recognized for its means to steal delicate data, present distant entry, and set up persistent backdoors in compromised methods. It employs superior evasion techniques and may unfold inside networks, making it a big cybersecurity menace.
McAfee Labs obtained a phishing electronic mail from the spamtrap, having an HTML attachment.

Determine 2: E-mail with Attachment

The HTML file masquerades as a Phrase doc, displaying an error immediate to deceive customers. This tactic is used to trick customers into taking actions that would result in the obtain and execution of malicious software program.

Determine 3: Shows extension downside subject

As proven, the pattern shows a message stating, “The ‘Phrase On-line’ extension is NOT put in in your browser. To view the doc offline, click on the ‘The right way to repair’ button.”

Earlier than clicking on this button, let’s look at the underlying code. Upon inspecting the code, it was found that there have been a number of base64-encoded content material blocks current. Of explicit significance was one discovered throughout the