mastouille.fr est l'un des nombreux serveurs Mastodon indépendants que vous pouvez utiliser pour participer au fédiverse.
Mastouille est une instance Mastodon durable, ouverte, et hébergée en France.

Administré par :

Statistiques du serveur :

582
comptes actifs

#clickfix

1 message1 participant0 message aujourd’hui
Sekoia.io<p>🔥 Hot summer, sizzling crypto... and scammers turning up the heat 🔥</p><p>Back in March, Sekoia <a href="https://infosec.exchange/tags/TDR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TDR</span></a> team published a deep-dive report on a <a href="https://infosec.exchange/tags/Lazarus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Lazarus</span></a> cluster we dubbed <a href="https://infosec.exchange/tags/ClickFake" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFake</span></a> Interview, leveraging the <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> technique in their <a href="https://infosec.exchange/tags/ContagiousInterview" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ContagiousInterview</span></a> campaign.</p>
ESET Research<p><a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> went from virtually non-existent to the second most common attack vector blocked by <a href="https://infosec.exchange/tags/ESET" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ESET</span></a>, surpassed only by <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a>. This novel social engineering technique accounted for nearly 8% of all detections in H1 2025. <a href="https://infosec.exchange/tags/ESETresearch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ESETresearch</span></a><br>ClickFix lures users by displaying bogus error messages followed by quick fix instructions, including copy-pasting malicious code. Running the code in the victim’s command line interpreter delivers malware such as <a href="https://infosec.exchange/tags/RATs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>RATs</span></a>, infostealers, and cryptominers.<br>Between H2 2024 and H1 2025, ESET’s detection for ClickFix, HTML/FakeCaptcha, skyrocketed by 517%. Most detections in ESET telemetry were reported from Japan (23%), Peru (6%), and Poland, Spain, and Slovakia (&gt;5% each).<br>What makes <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> so effective? The fake error message looks convincing; instructions are simple, yet the copied command is too technical for most users to understand. Pasting it into cmd leads to compromise with final payloads, including <a href="https://infosec.exchange/tags/DarkGate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DarkGate</span></a> or <a href="https://infosec.exchange/tags/LummaStealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LummaStealer</span></a>. <br>While <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> was introduced by cybercriminals, it’s since been adopted by APT groups: Kimsuky, Lazarus; Callisto, Sednit; MuddyWater; APT36. NK-aligned actors used it to target developers, steal crypto and passwords from Metamask and <a href="https://infosec.exchange/tags/macOS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>macOS</span></a> Keychain. <br><a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> uses psychological manipulation by presenting fake issues and offering quick solutions, which makes it dangerously efficient. It appears in many forms – error popups, email attachments, fake reCAPTCHAs – highlighting the need for greater vigilance online.<br>Read more in the <a href="https://infosec.exchange/tags/ESETThreatReport" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ESETThreatReport</span></a>:<br>🔗 <a href="https://welivesecurity.com/en/eset-research/eset-threat-report-h1-2025" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">welivesecurity.com/en/eset-res</span><span class="invisible">earch/eset-threat-report-h1-2025</span></a></p>
Randy<p><span class="h-card" translate="no"><a href="https://abyssdomain.expert/@filippo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>filippo</span></a></span> the copy/paste technique is called <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> . the site in the image is infected by TA2726's Keitaro which is well known for sending Windows folks to <a href="https://infosec.exchange/tags/SocGholish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SocGholish</span></a> . what they do with macOS folks has changed over the years. i see they sent you to something that delivered what looks like Poseidon Stealer.</p><p><a href="https://medium.com/@MateoPappa/letsdefend-poseidon-macos-stealer-hard-a796c85d8c72" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">medium.com/@MateoPappa/letsdef</span><span class="invisible">end-poseidon-macos-stealer-hard-a796c85d8c72</span></a></p>
