ClickFix Attack Hides Browser-Specific Payloads in Cache
· 20:33 · Watch on YouTube ↗
Summary
John Hammond analyzes a ClickFix lure on a compromised site impersonating Cloudflare Turnstile. It retrieves browser-specific batch payloads from cache, launches staged PowerShell/.NET code, and exfiltrates browser cookies and history.
Key points
- A compromised website presents a fake Cloudflare Turnstile verification prompt; interacting with the page triggers the ClickFix lure.
- The lure tells users to open the Windows Run dialog, paste a command, and press Enter, which extracts and executes a payload already cached by the browser.
- The command searches Firefox, Google Chrome, or Brave profile data for a batch file matching a 17,635-byte size condition.
- The analyzed stages retrieve additional payloads from cloudrecycled[.]com and cloudrecycle[.]com, while displaying a fake verification interface.
- Later stages use PowerShell and encoded ZIP data containing obfuscated C# and shellcode components.
- Sandbox analysis showed the payload uploading browser cookies, history, and device metadata to multifilehost[.]com.
Article Details
- Topics
- [00:10] Fake Cloudflare Turnstile prompt used as a ClickFix lure
- [01:00] Browser-specific commands extract payloads from Firefox, Chrome, and Brave profiles
- [03:01] Network requests reveal the compromised site’s payload-serving infrastructure
- [04:10] Finding the batch payload in browser cache by its file-size condition
- [07:21] Next-stage downloads and a fake verification interface
- [10:22] Obfuscated PowerShell stages, encoded archives, and C# shellcode components
- [18:02] Sandbox execution reveals browser-data exfiltration
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cloudrecycle[.]com | The analyzed payload used this domain to retrieve a subsequent malicious stage. |
| DOMAIN | cloudrecycled[.]com | The analyzed compromised site communicated with this domain while serving malicious ClickFix payloads. |
| DOMAIN | multifilehost[.]com | The analyzed payload uploaded browser cookies, history, and device metadata to this domain. |