Copy, Paste, Compromise: How ClickFix Turned Simple Commands into a Full-Blown Breach
A social engineering twist with fileless tactics that evaded traditional defences
The affected organisation operates in a heavily regulated sector, with a Windows-first endpoint estate, Microsoft 365 productivity stack, and standard enterprise EDR coverage. Internet access is heavily filtered, but user-driven interactions, especially for troubleshooting, are common in the workflow, a perfect setup for an attacker banking on human trust as the weakest link.
What Stood Out (The First Signal)
The first alert wasn’t a clear “malware detected” banner. It was subtler: an analyst noticed a high-privilege endpoint spawning a PowerShell session immediately after the user opened what appeared to be a CAPTCHA verification page. That alone wouldn’t trigger full-blown alarms in an environment where administrators sometimes troubleshoot using PowerShell. But the timestamp told a different story. This happened outside standard operating hours, and the parent process wasn’t a management tool. It was the Windows Run dialog.
That combination – PowerShell launched by a user via Run, not a management process – was a critical deviation from baseline. This was the point where our team moved from curiosity to suspicion.
Minute-by-Minute: From Alert to Containment
- 08:54 – Behavioural analytics flagged the unusual PowerShell execution.
- 08:58 – Manual pivot confirmed the session pulled an encoded command from memory rather than a file – often a precursor to fileless attack patterns.
- 09:02 – Analyst requested live telemetry for network activity and saw outbound calls to a short-lived domain sitting behind a content delivery service—unusual for admin activity.
- 09:08 – Host isolation initiated to break potential command-and-control (C2) communication before persistence could be established.
Within minutes, the triage escalated from a single behavioural anomaly to a suspected multi-stage intrusion attempt.
Incident Progression
How the Incident Unfolded
The story started with the user attempting to pass what looked like a CAPTCHA on a third-party vendor site. Behind that page sat the ClickFix technique: instructions telling the user to “fix verification issues” by copying a command into Windows Run. To the user, it felt like a reasonable self-help step. In reality, it was the perfect social engineering hook to bypass email filters and web proxies by making the user their own installer.
How the Threat Established Itself
The PowerShell command retrieved an AES-encrypted payload disguised as an .m4a audio file. Once decrypted in memory, additional components staged themselves without leaving traditional binaries on disk. This minimised detection by EDR agents, which rely heavily on disk artifacts. The malware leveraged living-off-the-land binaries to persist and execute further scripts – classic evasive behaviour for a fileless campaign.
What the Team Observed Next
Once decrypted payload execution began, the malware attempted to pull additional scripts from an attacker-controlled infrastructure. These scripts exhibited infostealer behaviour, enumerating browser sessions and credential data, before laying groundwork for potential remote access. Fortunately, endpoint isolation pre-empted full execution, but not before the telemetry confirmed clipboard interaction and task scheduler changes intended for persistence.
What We Did (Human-Led Response)
Automation surfaced the anomaly, but the escalation hinged on human intuition: understanding that a parent chain like Run → PowerShell was contextually almost impossible for automated patch jobs. Our SOC analysts issued a live response:
- Immediate host isolation to kill outbound traffic
- Forensic memory dump to confirm decrypted payload signatures
- Retro-hunt across the tenant for ClickFix-like behavioural patterns (PowerShell spawned by shell UI components + clipboard monitoring)
Within the hour, containment was complete, and no lateral movement occurred. The team also identified the social engineering lure, enabling the client to remove the compromised third-party page from its vendor exposure list.
Why This Was a High-Priority Threat
ClickFix isn’t a vulnerability exploit—it’s a trust exploit. By hijacking expected “fix-it” workflows, it bypasses perimeter controls, email gateways, and even sandboxing, leaving behavioural detection as the only real line of defence. Had this persisted beyond the staging phase, the payload had capabilities linked to known families like Lumma Stealer and RAT kits such as XWorm, leading to potential credential theft, remote access, and long-tail compromise risk across the estate.
Defender-Relevant Behaviours Observed
- PowerShell spawned from Windows Run dialog rather than IT automation tools
- AES-encrypted payload disguised as benign media file
- Command staging entirely in memory; minimal disk I/O
- Outbound connections to ephemeral domains fronted by CDN services
- Clipboard access patterns consistent with ClickFix lure script behaviour
Lessons Learned & Hardening Guidance
- User Awareness: Train users that legitimate sites never require terminal commands for verification
- Hardening: Apply Microsoft Attack Surface Reduction (ASR) rules for script execution and block child process creation via User Initiated Input dialogs
- Monitoring: Combine telemetry for PowerShell parent-child chains with clipboard usage to profile ClickFix techniques
- Policy Enforcement: Disable Run dialog access where business need is low; apply constrained language mode for PowerShell
ClickFix and similar campaigns expose gaps between user trust and technical defences. Are you confident your detection strategy can catch this hybrid of social engineering and fileless execution?
Contact Redsquid’s SOC for a Defender readiness review and proactive threat hunt tailored to your environment.