ClickFix Uses Fake Verification Pages and Trusted Tools to Deliver Malware
Summary
A ReversingLabs investigation details ClickFix attacks using fake verification pages and clipboard-injected commands. One university site reportedly exposed 5–10 students’ browser data; researchers matched 4,000+ samples and recommend behavior-based detection and system
Key points
- The author reports that a compromised university Student Association site served as a ClickFix watering hole; 5–10 students reportedly had browser credentials, session tokens, and cookies harvested.
- Fake verification pages use JavaScript to place a malicious command on the clipboard, then direct users to paste it into Windows Run or macOS Terminal.
- The attack chain uses trusted tools such as PowerShell, mshta.exe, curl, and rundll32.exe; some payloads execute in memory, making detection harder.
- A YARA hunt matched more than 4,000 ClickFix samples and identified 123 confirmed lures that evaded every antivirus engine tested.
- Reported payloads include Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, and DarkGate; the watering-hole case used zuhe.dll, a Go-based RAT with layered obfuscation and sandbox checks.
- The article describes ClickFix kits sold as a service and a platform using Node.js RAT modules and gRPC command-and-control traffic routed through Tor.
- Recommended defenses include behavioral YARA detection, PowerShell Constrained Language Mode, script-block logging, AMSI, application control, and user education.
Article Details
- Attack Vectors
- Fake CAPTCHA and verification pages trick users into pasting commands into the Windows Run dialog or macOS Terminal.
- JavaScript silently overwrites the clipboard with a malicious command when the victim interacts with the page.
- Trusted utilities, including PowerShell, mshta.exe, and rundll32.exe, are used to execute or retrieve payloads, which may run in memory.
- A compromised university Student Association website was used as a watering hole, displaying a fake Google verification prompt.
- A reported payload-retrieval mechanism queried Ethereum smart contracts.
- Defensive Notes
- Use behavioral YARA rules to detect fake verification pages, clipboard-writing JavaScript, and PowerShell payload indicators.
- Use PowerShell Constrained Language Mode, script block logging, AMSI, and application control through Windows Defender Application Control or AppLocker.
- Where operationally feasible, suppress the Run dialog for standard users.
- Educate users not to paste commands into the Run dialog or Terminal at the instruction of a website.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe zuhe.dll RAT payload is described as having three stacked obfuscation layers.T1059.001 · PowerShellPowerShell is used as a trusted execution path for malicious payloads and dropper activity.T1105 · Ingress Tool TransferClickFix payloads are downloaded from remote infrastructure and can execute in memory.T1204.004 · Malicious Copy and PasteUsers are deceived by fake verification pages into pasting a clipboard-supplied command into Run or Terminal and executing it.T1218.005 · MshtaThe article identifies mshta.exe as a trusted utility used to run malicious code in ClickFix chains.T1218.011 · Rundll32The article identifies rundll32.exe as a trusted utility used to execute payloads.T1497.001 · System ChecksThe zuhe.dll payload reportedly checked for 14 known sandbox environments.T1539 · Steal Web Session CookieThe zuhe.dll payload harvested browser cookies and session tokens.T1555.003 · Credentials from Web BrowsersThe zuhe.dll payload harvested credentials from Chromium and Firefox browsers.
People
Malware
AsyncRAThas been industrialized through MaaS offerings and has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university StudentDarkGateMaaS offerings and has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university Student Association website.Lumma StealerThe campaign has been industrialized through MaaS offerings and has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university StudentNetSupport RATthrough MaaS offerings and has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university Student Association website.SectopRATthrough MaaS offerings and has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university Student Association website.XWormcampaign has been industrialized through MaaS offerings and has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university Studentzuhe.dlland has delivered payloads such as Lumma Stealer, XWorm, AsyncRAT, NetSupport, SectopRAT, DarkGate, and zuhe.dll against victims including a university Student Association website.
Vendors
Products
AppLockerAntimalware Scan Interface (AMSI), application control through Windows Defender Application Control or AppLocker, and, where operationally feasible, suppressing the Run dialog for standard users.PowerShellTrusted Windows and macOS utilities such as PowerShell, mshta.exe, curl, and rundll32.exe are used to execute payloads.Spectra AnalyzeWorking with RL’s Spectra Analyze, I ran interactive dynamic analysis.Windows Defender Application Controlscript block logging, the Antimalware Scan Interface (AMSI), application control through Windows Defender Application Control or AppLocker, and, where operationally feasible, suppressing the Run dialog for standard