ClickFix Attack Write Up
The internet can be an interesting and dangerous place. While doing research the other day for a project, I finally encountered a site that seems to have been taken over by my malicious actors to execute a ClickFix style attack. ClickFix Social Engineering schemes have gained popularity in recent months, but this was my first time encountering one in the wild. I wanted to share a quick write-up for interested colleagues, even though its different from what I was intending to do with this page. There are several variations on the ClickFix theme, but they all follow a similar pattern. When accessing a site, a banner of some kind prompts the user to open a run dialog on their machine and paste and obfuscated command. The commands execute a malicious payload to deliver whatever form of malware attackers wish. From this point on, the attacker can complete whatever they wish with the victim’s machine. The rest of this post is an analysis of what happened but the site that I visite...
