ClickFix attacks exploit image files to secretly conceal malicious content from detection systems

Cybersecurity researchers at Huntress have uncovered a sophisticated, multi-stage malware operation that leverages a deceptive technique known as ClickFix to trick victims into manually executing malicious commands.

This new campaign delivers information-stealing malware such as LummaC2 and Rhadamanthys and uses steganography to hide malicious code within image files, thereby evading traditional detection systems.

From fake updates to stego-loaded payloads

ClickFix lures typically appear as “Human Verification” or “Windows Update” screens that instruct users to press Win+R and Ctrl+V, prompting them to paste and execute a malicious command copied to their clipboard.

The command launches mshta.exe, which fetches a remote JScript payload hosted on attacker-controlled infrastructure. This script executes further PowerShell commands that decrypt and load a .NET assembly, marking the start of a five-stage infection chain.

The PowerShell script is heavily obfuscated with junk code to hinder analysis. Once cleaned, it’s seen decrypting and loading a .NET assembly reflectively.

This loader then retrieves an embedded PNG image that hides the next malware stage using an advanced steganographic algorithm.

Instead of simply appending malicious data, the attackers encode the shellcode directly into the image’s pixel data and extract it later via the image’s color channels at runtime.

Injecting payloads and stealing data

After decryption, the loader extracts and executes the hidden shellcode using process injection into explorer.exe.

The steganographically concealed payloads have been identified as Donut-packed shellcode, a known wrapper that allows .NET payloads to execute directly from memory.

Final-stage payloads include the LummaC2 infostealer, which exfiltrates browser data, credentials, and cryptocurrency wallet information, and more recently, Rhadamanthys, a modular stealer with similar capabilities.

Recent variants of ClickFix employ fake Windows Update pages featuring realistic “Working on updates” animations to lure users.

These incidents, observed since October, originate from multiple domains pointing to IP 141.98.80[.]175, with PowerShell loaders hosted on securitysettings[.]live and xoiiasdpsdoasdpojas[.]com.

Defense and mitigation

Huntress advises organizations to disable the Windows Run dialog via Group Policy or registry settings to block the initial infection vector.

Security teams should also train users on recognizing social engineering tactics, especially scenarios that request running commands via the Windows Run prompt.

Monitoring explorer.exe spawning mshta.exe or PowerShell.exe processes can further help identify early stages of a ClickFix infection. Despite the use of steganography and multi-layer encryption, analysts emphasize that these attacks rely on a straightforward vector of human interaction.

Follow us on Google News , LinkedIn and X to Get More Instant Updates, Set Cyberpress as a Preferred Source in Google.