A ClickFix cluster: Observed activity from recent ClickFix campaigns

Contents

Campaign 1 - MSI packages

Campaign 2 - NodeJS

Campaign 3 - Python

Post-compromise activity

The overlap

Attribution

Mitigation

IOCs

MITRE

As ClickFix has become one of the most common infection techniques over the last few years, adversaries continue to refine and adapt their delivery mechanisms.

Earlier this summer, the Field Effect team observed a ClickFix campaign employing three distinct approaches to establish an initial foothold in victim environments. Despite variations in delivery, the campaigns shared several common characteristics,…