There was a joke on the Internet in the early 2000s. You receive a message with text like: “Hello! I’m an Albanian virus. Unfortunately, I don’t have high technology. Please help me: delete some important file on your computer by yourself, and then forward me to your friends”.
Over the past few years, the joke has become a reality due to massive attacks using the ClickFix technique. The user sees a pop-up window with a suggestion to perform certain actions “to fix some problem” (for example, to update the browser or prove that you are not a robot). By falling for this trick, users perform the suggested actions, i.e., they themselves download and execute malicious code on their computer.
The attack scheme in MacOS and Linux environments is similar to the technique for Windows: the victim is lured to a fake or hacked site, a command is copied to the clipboard via JavaScript, and then the user is prompted to insert it into the terminal. The attack doesn’t exploit any vulnerabilities which makes ClickFix an effective technique regardless of software updates.
However, ClickFix can be successfully detected at several levels: host-level (launching LOLBin from explorer.exe), behavioral (anomalous parent-child chain matching RunMRU entries), and artifact-level (RunMRU, tiptsf.dll, browser history). Combining this telemetry with correlation rules in SIEM systems allows for the detection of ClickFix attacks at an early stage — before the attacker moves on to post-exploitation.
Typical execution chains for such attacks, as well as various ways to detect them — in the article by our expert Vadim Grachev “Hack yourself: breaking down ClickFix”.
