Mastodon

Threat InsightState-sponsored threat actors often leverage techniques first developed and deployed by cybercriminal actors. One example is <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a>, a highly effective technique that involves clever <a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#socialengineering</a>.Listen as Proofpoint threat research experts Selena Larson, Sarah Sabotka, and Saher Naumaan deep dive into how modern <a href="https://infosec.exchange/tags/espionage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#espionage</a> and <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybercrime</a> are increasingly blurring lines.Stream DISCARDED now: Apple Podcasts: <a href="https://brnw.ch/21wSNbM" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://brnw.ch/21wSNbM</a> Spotify: <a href="https://brnw.ch/21wSNbL" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://brnw.ch/21wSNbL</a> Web player: <a href="https://brnw.ch/21wSNbN" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://brnw.ch/21wSNbN</a>

Taggart :donor:Reposting this since the first go-round coincided with some hosting trubz.Here's a quick review of some of the easy wins against <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a>!<a href="https://taggart-tech.com/clickfix/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://taggart-tech.com/clickfix/</a>

2rZiKKbOU3nTafniR2qMMSE0gwZRansomware group uses ClickFix to attack businesses The Interlock ransomware group is using the C... <a href="https://www.kaspersky.co.uk/blog/interlock-ransomware-clickfix-attack/28962/" rel="nofollow noopener noreferrer" target="_blank">https://www.kaspersky.co.uk/blog/interlock-ransomware-clickfix-attack/28962/</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/Business" target="_blank">#Business</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/Enterprise" target="_blank">#Enterprise</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/SMB" target="_blank">#SMB</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/attacks" target="_blank">#attacks</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/browsers" target="_blank">#browsers</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/Captcha" target="_blank">#Captcha</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/ClickFix" target="_blank">#ClickFix</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/cryptomalware" target="_blank">#cryptomalware</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/keyloggers" target="_blank">#keyloggers</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/PowerShell" target="_blank">#PowerShell</a> <a rel="nofollow noopener noreferrer" class="mention hashtag" href="https://mastodon.social/tags/ransomware" target="_blank">#ransomware</a> <a href="https://awakari.com/pub-msg.html?id=GVzLMElRaPkGGclMuXH7ydyQXvU&interestId=2rZiKKbOU3nTafniR2qMMSE0gwZ" rel="nofollow noopener noreferrer" target="_blank">Result Details</a>

Pyrzout :vm:iClicker Website Hacked with Fake CAPTCHA in ClickFix Attack – Source:hackread.com <a href="https://ciso2ciso.com/iclicker-website-hacked-with-fake-captcha-in-clickfix-attack-sourcehackread-com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ciso2ciso.com/iclicker-website-hacked-with-fake-captcha-in-clickfix-attack-sourcehackread-com/</a> <a href="https://social.skynetcloud.site/tags/1CyberSecurityNewsPost" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#1CyberSecurityNewsPost</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://social.skynetcloud.site/tags/CyberAttacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberAttacks</a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberAttack</a> <a href="https://social.skynetcloud.site/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://social.skynetcloud.site/tags/Hackread" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hackread</a> <a href="https://social.skynetcloud.site/tags/iClicker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iClicker</a> <a href="https://social.skynetcloud.site/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://social.skynetcloud.site/tags/Captcha" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Captcha</a> <a href="https://social.skynetcloud.site/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a>

Pyrzout :vm:iClicker Website Hacked with Fake CAPTCHA in ClickFix Attack <a href="https://hackread.com/iclicker-website-hacked-fake-captcha-clickfix-attack/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackread.com/iclicker-website-hacked-fake-captcha-clickfix-attack/</a> <a href="https://social.skynetcloud.site/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://social.skynetcloud.site/tags/CyberAttacks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberAttacks</a> <a href="https://social.skynetcloud.site/tags/CyberAttack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberAttack</a> <a href="https://social.skynetcloud.site/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.skynetcloud.site/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://social.skynetcloud.site/tags/iClicker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iClicker</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.skynetcloud.site/tags/Captcha" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Captcha</a>

