ClickFix Abuse Gives Threat Actors Persistent Access

Introduction

In today’s hyper‑connected environment, attackers constantly search for fresh avenues to breach defenses. Recent incidents reveal that the ClickFix social‑engineering method is being weaponized to turn legitimate communication platforms into footholds for long‑term intrusion. These attacks demonstrate how deception can turn trusted services into footholds for persistent access. These tactics reflect a broader shift in adversary behavior, where the line between legitimate communication and malicious activity is increasingly blurred. As organizations adopt newer collaboration platforms, attackers exploit the very features designed to enhance productivity.

Exploiting Trusted Collaboration Tools for Stealthy Intrusion

The first observed campaign targeted organizations that rely heavily on Microsoft Teams and similar chat ecosystems. Attackers sent carefully crafted emails containing a link that appeared to lead to a legitimate document request hosted on a ClickFix‑styled landing page. Once the victim clicked, the page prompted the user to download a seemingly innocuous file, which in reality delivered a lightweight backdoor. By harvesting the victim’s credentials during the interaction, the adversary was able to add a malicious device to the organization’s directory and maintain access even after the initial payload was removed. After the initial foothold was established, the attacker employed scheduled tasks to ensure the backdoor persisted across reboots, and used credential dumping tools to harvest additional account hashes. This approach allowed the threat actor to move laterally, exfiltrate data, and issue further commands through encrypted command‑and‑control traffic, staying hidden from standard alerts.

• Authentic‑looking URLs that evade initial suspicion.
• Credential harvesting through fake login prompts.
• Deployment of living‑off‑the‑land binaries to avoid detection.
• Persistence via scheduled tasks and credential dumping.
• Encrypted C2 communication that conceals command and control traffic.
• Lateral movement using compromised accounts and stolen hashes.

Multi‑Layered Social Engineering Chains Target Enterprise Services

A second campaign focused on Zoom and email platforms, illustrating a more elaborate chain of deception. The threat actor first sent a phishing message that referenced an urgent meeting invitation, embedding a ClickFix link that redirected to a malicious site mimicking a corporate portal. Victims who entered their credentials were then presented with a second‑stage payload disguised as a meeting agenda PDF, which actually installed a credential‑stealing module. The module leveraged the already compromised credentials to move laterally across the network, hijacking privileged accounts and establishing a foothold that survived routine password resets. The malicious PDF leveraged a macro‑enabled Office document that executed a PowerShell script to download a secondary payload from a remote server, further expanding the attacker’s control.

• Chaining of social‑engineering lures to increase success rates.
• Use of familiar meeting contexts to lower victim vigilance.
• Delivery of multi‑stage malware combining social and technical tactics.
• Use of PowerShell scripts and living‑off‑the‑land binaries to bypass application whitelisting.
• Final stage involved ransomware deployment to extort data and force payment.

Conclusion

Overall, the rise of ClickFix‑based social engineering highlights the need for organizations to move beyond perimeter‑centric defenses and adopt continuous, AI‑enhanced monitoring. By integrating advanced automation with robust cybersecurity practices, enterprises can stay ahead of evolving threat vectors and protect their critical assets. Such proactive measures align with Grivyonx’s commitment to delivering AI‑powered security automation that anticipates emerging threats. Such measures also support compliance frameworks and reduce the likelihood of costly data breaches.