ClickFix Campaigns Abuse Legitimate Services for Persistent Access

1. Executive summary

ClickFix — a social-engineering technique in which a fake webpage (styled as a CAPTCHA check, browser update notice, or meeting error) instructs the victim to open the Windows Run dialog or macOS Terminal and paste an attacker-supplied command — has become the dominant initial-access and malware-delivery method, displacing exploit- and vulnerability-based entry. Microsoft's team observed it as the most common initial access method last year, and ReversingLabs assesses it has industrialised into an API-driven attack ecosystem that outpaces conventional antivirus and endpoint defences. Two new campaigns demonstrate actors abusing legitimate services to convert that initial access into persistent footholds. No CVEs are involved — the technique deliberately skips exploits and vulnerabilities entirely — so patching posture does not mitigate this threat; control gaps are procedural and behavioural. EMEA financial services clients should treat user-executed paste-and-run as a primary, current initial-access vector and prioritise script-execution controls, egress restriction, and user-facing controls accordingly.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The source material describes a threat technique and campaign trend, not an incident at a client, a specific ICT third-party failure, or a testing obligation tied to a distinctive fact in this item. Generic mappings (e.g. "an incident occurred, therefore Art. 19") would be compliance-checkbox padding. Clients who DO detect ClickFix-sourced execution should reassess under DORA Art. 18 (classification of ICT-related incidents and cyber threats) at that point — but that trigger is not present here.

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated)

1. Lure page. Victim reaches a webpage styled as a CAPTCHA verification, browser update notice, or meeting error. The page carries no exploit — the technique "skips exploits and vulnerabilities entirely."
2. Clipboard or instruction payload. While the victim reads the "prove you're human" instructions, the page quietly places a command on their clipboard (or displays it for manual copy).
3. User-executed delivery. The page talks the victim through opening the Windows Run dialog or macOS Terminal and pasting the command. The victim executes the malware by hand — there is no drive-by exploitation.
4. API-driven payload distribution. Per researcher analysis of ~3,000 live ClickFix payloads, the malicious commands are now handed out by API-driven servers that give each visitor the same malware in a different disguise — per-visitor polymorphism at the delivery layer, defeating static, hash-based blocking.
5. Persistence via legitimate services. The two campaigns in the primary item abuse legitimate services to maintain persistent access following initial compromise. The primary source's body text is summary-only and does not name the specific services, commands, or malware families involved — see caveat below.
6. Repeatable, industrialised operations. ReversingLabs characterises ClickFix as having moved from a one-off trick to an industrialised ecosystem; The Hacker News frames the actor priority as repeatable attacks over novel ones.

Technical specifics relevant to defenders

• Initial access vector: social engineering via fake CAPTCHA/update/meeting-error pages; execution is user-initiated paste-and-run via Win+R Run dialog (Windows) or Terminal (macOS).
• Delivery infrastructure: API-driven servers issuing per-visitor disguised variants of the same malware; a new delivery method was identified that is built to slip past Windows' script scanning (mechanism not detailed in the source excerpt).
• Persistence mechanism: abuse of legitimate services (unnamed in available source text).
• Exploited component/CVE: none — by design.
• Attribution: no named actor, and no MITRE ATT&CK profile exists in the verified reference data (none was resolved for this item). Treat any attribution as unconfirmed; none is asserted here.

Single-sourced / unconfirmed claims — confidence caveat: The specific detail that the two campaigns abuse legitimate services for persistent access rests on the Dark Reading primary item alone, and its available text names neither the services, the malware, the commands, nor the target sectors. The API-driven delivery finding is single-sourced (one researcher's analysis of ~3,000 payloads, reported via The Hacker News). Verify before enforcement: do not build blocking rules on the premise that a specific named legitimate service is abused until the underlying vendor report is obtained.

4. Mitigation & containment

P1 — within 24 hours

• Confirm current policy on user-executed script execution: block or heavily restrict execution from the Run dialog and Terminal for standard users (AppLocker/WDAC on Windows; Gatekeeper + endpoint policy on macOS). ClickFix's entire chain depends on a non-admin user being able to paste and execute arbitrary commands.
• Review egress policy for the endpoint: the chain requires the pasted command to reach out and retrieve a payload. Default-deny outbound for workstations, with allow-listing for business-required destinations, breaks retrieval even if execution occurs.
• Brief the SOC and service desk on the ClickFix pattern (fake CAPTCHA/update/meeting-error page → clipboard payload → "open Run/Terminal and paste") so user reports are triaged as security events, not support tickets.

