Recent cybersecurity research reveals that ClickFix attacks have grown more sophisticated. Instead of simply prompting users to download malware, attackers are now embedding executable payloads inside PNG images, leveraging false verification prompts, and infiltrating Windows domain controllers to steal credentials and move freely within corporate networks.
New Techniques: Hidden Executables & Cloudflare Impersonation
In one notable case, attackers used a web page to get users to copy and run a PowerShell command. The terminal displays a faux Cloudflare verification while fetching an archive. Inside are a Microsoft-signed executable, a malicious DLL, and a batch script. The script then extracts PNG images that have full executables encoded in their pixels, reconstructs them onto disk, and executes them. Persistent access was secured through scheduled tasks and Run registry entries.
Domain Controller Hijacks and Lateral Movement
Another attack in September used DLL sideloading and Windows administrative tools to breach a primary domain controller. After establishing persistence, the attackers gathered details on domain trusts, administrator privileges, and account information. They used WinRM for movement across the network, installed new accounts, and set up a reverse SSH tunnel. Earlier incidents have similarly delivered malware like Matanbuchus 3.0 and AstarionRAT, eventually gaining domain controller access.
Back in May, a ClickFix campaign deployed malware via MSI installations and administrative shares—affecting 11 machines before containment. Each attack chain shares a theme: coaxing victims into copying terminal commands, hiding payloads in deceptive forms, and expanding reach once inside.
Browser Tricks & Strategic Defense Steps
Some attacks target browsers like Chrome, Firefox, or Brave by placing files in browser cache. Commands then search for files of specific sizes—like a 17,635-byte marker—copy them to temp storage, and execute them as batch scripts. In one case, a remote access Trojan (RAT) disguised as legitimate software was dropped using Node.js malware called DuskDesk. This campaign also created run-keys and used logon persistence, making cleanup harder.
Experts urge organizations to train users not to run terminal instructions from websites, limit execution rights for untrusted scripts, and closely monitor PowerShell usage, new persistence artifacts, and unexpected SSH activity. Defenders are encouraged to look for patterns—such as encoded binaries hidden in images or odd scripting behavior—rather than relying only on traditional indicators like file names or static hashes.
Indicators of compromise include a wide range of malware-staging artifacts: typosquatted redirectors, fake verification landing pages, archives like cf_verify.zip, payload staging directories under C:\ProgramData, DLLs masquerading as Microsoft components (e.g. CertEnroll.dll), malicious scripts for creating reverse tunnels, and identifiable persistence keys and scheduled tasks.
ClickFix attacks began earlier this year as simple lure tactics—basic prompts tricked users into running malware. Now, these campaigns have evolved into multi-stage operations that combine social engineering with technical deception to evade detection. The stakes are higher: once inside the domain controller, attackers can wreak havoc on entire networks.
What this means: This evolution demonstrates that even familiar threats like credential-stealing and phishing are morphing fast. In this climate, defenders must proactively look for behavioral red flags across the enterprise. The next frontier will likely involve more stealthy payload delivery and refined social engineering—how well organizations tighten up execution context, user privileges, and script monitoring will determine their resilience.
