ClickFix Deception: A Social Engineering Tactic to Deploy Malware

Authored by Yashvi Shah and Vignesh Dhatchanamoorthy

McAfee Labs has found a extremely uncommon methodology of malware supply, referred to by researchers because the “Clickfix” an infection chain. The assault chain begins with customers being lured to go to seemingly official however compromised web sites. Upon visiting, victims are redirected to domains internet hosting faux popup home windows that instruct them to stick a script right into a PowerShell terminal.

The “ClickFix” an infection chain represents a complicated type of social engineering, leveraging the looks of authenticity to control customers into executing malicious scripts. These compromised web sites are sometimes fastidiously crafted to look real, rising the probability of person compliance. As soon as the script is pasted and executed within the PowerShell terminal, it permits the malware to infiltrate the sufferer’s system, doubtlessly resulting in information theft, system compromise, or additional propagation of the malware.

We’ve got noticed malware households resembling Lumma Stealer and DarkGate leveraging this system. Right here is the heatmap displaying the distribution of customers affected by the “Clickfix” method:

Determine 1:Prevalence for the final three months

Darkgate ingesting through “ClickFix”

DarkGate is a complicated malware identified for its means to steal delicate data, present distant entry, and set up persistent backdoors in compromised methods. It employs superior evasion ways and might unfold inside networks, making it a big cybersecurity risk.
McAfee Labs obtained a phishing e-mail from the spamtrap, having an HTML attachment.

Determine 2: E mail with Attachment

The HTML file masquerades as a Phrase doc, displaying an error immediate to deceive customers. This tactic is used to trick customers into taking actions that might result in the obtain and execution of malicious software program.

Determine 3: Shows extension downside difficulty

As proven, the pattern shows a message stating, “The ‘Phrase On-line’ extension is NOT put in in your browser. To view the doc offline, click on the ‘Easy methods to repair’ button.”

Earlier than clicking on this button, let’s study the underlying code. Upon inspecting the code, it was found that there have been a number of base64-encoded content material blocks current. Of explicit significance was one discovered inside the