P2 — within 72 hours

• Hunt retroactively for the behavioural signature: user-initiated powershell/cmd/Terminal execution shortly after browser activity, Run-dialog executions by non-technical users, and clipboard-to-execution patterns. (See §6.)
• Validate that AV/EDR is not the sole control: ReversingLabs assesses the API-driven, per-visitor-disguise delivery outpaces conventional antivirus and endpoint defences. Prioritise behavioural detection and execution-control (allow-listing) layers over signature-based blocking.
• Update user-awareness content to cover ClickFix specifically — no legitimate CAPTCHA, browser update, or meeting platform asks users to open Run or Terminal and paste a command. This is the highest-leverage user-facing message available.

P3 — within 7 days

• Review Windows script-scanning coverage in light of the reported new delivery method built to slip past it; assume script-host execution controls (not signature scanning) are the reliable layer.
• If ClickFix-sourced execution is detected at any point, classify per DORA Art. 18 and reassess reporting obligations at that stage.

5. Indicators of compromise

No indicators of compromise available in the source material. The available source text contains no domains, IPs, hashes, file paths, or command strings for these campaigns.

Behavioural indicators

6. Detection

The sources contain no atomic artefacts (no command strings, file names, mutexes, registry keys, or hashes) usable to author a YARA rule — every string would be invented, which we will not do.

A Sigma rule is authorable from the corroborated behavioural pattern: user-initiated script execution from the Run dialog / Terminal context, which is the defining execution step of the ClickFix chain.

title: ClickFix-Style User-Initiated Script Execution via Run Dialog
id: 8c1f2a44-7d3e-4b9a-a6f1-2e5c9d0b7a83
status: experimental
description: >
  Detects execution of script interpreters launched in a manner consistent with
  ClickFix social engineering, where a user is instructed to open the Run dialog
  (Win+R) or Terminal and paste an attacker-supplied command. Corroborated
  pattern per AT-2026-09-08-800. Tune against your baseline: legitimate admin
  and developer activity will generate false positives.
references:

  - https://www.darkreading.com/endpoint-security/clickfix-campaigns-legitimate-services-persistent-access
  - https://thehackernews.com/2026/09/threat-actors-dont-want-better-attacks.html
  - https://www.helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-report/
author: Adverse Trace
date: 2026/09/08
logsource:
  category: process_creation
  product: windows
detection:
  selection_script:
    Image|endswith:

      - '\powershell.exe'
      - '\cmd.exe'
      - '\mshta.exe'
  filter_parent_legit:
    ParentImage|endswith:

      - '\explorer.exe'   # Run dialog / Start menu launches parent to explorer.exe
  filter_user_context:
    IntegrityLevel:

      - 'Medium'          # standard-user, non-elevated execution
  condition: selection_script and filter_parent_legit and filter_user_context
falsepositives:

  - Legitimate user-launched scripts and utilities from Run dialog
  - Developer and admin workflows on shared endpoints
level: medium

Operational note: this rule keys on the execution step of the chain, not on any campaign-specific artefact — no such artefacts are published in the available sources. Expect false positives from legitimate Run-dialog usage; tune per business unit. macOS equivalents (Terminal-launched osascript, curl-piped-to-shell) should be built from your own EDR telemetry; the sources confirm the macOS Terminal vector but provide no command strings.

7. Sources

• Dark Reading — ClickFix Campaigns Abuse Legitimate Services for Persistent Access — https://www.darkreading.com/endpoint-security/clickfix-campaigns-legitimate-services-persistent-access — 2026-09-08
• The Hacker News — Threat Actors Don't Want Better Attacks. They Want Repeatable Ones — https://thehackernews.com/2026/09/threat-actors-dont-want-better-attacks.html — September 2026
• Help Net Security — ClickFix is changing the economics of social engineering — https://www.helpnetsecurity.com/2026/07/15/clickfix-social-engineering-attacks-report/ — 2026-07-15
• Dark Reading — And the Winner in Dominant Malware Delivery? ClickFix — https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix — undated in provided material
• The Hacker News — Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery — https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html — July 2026

8. Adverse Trace position

ClickFix is now the dominant initial-access and malware-delivery method, and its significance for EMEA financial services is precisely that it inverts the usual defensive calculus: there is no CVE to patch, no exploit to virtualise, and per-visitor payload disguise degrades signature-based AV — the effective controls are execution restriction, egress discipline, and user behaviour. Severity is high as a threat-landscape matter but this advisory carries no client-specific incident, no confirmed attribution (no actor is named and no MITRE profile exists in the verified data), and its most actionable campaign detail — which legitimate services are abused for persistence — is single-sourced and unnamed in the available text; verify before enforcement. We will monitor for the underlying vendor reports naming the abused services and payload families, and will issue a follow-up advisory with atomic IOCs and campaign-specific detection content when those artefacts are published.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.