Kimusky Hackers Leverage ClickFix Method to Deploy Malicious Scripts on Target Systems

Cybersecurity researchers at the Genians Security Center (GSC) identified a sophisticated campaign attributed to the North Korean APT group Kimsuky, leveraging the so-called “ClickFix” tactic to compromise target systems.

ClickFix, first documented by Proofpoint in April 2024, exploits user psychology by presenting seemingly legitimate troubleshooting instructions or security verification prompts, ultimately coercing victims into executing malicious PowerShell or script commands on their own devices.

Evolution of the ClickFix Tactic

The ClickFix method is a form of social engineering that disguises malicious intent behind plausible instructions, such as fixing browser errors or entering authentication codes.

Originally, it involved fake error messages on compromised websites, prompting users to copy and paste code into PowerShell.

Recent iterations have expanded to multilingual phishing emails, fake job portals, and even mimicked security interfaces of popular Korean web portals.

In each scenario, the user is manipulated into executing a pre-crafted command, typically obfuscated to evade detection and reverse-engineered analysis.

For instance, in a January 2025 spear-phishing attack, Kimsuky operatives impersonated a European journalist to lure a South Korean expert into opening a malicious Visual Basic Script (.vbs) file.

The script, delivered via an encrypted archive, executed a multi-stage payload: launching a decoy document, creating hidden directories, downloading further malware from a command-and-control (C2) server, and establishing persistence through scheduled tasks.

Obfuscation techniques, such as inserting random numeric strings and using reverse string transformations, were employed to bypass signature-based detection.

By March 2025, the group had shifted to a more refined ClickFix approach. Targets received phishing emails purportedly from aides to senior U.S. officials, containing multilingual manuals and code snippets.

According to Genians Security Center (GSC) Report, victims were instructed to paste obfuscated PowerShell commands often in reverse order into their consoles.

These commands, once executed, would contact C2 infrastructure, download additional payloads, and exfiltrate sensitive information.

Infrastructure and Attribution

Kimsuky’s infrastructure is characterized by a rotating set of C2 domains, often leveraging compromised or newly registered domains with plausible names.

Notable C2 addresses include konamo[.]xyz, raedom[.]store, kida.plusdocs.kro[.]kr, and others, spanning hosting providers in South Korea, the U.S., Japan, and beyond.

The threat group also utilizes cloud storage services (e.g., Google Drive, Proton Drive) for payload delivery and decoy content.

Linguistic analysis of phishing lures and web interfaces further supports attribution to North Korea, with the use of distinctive vocabulary and IT terminology consistent with North Korean dialects.

Additionally, the campaign’s technical indicators such as repeated use of the string “7539518426” for obfuscation, and the deployment of RATs like QuasarRAT align with known Kimsuky TTPs, particularly those observed in the ongoing “BabyShark” campaign.

The ClickFix tactic underscores the necessity of robust endpoint detection and response (EDR) solutions capable of behavioral analysis and real-time threat visibility.

Unlike traditional malware, ClickFix relies on user execution, making it less susceptible to conventional signature-based defenses.

EDR platforms, such as Genian EDR, can track process chains initiated by PowerShell, identify abnormal behaviors, and provide actionable intelligence for SOC teams.

Security awareness training remains crucial, as the attack hinges on social engineering. Users should be wary of unsolicited instructions to execute scripts or commands, especially those requiring administrative privileges.

Organizations are encouraged to update firewall blocklists with the latest IoCs and leverage threat intelligence to pivot and correlate related activity.

Indicators of Compromise (IoC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant updates