Russian APT Groups Adopt the ClickFix Technique

The social-engineering technique known as ClickFix, which for a long time remained a tool of financially motivated cybercriminals, is now being used by more advanced groups as well. According to Ars Technica, it has been taken up by hacking groups linked to Russia and considered among the most technically capable.

What ClickFix Is

ClickFix is a trick in which a victim is deceived into running a malicious command on their own device themselves. This usually happens under the guise of fixing a technical problem: the user is shown a fake error message and prompted to copy and paste a command into the system terminal or the “Run” window in order to supposedly resolve it. In reality, that command downloads and launches malware.

A Shift in Tactics by Elite Groups

Previously, such schemes were associated primarily with mass fraud campaigns aimed at financial gain. The move to ClickFix by more skilled groups is a sign that the technique has proven its effectiveness and has become a universal tool for gaining initial access to victims' systems, regardless of the attackers' motivation.

The use of the same method by both ordinary scammers and highly skilled groups makes the defenders' job harder: an attack becomes more difficult to classify by its infection vector alone, which means more attention must be paid to behavioral analysis and to training users to recognize such ploys.

What It Means for Security

Cybersecurity experts recommend treating with suspicion any instructions that prompt you to manually enter commands into a terminal or an operating-system dialog box to “fix” technical glitches. It is precisely the human factor that remains the key link in such attacks, and the spread of ClickFix among elite groups makes user awareness even more important.

Source: Ars Technica