IClickFixMalware
IClickFix is a malicious JavaScript framework deployed on compromised WordPress sites to deliver further malware using the ClickFix social engineering tactic and fake Cloudflare Turnstile CAPTCHA challenge.From MISP Galaxy
Last reported 1 month ago, by Sekoia.io4 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1684Social Engineering
“… unveiling emerging adversary clusters, TDR analysts identified a widespread malware distribution campaign leveraging the ClickFix social engineering tactic through a Traffic Distribution System (TDS).”
- T1036Masquerading
“Of note, this PowerShell script is masquerading as a legitimate installer for “SecureModule Engine v1.0.0” , with installation messages and a progress bar.”
- T1053.005Scheduled Task
“…paths, extracts the archive in the %APPDATA% directory, and starts "hypersnap.exe" executable without a visible window and creates a scheduled task triggered at user logon.”
- T1110Brute Force
“The fact that both addresses succeeded on the first attempt rules out any possibility of brute force discovery.”
- T1110.004Credential Stuffing
“The distribution across seven consumer residential ISPs spanning three countries is consistent with the use of a credential stuffing tool routed through a residential proxy service.”
- T1119Automated Collection
“NetSupport adds an operator driven capability after Amatera’s automated collection.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Exvicy: A Copycat of the ErrTraffic Malware Distribution Framework“It became a leading competition among ClickFix distribution clusters, alongside ClearFake, KongTuke, SmartApeSG, and IClickFix.”
-
ClearFake WebDAV infection chain delivers Amatera stealer, ZigCryptoStealer, and NetSupport Manager“The exact license file has appeared in numerous malicious NetSupport packages, including activity publicly tracked as EVALUSION and IClickFix.”
-
ErrTraffic: A Growing ClickFix Malware Distribution Framework“To protect our customers from ErrTraffic and other ClickFix-based frameworks (ClearFake, IClickFix), Sekoia.io analysts will continue proactive monitoring of these threats and tracking their C2 infrastructure.”
-
Meet IClickFix: a widespread framework using the ClickFix tactic“Meet IClickFix: a widespread framework using the ClickFix tactic”
Indicators in its reports
named in the reports above- chatgpt-web[.]vipin 2 reports
- flare[.]ioin 1 report
- verification[.]googlein 1 report
- pf[.]chin 1 report
- leaguejazire[.]comin 1 report
- riyazinikokar[.]xyzin 1 report
- hxxps://telegra[.]ph/Functions-04-03in 1 report
- 145.249.109[.]147in 1 report
- 45.150.34[.]2in 1 report
- 279d04c0cfd700c8…772739aecb92in 1 report
- lb.propertyfind[.]ccin 1 report
- fd.gstats-api-contact[.]ccin 1 report
- pkg.vogueatelier[.]ccin 1 report
- kffd3.vogueatelier[.]ccin 1 report
- kffd3.vexlatech[.]ccin 1 report
- static.quorashift[.]ccin 1 report
- 643ef35536ff9273…44b02131b205in 1 report
- 1819827e17f31e72…da9f24179b25in 1 report
- update.dubbedmuch[.]ccin 1 report
- hxxps://kr.cedar2glanz[.]ru/jewel.jsin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.