Taggart :donor:I think I have a nice compromise <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> ...fix for those places that just can't live without some Explorer niceties. There is an alternative to the "Disable Windows shortcuts" GPO, which not only disables Win+ shortcuts, but also things like using UNC paths in the Explorer address bar. Of course, Geoff Chappell <a href="https://www.geoffchappell.com/notes/windows/shell/explorer/globalhotkeys.htm" rel="nofollow noopener noreferrer" target="_blank">lights the way</a>.I believe that GPO applies the <code>REST_NORUN</code> reg key and not <code>REST_NOWINKEYS</code> policies—despite the name.If I apply the <code>REST_NORUN</code> reg setting directly, I get the same behavior as the GPO. The popup pictured here appears.But if I instead set the <code>REST_NOWINKEYS</code> dialog, the Win+R shortcut is disabled, but other stuff (like UNC paths in explorer) still works! Now, this doesn't remove the Run command from the start menu, but it is at least a safety. Oh and one more thing: because that shortcut is now unregistered, you can register it yourself for something like a lil daemon that pops a message box saying <code>Hey did a website tell you to do this? Don't!</code>You can try both settings.<code>REST_NORUN</code>: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun</code><code>REST_NOWINKEYS</code>: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys</code>UPDATE: You can additionally disable only Win+R by setting <code>HKEY_CURRENT_USER\SOFTWARE\Microsoft\CurrentVersion\Explorer\Advanced\DisabledHotkeys</code> to a String value containing the Win shortcuts you want to disable. So a single <code>R</code> will do the trick. Note this only works at the user level.

The New OilHackers now testing <a href="https://mastodon.thenewoil.org/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> attacks against <a href="https://mastodon.thenewoil.org/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> targets<a href="https://www.bleepingcomputer.com/news/security/hackers-now-testing-clickfix-attacks-against-linux-targets/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/hackers-now-testing-clickfix-attacks-against-linux-targets/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://mastodon.thenewoil.org/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FOSS</a>

Hackread.com🚨 Popular student engagement platform iClicker’s website was hacked with a fake "I'm not a robot" check which is a textbook example of a ClickFix attack.Read: <a href="https://hackread.com/iclicker-website-hacked-fake-captcha-clickfix-attack/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackread.com/iclicker-website-hacked-fake-captcha-clickfix-attack/</a><a href="https://mstdn.social/tags/iClicker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iClicker</a> <a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mstdn.social/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://mstdn.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>

nemo™ 🇺🇦🚨 New ClickFix campaign alert! 🚨 This evolving cyberattack now targets both Windows & Linux users by tricking them into running malicious console commands under the guise of “browser updates” or CAPTCHA tests. 🖥️🔒 Currently harmless but watch out! Threat actor: APT36 (Pakistan). Stay safe & informed! 🔐 <a href="https://mas.to/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mas.to/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://mas.to/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> <a href="https://mas.to/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> <a href="https://mas.to/tags/APT36" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT36</a> <a href="https://mas.to/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://mas.to/tags/TechRadar" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechRadar</a> <a href="https://mas.to/tags/newz" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#newz</a> Read more: <a href="https://www.techradar.com/pro/security/new-clickfix-campaign-spotted-hitting-both-windows-and-linux-machines" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.techradar.com/pro/security/new-clickfix-campaign-spotted-hitting-both-windows-and-linux-machines</a>

LavX NewsNew ClickFix Attacks Target Linux: A Shift in Cyber Threat LandscapeIn a surprising twist, hackers are now adapting ClickFix attacks to target Linux systems, previously dominated by Windows vulnerabilities. This development highlights the evolving tactics of cybercrim...<a href="https://news.lavx.hu/article/new-clickfix-attacks-target-linux-a-shift-in-cyber-threat-landscape" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://news.lavx.hu/article/new-clickfix-attacks-target-linux-a-shift-in-cyber-threat-landscape</a><a href="https://ioc.exchange/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://ioc.exchange/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://ioc.exchange/tags/LinuxSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LinuxSecurity</a> <a href="https://ioc.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://ioc.exchange/tags/APT36" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT36</a>

