10 minhigh
ClickFix doesn't attack your knowledge. It attacks your trust.
ClickFix is a mature Malware-as-a-Service attack methodology that uses fake verification prompts to silently poison the user's clipboard with malicious commands, which are then pasted into Windows Run or macOS Terminal. The execution chain relies entirely on living-off-the-land binaries (PowerShell, mshta.exe, curl, rundll32.exe), making it invisible to traditional EDR and AV tooling. A specific watering hole attack on a university site delivered zuhe.dll, a Go-based RAT, using blockchain-based C2 via Ethereum smart contracts to evade infrastructure takedowns.
Sens:▲ 24hConf:high
Showing defanged values
- filenamezuhe.dllGo-based post-exploitation RAT dropped in watering hole attack on university student association site; features three obfuscation layers, anti-sandbox checks for 14 environments, and multi-channel C2
Detection / Hunteropenrouter
What Happened
Attackers are using a technique called ClickFix to trick people into infecting their own computers. The attack works by showing a fake verification screen (like a CAPTCHA) on a website the victim trusts, and secretly copying a malicious command to their clipboard. When the victim follows the on-screen instructions to paste and run that command, they unknowingly install malware. This is very hard for security software to detect because the attack uses built-in system tools that look completely normal. The attackers sell this as a ready-made kit to other criminals, making it widespread. People and organizations should know that legitimate websites never ask you to copy and paste commands into your computer's Run dialog or Terminal, and should consider restricting what standard users can run on their machines.
Key Takeaways
- ClickFix is an industrialized MaaS attack methodology that uses fake verification prompts (CAPTCHAs, browser updates) to trick users into pasting malicious commands from their clipboard into Run dialog or Terminal
- EDR and AV tools are structurally unequipped to detect ClickFix because every step in the execution chain uses trusted, signed system utilities (PowerShell, mshta.exe, curl, rundll32.exe) that appear as normal user behavior
- A watering hole attack on a university student association site compromised 5-10 students using a fake Google CAPTCHA, delivering zuhe.dll, a Go-based RAT with three obfuscation layers and anti-sandbox checks
- Attackers are increasingly using blockchain-based C2 via Ethereum smart contracts to retrieve payloads, eliminating IP/domain infrastructure that can be blocked or taken down
- ClickFix MaaS kits sell for $250-$1,800 with pre-built lure templates, domain rotation, and AV-bypass advertised as a feature
Affected Systems
- Windows endpoints (PowerShell, Run dialog, rundll32.exe used in execution chain)
- macOS endpoints (Terminal used as execution vector)
- Chromium-based browsers (credentials, cookies, session tokens, autofill data, browsing history targeted)
- Firefox browsers (credentials, cookies, session tokens, autofill data, browsing history targeted)
- WordPress sites with outdated plugins (used as watering hole infrastructure)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Victim visits trusted compromised website (watering hole) displaying a pixel-perfect fake Google CAPTCHA verification prompt
- Clipboard Poisoning: JavaScript on the fake page silently overwrites the victim's clipboard with a malicious command
- Execution: Victim follows on-screen instructions to open Win+R or Terminal, paste (Ctrl+V), and press Enter, executing the payload via trusted system utilities (PowerShell, rundll32.exe)
- Persistence & C2: Payload (zuhe.dll) loads in memory via rundll32 loading a remote DLL over SMB/WebDAV; C2 traffic routed through blockchain-based Ethereum smart contracts and gRPC over Tor
- Collection & Exfiltration: RAT harvests credentials, cookies, session tokens, autofill data, and browsing history from Chromium and Firefox browsers from within legitimate Windows processes without UAC prompts
Detection Availability
- YARA Rules: Yes
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
- Platforms: ReversingLabs ClickFix research report
An open-source YARA rule is available in the ReversingLabs ClickFix research report. It targets the structural behavioral fingerprint of ClickFix lures: fake verification UI elements, clipboard-writing JavaScript functions, and PowerShell payload indicators. The rule requires multiple conditions to match to minimize false positives.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | ClickFix execution chains use trusted, signed system utilities (PowerShell, mshta.exe, curl, rundll32.exe) that appear identical to normal user/administrator behavior. EDR tools calibrated for malicious code execution patterns will not flag this chain. Some payloads execute entirely in memory without touching disk. |
| Network Visibility | Low | Blockchain-based C2 via Ethereum smart contracts eliminates traditional IP/domain infrastructure to block or monitor. gRPC over Tor further obscures network telemetry. SMB/WebDAV traffic for remote DLL loading may blend in with legitimate file sharing activity. |
| Detection Difficulty | Hard | The attack is designed so every individual step classifies as normal behavior. Detection requires correlating the full chain rather than individual events. Blockchain-based C2 and in-memory execution eliminate traditional file and network indicators. YARA rules targeting the lure pages are the most effective detection method but require web content inspection capabilities. |
Required Log Sources
- PowerShell Script Block Logging (Event ID 4104)
- AMSI logging
- Process creation events (Sysmon Event ID 1 or Windows Security Event ID 4688)
- Clipboard access monitoring
- Browser process memory access events
- Network connection events for SMB/WebDAV and outbound Tor traffic
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for processes where rundll32.exe loads a DLL from a remote SMB or WebDAV path, as this is unusual behavior that may indicate ClickFix payload delivery | Sysmon Event ID 1 (process creation) and Event ID 7 (image loaded), EDR process telemetry | Execution | Medium — some legitimate administrative tools may load remote DLLs, but this is uncommon in most environments |
