Darktrace Details ClickFix Attacks Using PowerShell and Data Exfiltration
Summary
Darktrace analyzed ClickFix attacks that used fake verification prompts to induce PowerShell execution, followed by C2 communications and data exfiltration. Its monitoring detected malicious activity, and Autonomous Response blocked connections in a separate case.
Key points
- ClickFix prompts imitate CAPTCHA checks or routine fixes, tricking users into pasting and running malicious PowerShell commands.
- Darktrace investigated attacks across customer environments and detailed an April 9, 2025 incident; initial access in that case was outside its visibility.
- The compromised device contacted C2 infrastructure, downloaded a numerically named file, and sent system information through HTTP POST requests.
- Darktrace observed further connections associated with ClickFix campaigns and activity indicating automated data egress.
- In the investigated incident, response actions required manual implementation, allowing the attack to escalate.
- In a separate case, Autonomous Response blocked a connection one second after a suspicious file download, and the affected device was quarantined.
Article Details
- Attack Vectors
- ClickFix social engineering using fake error messages, verification prompts, or CAPTCHA prompts to persuade users to execute malicious PowerShell commands.
- Spearphishing emails, malvertisements, and drive-by compromises can redirect users to malicious URLs.
- Attackers may abuse trust in familiar online platforms such as GitHub to deliver malicious payloads.
- Observed follow-on activity included downloading numerically named files, scanning internal system information, and sending data to C2 servers via HTTP POST.
- Defensive Notes
- Monitor for unusual PowerShell user agents and PowerShell execution, numerically named file downloads, and anomalous HTTP POST connections to external IP addresses.
- Use network detection and response to identify unusual outbound connections and correlate related events across an attack chain.
- The article reports that Darktrace Autonomous Response blocked connections to malicious endpoints and quarantined an affected device; without Autonomous Response enabled, proposed blocking actions required manual implementation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | tlgrm-redirect[.]icu | Listed as possible C2 infrastructure. |
| HOSTNAME | diagnostics[.]medgenome[.]com | Identified in the IOC list as a compromised website. |
| HOSTNAME | rkuagqnmnypetvf[.]top | Listed as a C2 server. |
| IPV4 | 138[.]199[.]156[.]22 | Identified as a C2 server; Darktrace Autonomous Response blocked connections to it. |
| IPV4 | 141[.]193[.]213[.]10 | Listed as possible C2 infrastructure. |
| IPV4 | 141[.]193[.]213[.]11 | Listed as possible C2 infrastructure. |
| IPV4 | 168[.]119[.]96[.]41 | Listed as possible C2 infrastructure. |
| IPV4 | 188[.]34[.]195[.]44 | Identified as a C2 server associated with ClickFix campaigns. |
| IPV4 | 193[.]36[.]38[.]237 | Identified as a C2 endpoint used for HTTP communications and data exfiltration. |
| IPV4 | 205[.]196[.]186[.]70 | Listed as possible C2 infrastructure. |
| IPV4 | 212[.]237[.]217[.]182 | Listed as possible C2 infrastructure. |
| IPV4 | 216[.]245[.]184[.]181 | Listed as possible C2 infrastructure. |
| IPV4 | 64[.]94[.]84[.]217 | Listed as possible C2 infrastructure. |
| IPV4 | 94[.]181[.]229[.]250 | Listed as possible C2 infrastructure. |
| SHA1 | 10a5eab3eef36e75bd3139fe3a3c760f54be33e3 | Listed as the hash of a possible malicious file. |
| SHA256 | 34ff2f72c191434ce5f20ebc1a7e823794ac69bba9df70721829d66e7196b044 | Listed as the hash of a possible malicious file. |
MITRE ATT&CK
T1020.001 · Traffic DuplicationThe article describes automated data egress through HTTP POST requests to ClickFix C2 endpoints.T1059.001 · PowerShellUsers are tricked into pasting and running malicious PowerShell commands.T1071.001 · Web ProtocolsThe incident used HTTP communications between compromised devices and C2 infrastructure.T1189 · Drive-by CompromiseDrive-by compromises are described as an initial access method used in ClickFix attacks.T1210 · Exploitation of Remote ServicesThe downloaded file is described as containing code designed to exploit remote services.T1566.002 · Spearphishing LinkThe article describes spearphishing emails containing links that can redirect users to malicious URLs.
People
Threat Actors
Malware
AsyncRATdata [4]. Malicious payloads associated with various malware families, such as XWorm, Lumma, and AsyncRAT, are often deployed [2][3].Lummastealing sensitive data [4]. Malicious payloads associated with various malware families, such as XWorm, Lumma, and AsyncRAT, are often deployed [2][3].XWormand stealing sensitive data [4]. Malicious payloads associated with various malware families, such as XWorm, Lumma, and AsyncRAT, are often deployed [2][3].
Vendors
Products
Darktrace / NETWORKbegan when the threat actor initiated external communication with their C2 infrastructure, with Darktrace / NETWORK detecting the use of a new PowerShell user agent, indicating an attempt at remote code execution.Darktrace Autonomous ResponseFigure 6: Darktrace correlated the separate malicious connections that pertained to a single campaign. Darktrace Autonomous Response
Countries
Iranto Advanced Persistent Threat (APT) groups such as APT28 and MuddyWater, linked to Russia and Iran respectively, introducing security threats on a broader scale [1]. ClickFix campaigns have been observedRussiacybercriminals to Advanced Persistent Threat (APT) groups such as APT28 and MuddyWater, linked to Russia and Iran respectively, introducing security threats on a broader scale [1]. ClickFix campaigns have been
Industries
Automotivebeen observed affecting organizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].Governmentorganizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].HealthcareClickFix campaigns have been observed affecting organizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].Hospitalityhave been observed affecting organizations in across multiple industries, including healthcare, hospitality, automotive and government [2][3].