How a ClickFix Scam Could Turn an AI Search into Microsoft 365 Business Email Compromise
Summary
Huntress illustrates a fictional attack chain in which a malicious custom GPT leads an employee to run a ClickFix command, enabling session-cookie theft and invoice fraud, and describes endpoint and identity clues defenders could watch for.
Key points
- In Huntress’s fictional scenario, an employee reaches an attacker-built custom GPT through a sponsored search result, then follows its instructions to run a command in Terminal.
- The ClickFix command compromises the employee’s Mac; the attacker retrieves browser cookies and reuses the Microsoft 365 session cookie to access Outlook without the password or a new MFA prompt.
- The attacker creates a hidden inbox rule to archive invoice-related messages, impersonates the employee in a payment-change request, and deletes evidence; the scenario unfolds in about 24 hours.
- Potential endpoint clues include a Mac shell running curl and an attacker IP address encoded in the command.
- Potential identity clues include two browsers or operating systems associated with one session, unexpected VPN traffic, and an inconspicuous inbox rule.
- Huntress’s Tragic Quadrant compares tactics by prevalence and potential impact, emphasizing how lower-impact techniques can become more damaging when attackers chain them together.
Article Details
- Topic
- Illustrative ClickFix-to-business-email-compromise attack chain involving session-cookie theft and hidden inbox rules
MITRE ATT&CK
T1059.002 · AppleScriptThe scenario describes a victim pasting and executing a command in macOS Terminal.T1539 · Steal Web Session CookieThe attacker retrieves and reuses Doris's Microsoft session cookie to access her authenticated session.T1564.008 · Email Hiding RulesThe attacker creates a hidden inbox rule to archive invoice-related messages and conceal the activity.
People
Vendors
HuntressThe Huntress Tragic Quadrant plots tactics from this attack chain on prevalence (how often they show up) and "pucker factor" (how much damage they cause when they land), giving you a clear view of which gaps to closeMicrosoftnot a robot" page quietly lead her into a ClickFix command that gives an attacker remote access to her Microsoft 365 session.
Products
ChatGPTA normal day for Doris turns into an OH $#!T moment when a sponsored ChatGPT result, a custom GPT, and a "prove you're not a robot" page quietly lead her into a ClickFix command that gives an attacker remote access toMicrosoft 365 Apps for Enterprisea robot" page quietly lead her into a ClickFix command that gives an attacker remote access to her Microsoft 365 session.Outlookto retrieve cookies and spots Doris' Microsoft session cookie, the one that keeps her logged in to Outlook without entering a password or MFA code each time she needs access. By dropping that cookie into a fresh