| Consider hunting for PowerShell execution initiated shortly after clipboard write events or Run dialog usage, as this pattern may indicate a user pasted a ClickFix payload | PowerShell Script Block Logging (Event ID 4104), clipboard monitoring, Windows Event Log for Run dialog usage | Execution | Medium — IT staff may legitimately paste commands into Run dialog, but the combination with clipboard writes from browser sessions is suspicious |
| Consider hunting for browser credential stores being accessed by non-browser processes, which may indicate a RAT like zuhe.dll harvesting data from within a legitimate Windows process | EDR file access monitoring, Sysmon Event ID 10 (process access), browser security logs | Collection | Low — legitimate credential access is typically performed by the browser process itself or authorized password managers |
| Consider hunting for outbound Tor connections or gRPC traffic from non-Tor applications, which may indicate blockchain-based C2 communication | Network firewall logs, proxy logs, EDR network connection events | Command and Control | Low — Tor usage is uncommon in most enterprise environments and gRPC from unexpected processes warrants investigation |
| Consider hunting for JavaScript on web pages that writes to the clipboard without explicit user action, as this is the core ClickFix delivery mechanism | Web proxy logs with content inspection, browser extension logging, WAF logs | Initial Access | Medium — some legitimate web applications use clipboard APIs, but automatic clipboard writes on verification pages are suspicious |
Control Gaps
- Hash-based and reputation-based detection cannot keep up with infrastructure that rotates faster than coverage develops
- EDR cannot flag execution chains that use only trusted, signed system utilities in expected ways
- Blockchain-based C2 via Ethereum smart contracts eliminates traditional IP/domain blocking and takedown capabilities
- In-memory execution of payloads bypasses file-based detection controls
- Clipboard monitoring is not a standard capability in most endpoint security tooling
Key Behavioral Indicators
- rundll32.exe loading a DLL from a remote SMB/WebDAV path with a disguised .google filename
- PowerShell execution originating from Run dialog or Terminal shortly after browser clipboard activity
- Non-browser processes accessing Chromium and Firefox credential stores, cookies, and session tokens
- JavaScript clipboard write events on pages displaying fake CAPTCHA or verification UI elements
- Yandex Metrica tracking combined with cjs_id cookie on compromised WordPress sites used for victim profiling
- Outbound gRPC or Tor traffic from processes that would not normally use these protocols
False Positive Assessment
Medium — ClickFix execution chains use legitimate system utilities that are also used by administrators and IT staff for maintenance tasks. Detection based on individual process events will generate false positives. Correlation of clipboard activity with subsequent PowerShell/rundll32 execution and browser credential access is needed to reduce false positives. YARA rules targeting lure page structure have lower false positive rates due to multi-condition matching.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider deploying PowerShell Constrained Language Mode to prevent arbitrary script execution even when users launch PowerShell manually
- Evaluate whether enabling PowerShell Script Block Logging and AMSI would improve visibility into ClickFix execution chains in your environment
- If supported by your endpoint tooling, consider hunting for rundll32.exe loading DLLs from remote SMB/WebDAV paths, particularly with unusual file extensions
- Consider blocking or restricting outbound Tor traffic if your network policies permit, to disrupt blockchain-based C2 communication
Infrastructure Hardening
- Consider implementing Windows Defender Application Control or AppLocker to restrict which binaries can execute on endpoints
- Evaluate whether suppressing the Windows Run dialog (Win+R) for standard users is operationally feasible in your environment
- If you manage WordPress sites, consider auditing for outdated plugins and applying patches promptly to prevent watering hole compromises
- Consider deploying web content inspection or WAF rules that detect JavaScript clipboard-writing functions on verification or CAPTCHA pages
User Protection
- Consider rolling out browser extensions or policies that restrict clipboard access from web pages, particularly automatic clipboard writes without explicit user consent
- Evaluate whether your EDR or browser security tooling can detect and alert on non-browser processes accessing browser credential stores
- If applicable, consider implementing browser session isolation or containerization for high-risk user populations
Security Awareness
- Consider incorporating into existing awareness programs the simple rule: legitimate software, websites, and IT tools never instruct users to copy and paste a command into the Run dialog or Terminal
- Consider training users to recognize fake CAPTCHA and verification prompts, especially on sites they frequently visit and trust
- Consider educating users that clipboard contents can be silently overwritten by websites and that pasting commands from web pages is inherently risky
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Credential Access
Tactic
Collection
Additional IOCs
- Command Lines:
- Purpose: Load remote DLL via SMB/WebDAV using a disguised .google filename | Tools:
rundll32.exe| Stage: Execution |rundll32.exe
- Purpose: Load remote DLL via SMB/WebDAV using a disguised .google filename | Tools:
- Other:
.google- Disguised file extension/name used by rundll32 to load a remote DLL via SMB/WebDAV in the watering hole attackcjs_id- Cookie used as a profiling mechanism alongside Yandex Metrica tracking to identify victims on compromised WordPress sites