ClickFix: When criminals trick you into infecting yourself

The olden days

Remember the olden days, when cybercriminals used to email you fake security warnings, or pop them up in your browser, hoping to lure you into downloading and installing malware all by yourself from a dubious web link they “helpfully” provided?

The download was pitched as a “fix”, but in reality it only made things worse.

Even if the downloaded program actually did something useful in the foreground to convince you it was legitimate, it would secretly install malware in the background so that the attackers could steal your data, spy on you, log keystrokes to sniff out your passwords, and much more.

Fortunately, most of us – sadly, not all of us, and not all the time – learned not to download random files and run them, and our email and web filters learned to block known-bad links to reduce the chance of us downloading them anyway.

From web links to phone numbers

As the effectiveness of emails and web popups offering fake “fixes” waned, the criminals switched aggressively to voice calls instead

At first, the crooks would acquire phone lists from venal marketing and lead-generation companies, or buy up phone numbers from data breaches offered for sale on the dark web by other criminals.

But this meant they had to call number after number until they got a victim on the hook, and then try and lure them into downloading and installing malware, or granting the scammer remote access (for example by using Windows Remote Assistance or a similar helpdesk tool), or handing over credit card details to pay for a “fix” for a made-up “problem.”

Soon, the criminals flipped around the flow, using web popups with a variety of different scares, offers, threats, or other high-pressure tactics, with a toll-free number in the recipient’s own country that they could call for a “free fix.”

Simply put, possible victims ended up calling up for “help” of their own accord.

After all, they weren’t clicking a risky link or opening a dubious attachment – they were simply phoning a number that the other end was paying for, so what harm could that possibly do?

The answer, of course, was that the call center “staff” at the other end were specially trained to talk them into endangering themselves, using a mix of flattery and fear to squeeze victims into complying with their instructions.

Fortunately, most of us learned not to take this sort of “helpdesk call” seriously, and the scammers found their payoffs waning once again.

From phone numbers to hidden commands

So, what better to try next than popup instructions that tell you how to you “fix” things for yourself?

This is an infamous cybercrime trick known in the jargon as a ClickFix attack, so named because it promises a “fix” that you can carry out all on your own, with a few simple clicks and keystrokes.

No download links to visit, no email attachments to save, no phone calls to make or receive, no remote assistance requests to approve – just bogus-but-believable popup “advice” with a self-contained list of instructions claiming to tell you how to “fix the problem right now.”

There are many different versions of this trick, using various excuses, such as: solving a CAPTCHA, confirming a login attempt, fixing a “registry error”, refreshing an expired session, and many more.

But the underlying deception is similar each time.

The crooks aim to lure you into opening a menu, dialog or window locally, on your own computer, that is usually used to launch Windows commands directly, such as the Windows Run dialog, or even a full-on Command Prompt or PowerShell window.

Any program names or commands you type in at this point are basically mini-programs that run directly under your account, with all the access rights you already have, which includes access to all your own files, even if you aren’t an Admin-level user.

For example, consider this example ClickFix screenshot from Wikipedia:

There are two huge problems here.

Firstly, Win+R brings up this dialog, which many users will know, and probably have used before, perhaps without recognizing the risks it brings:

A common use for the Run dialog is to launch regular Windows programs that you know the name of, such as notepad (Microsoft’s built-in text editor), without needing to rootle through your menus or have a shortcut on your desktop or task bar:

In real life, if you were to type in the text Verification Code: 123456, as the ClickFix dialog implies it will do for you, like this․․․

․․․you’d just get an error message, because that text tries to run a program named Verification, which doesn’t exist.

But most ClickFix attacks trick you by asking you to press Ctrl+V to paste the suggested text instead, which almost everyone will do because it’s much more convenient than re-typing the given text by yourself.

However, the rogue web page you are on uses a JavaScript function such as navigator.clipboard.writeText() to pre-fill your clipboard with completely different text.