LavX NewsNew ClickFix Attacks Target Linux: A Shift in Cyber Threat LandscapeIn a surprising twist, hackers are now adapting ClickFix attacks to target Linux systems, previously dominated by Windows vulnerabilities. This development highlights the evolving tactics of cybercrim...<a href="https://news.lavx.hu/article/new-clickfix-attacks-target-linux-a-shift-in-cyber-threat-landscape" rel="nofollow noopener noreferrer" target="_blank">https://news.lavx.hu/article/new-clickfix-attacks-target-linux-a-shift-in-cyber-threat-landscape</a><a href="https://mastodon.cloud/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://mastodon.cloud/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://mastodon.cloud/tags/LinuxSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LinuxSecurity</a> <a href="https://mastodon.cloud/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://mastodon.cloud/tags/APT36" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#APT36</a>

CEOTECH.ITGoogle scopre LostKeys: malware russo per lo spionaggio <a href="https://mastodon.social/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://mastodon.social/tags/COLDRIVER" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#COLDRIVER</a> <a href="https://mastodon.social/tags/CyberEspionage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberEspionage</a> <a href="https://mastodon.social/tags/Cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybercrime</a> <a href="https://mastodon.social/tags/FSB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#FSB</a> <a href="https://mastodon.social/tags/Geopolitica" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Geopolitica</a> <a href="https://mastodon.social/tags/Google" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Google</a> <a href="https://mastodon.social/tags/LostKeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#LostKeys</a> <a href="https://mastodon.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://mastodon.social/tags/Notizie" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Notizie</a> <a href="https://mastodon.social/tags/Russia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Russia</a> <a href="https://mastodon.social/tags/Sicurezza" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Sicurezza</a> <a href="https://mastodon.social/tags/Spionaggio" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Spionaggio</a> <a href="https://mastodon.social/tags/StateSponsoredHacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StateSponsoredHacking</a> <a href="https://mastodon.social/tags/TechNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechNews</a> <a href="https://mastodon.social/tags/Tecnologia" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Tecnologia</a> <a href="https://mastodon.social/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntelligence</a> <a href="https://mastodon.social/tags/VBS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VBS</a> <a href="https://www.ceotech.it/google-scopre-lostkeys-malware-russo-per-lo-spionaggio/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.ceotech.it/google-scopre-lostkeys-malware-russo-per-lo-spionaggio/</a>

LavX NewsiClicker Hack: A Cautionary Tale of ClickFix Malware Targeting StudentsIn a concerning breach, the iClicker platform was compromised by a ClickFix attack, leading to a sophisticated malware distribution scheme targeting students and educators. This incident highlights th...<a href="https://news.lavx.hu/article/iclicker-hack-a-cautionary-tale-of-clickfix-malware-targeting-students" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://news.lavx.hu/article/iclicker-hack-a-cautionary-tale-of-clickfix-malware-targeting-students</a><a href="https://ioc.exchange/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://ioc.exchange/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://ioc.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://ioc.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://ioc.exchange/tags/iClicker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iClicker</a>

LavX NewsiClicker Hack: A Cautionary Tale of ClickFix Malware Targeting StudentsIn a concerning breach, the iClicker platform was compromised by a ClickFix attack, leading to a sophisticated malware distribution scheme targeting students and educators. This incident highlights th...<a href="https://news.lavx.hu/article/iclicker-hack-a-cautionary-tale-of-clickfix-malware-targeting-students" rel="nofollow noopener noreferrer" target="_blank">https://news.lavx.hu/article/iclicker-hack-a-cautionary-tale-of-clickfix-malware-targeting-students</a><a href="https://mastodon.cloud/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://mastodon.cloud/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://mastodon.cloud/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://mastodon.cloud/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://mastodon.cloud/tags/iClicker" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#iClicker</a>

Bob CarverMacs under threat from thousands of hacked sites spreading malware — how to stay safe <a href="https://www.tomsguide.com/computing/online-security/macs-under-threat-from-thousands-of-hacked-sites-spreading-malware-how-to-stay-safe" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.tomsguide.com/computing/online-security/macs-under-threat-from-thousands-of-hacked-sites-spreading-malware-how-to-stay-safe</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Apple</a> <a href="https://infosec.exchange/tags/Macs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Macs</a> <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#socialengineering</a>

