While currently limited to experimental usage by these state-sponsored groups, the increasing popularity of ClickFix in both cybercrime and espionage campaigns suggests the technique will likely become more widely adopted as threat actors continue to refine their social engineering approaches. Security researchers have identified a concerning trend in the cyber threat landscape as state-sponsored hackers from multiple countries have begun adopting a relatively new social engineering technique called “ClickFix” in their espionage operations. Proofpoint researchers noted that over a relatively short three-month period from late 2024 through early 2025, state-sponsored threat actors from North Korea, Iran, and Russia all incorporated the ClickFix technique into their routine espionage campaigns. The migration of ClickFix from cybercriminal to state-sponsored usage represents a notable shift in the threat landscape, as it effectively replaces traditional installation and execution stages in existing infection chains with a method that leverages human interaction to bypass security measures. The technique, which emerged in early March 2024 in cybercriminal circles, has rapidly gained popularity among advanced persistent threat (APT) groups due to its effectiveness in bypassing traditional security controls. Similar techniques were observed in campaigns by Iranian group TA450 (also known as MuddyWater) and Russian threat actors, each adapting ClickFix to their existing tactics and infrastructure. Despite its growing popularity, researchers observed that most groups experimented with the technique in limited campaigns before returning to their standard operational tactics. ClickFix represents a creative social engineering approach that employs dialogue boxes with instructions to trick victims into copying, pasting, and running malicious commands on their machines. One particularly sophisticated application was observed in campaigns associated with TA427, a threat actor linked to North Korea (also known as Kimsuky or Emerald Sleet).
This Cyber News was published on cybersecuritynews.com. Publication date: Sat, 19 Apr 2025 14:25:13 +0000