ClickFix evolution abuses browser fullscreen support to mimic Windows Update

Rafi Mahmood

Observed in the wild

• On 12 November, NHS CTI analyst Daniel B. reported a novel evolution of the widely seen ClickFix technique. Threat actors have been observed leveraging browsers' fullscreen support to simulate a Windows Update page, ultimately prompting users to paste their clipboard (containing malicious commands) into the Windows Run box to "complete the update".
• This is a marked improvement over previous fake CAPTCHA lures, due to its increased sophistication making it more convincing to victims.
• Organisations are advised to monitor for PowerShell or Terminal commands copied from browsers, unexpected clipboard activity, and educate users on ClickFix-style phishing tactics. Disabling Start/Run in Group Policy where possible would inhibit this technique also.

ClickFix Social Engineering | Daniel B.

Du'aine Davis

PHALT#BLYX:  ClickFix Attack Uses Fake Windows BSOD Screens and MSBuild Abuse to deploy DCRAT
Observed in the wild

• A campaign named PHALT#BLYX targeted the hospitality sector, primarily European organisations, during the holiday season. Attackers used phishing emails mimicking Booking.com reservation cancellations with high-value charges to lure victims into visiting malicious sites.
• The infection chain relied on ClickFix social engineering, fake CAPTCHA and BSOD screens to trick users into pasting malicious PowerShell commands. It abused MSBuild.exe (a trusted Microsoft tool) to execute a customised DCRat payload, enabling remote access, keylogging, and process hollowing.
• Organisations are advised to monitor MSBuild.exe for unusual executions from non-standard directories and network activity, enable PowerShell Script Block Logging, and watch for creation of .proj files in %ProgramData% and .url shortcuts in Startup. Detect suspicious Windows Defender exclusions and outbound connections from legitimate binaries like aspnet_compiler.exe to unknown IPs on port 3535.

Threat Research: PHALT#BLYX: Fake BSODs and Trusted Build Tools - Securonix