Unveiling the New ClickFix Attacks: A Threat to Northeast India and Beyond

The Evolution of ClickFix Attacks

In the ever-evolving landscape of cyber threats, a new malicious campaign has emerged, blending the ClickFix method with fake CAPTCHA and a signed Microsoft Application Virtualization (App-V) script to ultimately deliver the Amatera infostealing malware. This sophisticated attack targets Windows systems, posing a potential risk to users in Northeast India and across the nation.

Leveraging Trusted Components for Malicious Activity

The Microsoft App-V script, a legitimate enterprise Windows feature, is manipulated in this campaign to act as a living-off-the-land binary. It proxies the execution of PowerShell through a trusted Microsoft component, disguising the malicious activity.

The Infection Chain: A Step-by-Step Analysis

The Initial Stage: Fake CAPTCHA and Manual Command Execution

The attack commences with a fake CAPTCHA human verification check, instructing the victim to manually paste and execute a command via the Windows Run dialog. The pasted command abuses the SyncAppvPublishingServer.vbs App-V script to execute PowerShell.

Later Stages: Steganography and Data Extraction

In later stages, a 32-bit hidden PowerShell process is spawned, and multiple embedded payloads are decrypted and loaded into memory. The infection chain then shifts to hiding payloads using steganography, where encrypted PowerShell payloads are embedded in PNG images and retrieved dynamically.

Final Stage: Amatera Infostealer Activation

The final PowerShell stage decrypts and launches native shellcode, which maps and executes the Amatera infostealer. Once active, the malware connects to a hardcoded IP address to receive additional binary payloads.

Implications for Northeast India and the Wider Indian Context

The Northeast region, with its growing digital footprint, is not immune to such threats. The Amatera malware, once activated, can collect browser data and credentials from infected systems, potentially leading to sensitive information being compromised.

Defending Against ClickFix Attacks

To protect against these attacks, security experts propose restricting access to the Windows Run dialog, removing App-V components when not needed, enabling PowerShell logging, and monitoring outbound connections for mismatches between the HTTP Host header or TLS SNI and the destination IP.

Looking Forward: Staying Ahead of the Threat

As cyber threats continue to evolve, it is crucial for individuals and organizations to stay vigilant and adapt their security measures accordingly. By understanding the tactics used in these attacks, we can better prepare ourselves to defend against them.