Lazarus APT Deploys ClickFix Technique to Exfiltrate Sensitive Intelligence Data

The Lazarus APT group has evolved its attack methods by incorporating the ClickFix social engineering technique into its cyber espionage operations, according to GBHackers. The article notes that ClickFix involves fake system faults presented to victims who are then guided to follow instructions that deliver malicious code, and that Lazarus has integrated these tactics into phishing campaigns using fraudulent job postings as the lure.

Recent analysis by the Qi’anxin Threat Intelligence Center uncovered a batch script linked to Lazarus ClickFix operations that downloads fraudulent Nvidia software packages, with the malware chain deploying a Node.js environment to run BeaverTail, a signature tool used by the group.

The attack sequence begins with ClickFix-1.bat, which pulls a malicious package from a hosted zip file, and the package includes components such as run.vbs, shell.bat, main.js, and drvUpdate.exe, targeting Windows 11 alongside macOS variants. BeaverTail acts as the primary intelligence-gathering component, connecting to command-and-control servers and then deploying the InvisibleFerret Python Trojan to establish persistence.

Security researchers attribute these samples to Lazarus based on code similarities and the deployment of these threat families, underscoring the continuing sophistication of the group’s social engineering and cross-platform capabilities.