Pyrzout :vm:ClickFix Scam: How to Protect Your Business Against This Evolving Threat <a href="https://hackread.com/clickfix-scam-how-to-protect-business-againt-threat/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackread.com/clickfix-scam-how-to-protect-business-againt-threat/</a> <a href="https://social.skynetcloud.site/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://social.skynetcloud.site/tags/Security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Security</a> <a href="https://social.skynetcloud.site/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://social.skynetcloud.site/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://social.skynetcloud.site/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://social.skynetcloud.site/tags/Captcha" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Captcha</a> <a href="https://social.skynetcloud.site/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scam</a>

Pyrzout :vm:ClickFix Scam: How to Protect Your Business Against This Evolving Threat – Source:hackread.com <a href="https://ciso2ciso.com/clickfix-scam-how-to-protect-your-business-against-this-evolving-threat-sourcehackread-com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://ciso2ciso.com/clickfix-scam-how-to-protect-your-business-against-this-evolving-threat-sourcehackread-com/</a> <a href="https://social.skynetcloud.site/tags/1CyberSecurityNewsPost" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#1CyberSecurityNewsPost</a> <a href="https://social.skynetcloud.site/tags/CyberSecurityNews" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurityNews</a> <a href="https://social.skynetcloud.site/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://social.skynetcloud.site/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> <a href="https://social.skynetcloud.site/tags/Hackread" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Hackread</a> <a href="https://social.skynetcloud.site/tags/Phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phishing</a> <a href="https://social.skynetcloud.site/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://social.skynetcloud.site/tags/Captcha" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Captcha</a> <a href="https://social.skynetcloud.site/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://social.skynetcloud.site/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scam</a>

Taggart :donor:FWIW, 100% of <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> attacks I've seen have added some kind of inline comment at the end of the command string like <code>I am not a robot</code> to sell the ruse. Definitely worth a threat hunt on command line history.<a href="https://infosec.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatHunting</a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntel</a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThreatIntelligence</a>

SaltmyhashExamine your EDR telemetry or other process command logs for the following <a href="https://infosec.exchange/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#clickfix</a> flow:Explorer.exe -> powershell.exe -> cmd.exe -> curl/wget to grab a .ps1 -> powershell.exeThe above flow was initiated using a Cloudflare Captcha challenge on a compromised website which fooled the victim into running the clipboard command. Also, look out for internet traffic which sources from copilot.exe. It won’t have a referrer in proxy logging which made figuring out where or how the victim initially hit the clickfix domain difficult. EDR telemetry ultimately showed copilot.exe making the initial netconn to the clickfix domain. Microsoft purview analysis of copilot was needed to figure out what the victim entered in the prompt to drive them to compromised site hosting the clickfix payload. Mitigation is to recommend restricting cmd.exe or powershell.exe execution to privileged groups only. Bob in the C-suite shouldn’t be able to use run to execute cmd.exe commands copied to his clipboard. Scope usage of cmd/powershell so you don’t blow up legitimate patching or remote assistance efforts. Also, know if copilot is on in your org and restrict or create privileged groups who need it. Almost every threat actor I track now is using clickfix technique, apparently because it works. Users are more than happy to self-diagnose problems or solve bogus captchas by doing what prompts tell them to do. <a href="https://infosec.exchange/tags/soc" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#soc</a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#threatintelligence</a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dfir</a> <a href="https://infosec.exchange/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#clickfix</a>

Brad2025-04-22 (Tuesday): Always fun to find the fake CAPTCHA pages with the <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClickFix</a> style instructions trying to convince viewers to infect their computers with malware. Saw <a href="https://infosec.exchange/tags/StealC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#StealC</a> from an infection today. Indicators available at <a href="https://github.com/malware-traffic/indicators/blob/main/2025-04-22-IOCs-for-ClickFix-style-campaign-leading-to-StealC-infection.txt" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://github.com/malware-traffic/indicators/blob/main/2025-04-22-IOCs-for-ClickFix-style-campaign-leading-to-StealC-infection.txt</a><a href="https://infosec.exchange/tags/ClipboardHijacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClipboardHijacking</a> <a href="https://infosec.exchange/tags/Pastejacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Pastejacking</a>

Recent searches

Search options

Administered by:

Server stats:

#clickfix