What actually gets pasted is not the harmless-looking (and ultimately useless) verification code suggested, but a malicious Windows command that runs malware code instead, usually written in PowerShell.

Normally, just typing powershell into the Run dialog opens up a PowerShell command window, leaving you at a prompt where you can enter script commands if you like, but without actually running any PowerShell code for you:

For better or worse, however, Microsoft allows PowerShell script code to be added to the command line itself, instead of loading it from a file, thus allowing what’s known as fileless malware, with no script to download first.

For example, pasting the string powershell read-host 'Press [Enter]' into the Run dialog not only opens the expected PowerShell window, but also automatically runs the read-host command (accept user input from the console) as a script:

And if you have a complex script including raw binary data that can’t be pasted as regular text, or want to hide the code in the script from the user, or both, you can use base64 encoding to convert it into letters and numbers, so you can paste it without arousing suspicion.

Here’s the PowerShell program text read-host 'Press [Enter]' converted into base64, running directly from the Run dialog, without using any files, or giving the content of the code away:

And by adding the official option -windowstyle hidden to the command line pasted into the Run dialog, attackers can launch their rogue script so that its execution is largely invisible – even if it carries on running for minutes or hours.

There’s a very brief flash as a -windowstyle hidden PowerShell process starts up, but numerous official Windows scripts do the same thing, so this sort of behavior is not unusual.

What to do?

The problems here are easy to deal with if you remember four simple facts:

• The Windows Run dialog (usually popped up with Win+R) isn’t safe to use with other people’s unknown input. This dialog lets you run any already-installed Windows program you like, together with any command-line arguments it will accept that allow it to be controlled remotely. The programs you launch here are run locally, directly on your computer, and can do anything you can do. There is no sandboxing or other protection that you would expect inside your browser.
• Pasting text with Ctrl-V on the say-so of a web page in your browser is totally unsafe. The text that the browser claims is in the clipboard (as with the bogus Verification Code in the image above) isn’t necessarily the text that actually is in the clipboard.
• PowerShell scripts don’t need to be saved to a local file first. That means there is no download for you to approve, and no tell-tale local files for your EDR software to detect and block. Attackers can inject the malicious program they want to run right into the powershell command itself. The same applies to old-school BAT (batch file) scripts for the Command Prompt, and many other script-based programming tools.
• Some ClickFix attacks skip the Run dialog and get you to open a PowerShell window (or a Command Prompt window) directly and then paste their rogue code into that. These attacks often pretend to be “fixing” a serious system problem “automatically,” so they ask you to right-click on the Windows icon in the task bar and choose the Terminal (Admin) or PowerShell (Admin) option. They claim they need this level of access to complete the “fix”; in reality they’re just squeezing you to give them almost unlimited access to your computer, and perhaps even your network.

To put it bluntly:

• DON’T run commands that an outsider provided you. They could do just about anything, and probably will.
• DON’T trust a pasted clipboard that was filled for you by a web page you visited. It could contain anything, and probably will.
• DON’T run any command as Admin (assuming you have the power to do so) on someone else’s say so. You could give away the keys to the kingdom, and probably will.

ClickFix attacks work because they sound like a safe and simple “fix” that doesn’t ask you to engage in any behavior that would historically have been considered reckless.

But just because you’re not saving a rogue attachment, not clicking an unknown link, and not talking to an unknown caller․․․

․․․doesn’t mean you’re safe!

If in doubt, leave it out.

Ask how SolCyber can help you do cybersecurity in the most human-friendly way. Don’t get stuck behind an ever-expanding convoy of security tools that leave you at the whim of policies and procedures that are dictated by the tools, even though they don’t suit you or your business!

More About Duck

Paul Ducklin is a respected expert with more than 30 years of experience as a programmer, reverser, researcher and educator in the cybersecurity industry. Duck, as he is known, is also a globally respected writer, presenter and podcaster with an unmatched knack for explaining even the most complex technical issues in plain English. Read, learn, enjoy!