ClickFix has never been bigger, and AI tools are its most convincing lure yet

ClickFix attacks are seeing a massive surge in adoption by threat actors, who are now weaponizing the hype around AI tools to make their social engineering lures nearly irresistible. The technique, which tricks users into copying and pasting malicious PowerShell commands or downloading malware by faking a browser or system error, is being deployed through fake AI installer pages, malicious SEO results, and even trusted chatbot platforms.

Technical Breakdown: – Primary TTP: Social Engineering (T1566) via fake error messages prompting users to execute a "fix" (e.g., ctrl+v into a Run dialog). – Delivery Vectors: – Malicious search ads for popular AI tools (e.g., "DeepSeek," "Sora"). – Compromised or fake GitHub repositories offering AI software. – Direct messages on platforms like Discord and Telegram. – Payloads: Typically leads to infostealers (e.g., Lumma, Vidar) or remote access trojans (RATs). – Evasion: Bypasses traditional email security and web filters because the initial payload is often a text-based instruction (the "fix") rather than a malicious file.

Defense: – User Education: This is the primary defense. Train users to never copy-paste commands from a website into a terminal or Run dialog. – Block Script Execution: Enforce PowerShell execution policy restrictions and block mshta.exe, regsvr32.exe, and other LOLBins from executing from web browsers or user-writable directories. – Search & Ad Blocking: Deploy DNS filtering to block known malicious domains and consider using ad-blockers on corporate-managed browsers to reduce exposure to malvertising.

Source: https://www.bleepingcomputer.com/news/security/clickfix-has-never-been-bigger-and-ai-tools-are-its-most-convincing-lure-yet/