Lazarus Group Targets Windows 11 with ClickFix Tactics and Fake Job Offers

Lazarus Group is reported to be targeting Windows 11 with the ClickFix technique, using a social-engineering campaign that disseminates fake job offers via phony social media accounts to lure victims into phishing traps. The campaign purportedly payloads the BeaverTail infostealer and InvisibleFerret, with the initial drop occurring through a deceptive interview website that prompts users to fix a fabricated camera configuration fault.

According to Qi’anxin Threat Intelligence Center, the attack chain includes ClickFix-1.bat downloading a malicious ZIP archive, followed by run.vbs that checks the system build number to confirm Windows 11 (BuildNumber ≥ 22000) and launches the backdoored drvUpdate.exe while evaluating a Node.js environment.

If Node.js is absent, shell.bat then installs it, and main.js is executed to deploy BeaverTail, which communicates with C2 servers such as 45.159.248[.]110, and retrieves InvisibleFerret from 45.159.248[.]110/client/xyz2, with persistence via registry modifications. The campaign also extends to macOS variants and uses several indicators of compromise, including the MD5 hashes and C2 addresses listed in the article.