Huntress: ClickFix chains now persist, move laterally, and steal credentials
Original title: Beyond the clipboard: The evolving tradecraft of ClickFix
Recent lures use malvertising, typosquats, and compromised sites, then show fake verification text while payloads run.
Huntress says ClickFix has moved beyond clipboard script delivery into chains that establish persistence, support lateral movement, and enable reconnaissance and credential theft. Recent cases use malvertising, SEO poisoning, typosquatted Westlaw and LinkedIn pages, and compromised websites with fake human-verification prompts. Some PowerShell displays colored progress messages while silently downloading and executing a payload. Other delivery includes browser-cache seeding, Node.js remote access trojans, and executables rebuilt from data hidden in PNG files.
- A Bing ad for Westlaw redirected through vvestalw.ghost.io to westlaw-signon.com.
- A compromised dental site used a consent popup to start a fake Cloudflare check.
- A failed payload check can show an error meant to prompt another attempt.
- Huntress has tracked Amazon, Google Doc, and macOS ClickFix variants since early August.
Impact: User-run commands enable persistence, lateral movement, and credential theft.
- 1.Treat browser verification pages that copy PowerShell to the clipboard as malicious.
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | apirequestaccess.com | two incidents investigated by Huntress, an MSI package from apirequestaccess[.]com installed a Node.js wrapper into the user's AppData direc |
| domain | ghost.io | e link redirected to a typosquatted domain https://vvestalw.ghost[.]io and a page titled "Westlaw - Legal Research Platforms Tho |
| domain | moziw.com | atted redirector presented after the Bing search. https://moziw[.]com/vvestalw/ Additional redirector in the delivery chain. |
| domain | westlaw-signon.com | ion below) the user was brought to a fake site at https[:]//westlaw-signon[.]com, designed to look like the real site on the Thomson Reute |
| ipv4 | 151.240.151.76 | nd path are more useful as publication-facing indicators. 151.240.151[.]76 IP address associated… |
| ipv4 | 167.148.201.104 | e.exe established a TCP connection to the remote IP address 167.148.201[.]104 on port 3861, potentially enabling the attacker to establ |
| ipv4 | 23.227.199.41 | d connects to attacker-controlled infrastructure located at 23.227.199[.]41 • Creates a scheduled task named SysyService Next, the |
| sha256 | 4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb | ScreenContentServer.exe for DLL sideloading. 1.bat SHA256:4155a4c7e857d9b613e14cf00e148037859cf627cf4004f5a4257f2cd29de2cb Malicious batch file launched through cmd.exe and used as a |
| sha256 | de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2 | ck Item Description LockScreenContentServer.exe SHA256:de9d325af3156232c34916840210efb5706d6e6a5eba1827c8240e4f71c09fa2 Legitimate, signed Microsoft binary dropped in C:\ProgramDa |
| sha256 | ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52 | executable in the DLL-sideloading chain. dui70.dll SHA256:ed37c12fc4beea98722f6f308cec45e6440c3089e1a002c837bed147fbeb0c52 Malicious DLL paired with LockScreenContentServer.exe for D |
From the original article
12 min read at huntress.comClickFix techniques are evolving. Huntress breaks down four attack chains: lateral movement, hidden PNG payloads, Node. js RATs and cache seeing.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.