Copy, Paste, Compromise: The Tale of ClickFix

The ClickFix social engineering technique does not exploit software — it exploits trust. And the fact that it's designed to bypass anti-virus (AV) and endpoint-detection and response (EDR) solutions explains why it's one of the most widely vehicles for malware delivery today.

In this new report, ReversingLabs' threat intelligence research team takes a deep dive into ClickFix's methodology, covering:

• The attack chain: The complete campaign, from fake CAPTCHA to fileless execution.
• The pushbutton nature: Malware-as-a-Service (MaaS) economy selling attack kits from $250/month.
• Payload families: Lumma Stealer, RATs, loaders, and rootkits.
• Case study: A real-world watering-hole case study with blockchain-hosted C2.
• Hardening strategies: Methods to actually stop ClickFix.
• Modern threat hunting: An RL-developed open-source YARA rule that caught 123 lures every AV engine missed.

The open-source YARA rule was built by RL and validated in Spectra Analyze against our curated repository of 422B+ samples. Deploy it today to hunt ClickFix lures already in your environment.

Get the Report