Attackers are altering ClickFix tactics to hide payloads until after the victim has already performed the trusted action, as two recent examples showcase.
ClickFix has become a prominent social engineering technique in the past few years, due largely to how it exploits human problem solving tendencies as well as trust in software. A typical ClickFix attack presents victims with a fake technical problem or verification prompt, then instructs them to paste and execute a command that has often already been copied to their clipboard.
Sometimes the prompt is attached to a phony CAPTCHA puzzle, while other times the victim visits a fake Zoom call that requires an update to "fix" a supposed technical issue. In any case, it almost always involves pasting code into Windows Run, PowerShell, or the MacOS Terminal.
The examples of threat actors employing this technique continue to pile up, and new research from two vendors shows how it continues to evolve to better evade detection measures.