ClickFix Pages Deliver Lumma and CryptBot, Steal Zoho Credentials

Apr 3, 2025 · Original article ↗

Summary

Hunt.io researchers used behavioral queries to identify ClickFix pages delivering Lumma and CryptBot, harvesting Zoho credentials, and staging PowerShell payloads. The article details their techniques, infrastructure, indicators, and defensive recommendations.

Key points

ClickFix lures users with fake CAPTCHA or system prompts, then uses JavaScript to copy commands to the clipboard for execution through Windows Run.
A Bitcoin-themed page used encoded PowerShell to download malware archives; researchers linked one executable to Lumma Stealer and another to CryptBot.
Another page redirected users to a fake Zoho sign-in prompt, with a hardcoded Telegram bot token in the source code to send submitted credentials to an actor-controlled endpoint.
A page hosted on compromised infrastructure copied a PowerShell command that attempted to retrieve a second script; the URL was inactive at the time of analysis.
Hunt.io's query of its crawler data returned 10 results matching selected ClickFix-related strings.
The article recommends monitoring browser-triggered clipboard use, PowerShell and mshta.exe execution, suspicious verification-lure domains, and enabling MFA.

Article Details

Attack Vectors: ClickFix pages use deceptive CAPTCHA or security prompts to persuade users to copy and run commands from the clipboard.
Some observed pages staged malware through PowerShell or mshta.exe; another presented a Zoho-branded credential prompt after verification.
A compromised website was used to deliver a PowerShell command that attempted to retrieve another script.
Defensive Notes: Monitor for clipboard-based execution involving PowerShell, mshta.exe, or Base64-encoded commands, especially after suspicious browser activity.
Alert on or block domains hosting verification-style lures that mimic CAPTCHA challenges or security checks.
Configure endpoint detection to log PowerShell activity, script execution, and unusual clipboard use.
Encourage users to enroll in multi-factor authentication to mitigate credential-harvesting impact.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`aatox[.]com`	Host of the PowerShell script described in the article's payload-staging example.
DOMAIN	`coinspaceteam[.]com`	Listed among domains matching the article's ClickFix activity query.
DOMAIN	`informationhuman[.]com`	Listed among domains matching the article's ClickFix activity query.
DOMAIN	`informboomk[.]com`	Listed among domains matching the article's ClickFix activity query.
DOMAIN	`informepartne[.]com`	Listed among domains matching the article's ClickFix activity query.
DOMAIN	`meltmetu[.]live`	Reported as a network destination contacted by verify1.exe.
DOMAIN	`micropedik[.]in`	Listed in the article's ClickFix network observables as a domain associated with the activity.
DOMAIN	`movmlyvvip88[.]xyz`	Listed among domains matching the article's ClickFix activity query.
DOMAIN	`securedmicrosoft365[.]com`	Listed among domains matching the article's ClickFix activity query.
DOMAIN	`soubtcevent[.]com`	ClickFix verification domain that delivered a script associated with malware.
DOMAIN	`targett[.]top`	Reported as a callback destination for verify1.exe.
DOMAIN	`timestesol[.]com`	ClickFix credential-harvesting page that presented a Zoho-branded login prompt.
DOMAIN	`tlgrm-redirect[.]icu`	Hosted the second-stage PowerShell script used in the malware-delivery chain.
DOMAIN	`tlgrmverif[.]cyou`	Received success or failure logs from the archive-download attempts.
IPV4	`94[.]181[.]203[.]38`	Address of an endpoint contacted by verify2.exe at port 4057.
IPV4	`94[.]181[.]229[.]250`	IP listed in the ClickFix observables table for multiple domains associated with the activity.
SHA256	`1d4f24b5df63fb65947d1d1378b9686986a78bd4dc714511358bf0fea841bc51`	SHA-256 hash listed for the 1.zip archive.
SHA256	`4f568e8305ea8a024c22b0b77547384950198156fb4217c0278e09bed17a144c`	SHA-256 hash listed for focus-beats-vol1.mp3 in the host observables table.
SHA256	`638a472c16202c2b564a08b779b6640bcc933ba170d469370f83645130fa76b5`	SHA-256 hash listed for the 2.zip archive.
SHA256	`69c513f0ddf4416e0d47f778594fd76b96424359c7e9c2e5585ad0abaaf5dbc0`	SHA-256 hash listed for verify2.exe, which the article links to CryptBot.
SHA256	`85fc09ce98fb126d4d47d4b75a96fb7e7ca6184bfcb9971cfae8d893f2912cf1`	SHA-256 hash listed for the 3.zip archive.
SHA256	`909ed8a1351f9a21ebdd5d8efb4147145f12d5d24225dbd44cd2800a1f94a596`	SHA-256 hash listed for 1.txt, the second-stage script.
SHA256	`dad4ecd247efa876faac2e3f67130951b044043ca21c5db6281ba2b8fce7a089`	SHA-256 hash listed for verify1.exe, which the article reports was flagged as malicious by 39 of 73 vendors.
SHA256	`e11d68ee9294a55de8548687935567d030dae3a594d40ea75f88598f30ebb76e`	SHA-256 hash listed for verify3.exe.
URL	`hxxp[:]//aatox[.]com/verify/45[.]ps1`	PowerShell script URL containing a command that attempted to retrieve a second script.
URL	`hxxps[:]//riverview-pools[.]com/verify/index[.]html`	Verification page on a website the article identifies as compromised and used to copy a PowerShell command.