ClickFixは2024年ごろに登場して以来、急速にサイバー犯罪者の定番手口となりました。件数も種類も増え続けており、FileFix、InstallFix、TerminalFix、さらにブラウザ内で完結するConsentFixなど、派生手法が次々と生まれています。 誘い文句も巧妙化し、標的を絞り込むようになりました

ClickFix and TerminalFix deliver Lorem Ipsum and Axolotl loaders using DLL sideloading, MSI installers, PowerShell, and advanced evasion techniques

The activity is linked to a broader campaign that previously used a different delivery mechanism

EDR is still essential for detecting host execution, but it can miss attacks that stay inside browser-based SaaS sessions, identity workflows, and cloud applications. The article explains how browser controls, identity protections, and SaaS-specific policies can stop threats like AiTM phishing, malicious extensions, and ClickFix attacks before they reach endpoint telemetry. #UNC6395 #SalesloftDrift #Storm2755 #Microsoft365 #Workday #TerminalFix #NordLayerBrowser

Sophos unites unmatched threat intelligence, adaptive AI, and human expertise in an open platform to stop attacks before they strike — giving you the clarity and confidence to stay ahead of every threat.

ClickFix型のソーシャルエンジニアリング、PowerShellの実行、DLLサイドローディング、Pythonベースのリバーストンネルを組み合わせた侵入キャンペーン「TerminalFix」が確認されました。標的ネットワーク内に隠密なコマンド&コントロール（C2）チャネルを構築する手口です。 「STAC4924」

新たに追跡対象となった侵入セット「STAC4924」が、TerminalFixと呼ばれるソーシャルエンジニアリングの手口でLorem Ipsum Loaderを展開し、企業環境へ秘密のリバーストンネルを確立しています。 この攻撃は、おなじみのClickFixの手法を、Windowsの「ファイル名を指定して実行」ダイア

September’s attacks showed how CSuite, N0va, IronToll, Wazza, and TerminalFix blurred the line between legitimate business workflows and malicious activity by abusing trusted services, authentication flows, and infrastructure. The campaigns increased risk to Microsoft 365 users, payment data, endpoints, and enterprise identity systems while making detection and incident scoping much harder....

Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance.

Microsoft Security Research published an interesting blog post "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" about a malware campaign. The aspect that I want to take a closer look at, is the fact that the threat actors used PNG files with steganography. I reached out to the researchers and they kindly shared the IOCs for the PNG files with me.

TerminalFix: PNG Steganography, Author: Didier Stevens

The TerminalFix campaign hides Windows executables inside the RGBA pixels of PNG files, using every available bit rather than just the least significant ones. The technique yields structurally valid PNGs that render as visual noise, evading steganography detectors tuned for LSB anomalies.

Un falso CAPTCHA convince la vittima a eseguire PowerShell, ma è solo l’inizio. Con TerminalFix, ClickFix evolve in una catena multistadio che effettua ricognizione dell’ambiente Active Directory e…

A government organization providing cloud infrastructure to Indian companies is inadvertently distributing malware.

A website linked to India’s Software Technology Parks of India (STPI) is serving a spoofed Cloudflare verification page that silently copies a malicious string to visitors’ clipboards and prompts them to execute it via Windows Terminal, in a technique consistent with emerging TerminalFix-style attacks. STPI, a Government of India organization that supports the country’s IT services and startup ecosystem, operates platforms used by technology firms, developers, and public-sector stakeholders. The activity was observed on the ananta.stpi[.]in subdomain by cybersecurity researcher and red teamer Vibhum Dubey, who reported the issue to STPI and CERT-In, India’s Computer Emergency Response Team. A suspicious external JavaScript tied to the behavior remained embedded in the site’s source, even after the attack briefly disappeared, a review by _CSO_ confirmed, indicating the issue may not have been fully resolved. ## Fake verification flow used to trigger execution The page mimics a standard Cloudflare “Verify you are human” prompt, but includes an additional step instructing users to open Windows Terminal, paste a command, and press Enter, and preloads a string into the clipboard without explicit user action, Dubey said. The copied content is a URL which, when pasted into the terminal, would be interpreted by the system shell to initiate a request to external infrastructure controlled by the attacker. Dubey did not execute the command. The destination associated with the URL has been flagged as malicious by multiple security vendors, with 17 engines detecting it as malicious on VirusTotal at the time of analysis. The method shifts execution from the browser to the endpoint, relying on user interaction rather than direct payload delivery. “What stood out was that this wasn’t a shady email or a fake website, it was on a government portal,” Dubey said. “You go to ananta.stpi[.]in expecting to access STPI services, and you see what looks like a normal Cloudflare verification check. Most users would follow the steps without thinking. That’s what makes it effective: You’re not being redirected somewhere suspicious, you’re already on a site you trust.” ## Looks like TerminalFix The technique observed in this case is consistent with an attack pattern Microsoft calls TerminalFix, a variant of ClickFix. These attacks use spoofed verification pages to prompt users to copy and execute commands locally, moving the point of compromise outside traditional web security controls. “The technique follows the same playbook: fake verification page, clipboard injection, and instructions to execute via the terminal,” Dubey said. “Microsoft has flagged similar patterns in its TerminalFix reporting.” While no direct attribution to a specific campaign has been established, the overlap in behavior, including clipboard manipulation, terminal-based execution prompts, and staged delivery, matches documented attack workflows, Dubey said. ## Staged delivery Inspection of the site’s source shows an external script loaded from cdn[.]quickdelivr[.]com, a domain less than a week old and vaguely resembling the legitimate jsDelivr content delivery network. The registrant of the domain name provided an address in Russia, as for at least three other recently registered domains hosted on the same server at an IP address located in Hong Kong, according to data provided by domaintools.com. Dubey attributed both the fake overlay and clipboard manipulation to this script, a finding independently verified by _CSO_ at the time of reporting. “The attacker appears to be storing command-and-control configuration on external infrastructure in a way that makes takedowns more difficult,” he said. “The script itself is heavily obfuscated and runs through a virtual machine inside the browser, making it hard to analyze. Each visitor is also assigned a unique identifier, suggesting some level of session tracking.” The script interacts with browser components including the document object model and network request interfaces, enabling dynamic content injection and communication with external infrastructure, he added. ## External configuration and persistence concerns The fake verification page, which had briefly disappeared, has since reappeared, according to the researcher. The continued presence of the external script indicates that the underlying mechanism enabling the behavior may still be active. Dubey also pointed to a potential weakness in the site’s WordPress configuration, where the login endpoint reveals a valid administrator username through differential error messages. He noted that confirming whether this was used as an entry point would require server-side analysis. “What’s concerning here is that it’s appearing on a government-linked site,” he said. “The audience includes IT companies, startups, and officials. If a user executes the command on a work system, it could expose credentials or access to internal environments.” CERT-In acknowledged the report to the researcher and said it is “in process of taking appropriate action with the concerned authority.” STPI had not responded to _CSO_ ’s queries at the time of publication.