What is ClickFix?
ClickFix is a social engineering technique that the Security Operations team at CloudTech24 are seeing cybercriminals use to trick users into infecting their own devices.
Typically, we find that a user is redirected to a fake verification page that impersonates a trusted service such as Cloudflare, Google reCAPTCHA, or a website security check. The page claims the user must complete a verification step before accessing the website.
Unlike traditional phishing attacks, the page does not ask for credentials. Instead, it instructs the user to copy and paste a command into the Run dialogue box (Windows) or Terminal (macOS) and execute it. This command then downloads and runs malicious code directly on the user’s device.
These attacks are typically more successful due to these fake verification pages appearing on legitimate websites. The attackers will compromise a legitimate website that you may regularly use and then place the CAPTCHA/Verification.
What you should look out for
The images below are real-world examples of ClickFix style attacks:
The impact of an attack
A ClickFix campaign can result in:
- Malware installation
- Credential theft
- Command-and-control (C2) activity
- Unauthorised access to corporate systems
- Theft of sensitive data.
In severe cases, it can provide attackers with persistent access to an environment and act as a precursor to ransomware or further compromise.
Recommended response
If a user encounters a ClickFix style prompt, our cybersecurity specialists advise the following:
- Do not copy or run any commands
- If you can, capture/screenshot the URL, then close the browser tab immediately
- Report the incident to your IT/Security team.
If you have already run the command:
- Disconnect the device from the network
- Contact CloudTech24 immediately
- Do not attempt to clean the device yourself
- Assume any credentials used on that device are compromised and change them from a different device.
Concerned about phishing attacks?
CloudTech24 clients are welcome to schedule a call with their Customer Success Manager to discuss phishing attacks. If you are interested in CloudTech24’s managed email security and/or Managed Detection and Response (MDR) services, contact CloudTech24 today. We can help you improve your cybersecurity and reduce risk.