Brad<p>2025-07-15 (Tuesday): Tracking <a href="https://infosec.exchange/tags/SmartApeSG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmartApeSG</span></a> </p><p>The SmartApeSG script injected into page from compromised website leads to <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> style fake verification page. ClickFix-ing you way through this leads to a <a href="https://infosec.exchange/tags/NetSupportRAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NetSupportRAT</span></a> infection.</p><p>Compromised site (same as yesterday): </p><p>- medthermography[.]com</p><p>URLs for ClickFix style fake verification page:</p><p>- warpdrive[.]top/jjj/include.js<br>- warpdrive[.]top/jjj/index.php?W11WzmLj<br>- warpdrive[.]top/jjj/buffer.js?409a8bdbd9</p><p>Running the script for NetSupport RAT:</p><p>- sos-atlanta[.]com/lal.ps1<br>- sos-atlanta[.]com/lotu.zip?l=4773</p><p><a href="https://infosec.exchange/tags/NetSupport" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NetSupport</span></a> RAT server (same as yesterday):</p><p>- 185.163.45[.]87:443</p>
ℒӱḏɩę :blahaj: 💾<p>I finally stumbled upon a real <a href="https://tech.lgbt/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> attack in the wild. My favorite weather page presented the screen as shown. It doesn't take much tech knowledge to know these instructions are pure bullshit.</p><p>Now here's what's interesting. I reloaded the page, normal page came up. Cleared the cookies, normal page. Tried a different browser, normal page. So is it random? Should I alert the site owner?</p><p><a href="https://tech.lgbt/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://tech.lgbt/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a> <a href="https://tech.lgbt/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://tech.lgbt/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://tech.lgbt/tags/cloudflare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cloudflare</span></a></p>
ESET Research<p>ESET Threat Report H1 2025: <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> attacks surge 500%, SnakeStealer tops infostealer charts, and NFC fraud jumps 35x. Plus, chaos in the ransomware underworld and a new Android adware menace—Kaleidoscope. Dive into the full report: <a href="https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12025.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">web-assets.esetstatic.com/wls/</span><span class="invisible">en/papers/threat-reports/eset-threat-report-h12025.pdf</span></a> <a href="https://infosec.exchange/tags/ESETresearch" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ESETresearch</span></a></p>
The New Oil<p>New <a href="https://mastodon.thenewoil.org/tags/FileFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FileFix</span></a> attack weaponizes <a href="https://mastodon.thenewoil.org/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Windows</span></a> <a href="https://mastodon.thenewoil.org/tags/FileExplorer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FileExplorer</span></a> for stealthy commands</p><p><a href="https://www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.thenewoil.org/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a></p>
Brad<p>2025-06-18 (Wednesday): <a href="https://infosec.exchange/tags/SmartApeSG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SmartApeSG</span></a> --&gt; <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> lure --&gt; <a href="https://infosec.exchange/tags/NetSupportRAT" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>NetSupportRAT</span></a> --&gt; <a href="https://infosec.exchange/tags/StealCv2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>StealCv2</span></a></p><p>A <a href="https://infosec.exchange/tags/pcap" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pcap</span></a> of the traffic, the malware/artifacts, and some IOCs are available at <a href="https://www.malware-traffic-analysis.net/2025/06/18/index.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">malware-traffic-analysis.net/2</span><span class="invisible">025/06/18/index.html</span></a>.</p><p>Today's the 12th anniversary of my first blog post on malware-traffic-analysis.net, so I made this post a bit more old school.</p>
Graham Cluley<p>"We don’t just want payment; we want accountability." The malicious hackers behind the Interlock ransomware try to justify their attacks.</p><p>Learn more about what you need to know about Interlock in my article on the Tripwire blog.</p><p><a href="https://www.tripwire.com/state-of-security/interlock-ransomware-what-you-need-know" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">tripwire.com/state-of-security</span><span class="invisible">/interlock-ransomware-what-you-need-know</span></a></p><p><a href="https://mastodon.green/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.green/tags/ransomware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ransomware</span></a> <a href="https://mastodon.green/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>clickfix</span></a></p>
The New Oil<p><a href="https://mastodon.thenewoil.org/tags/TikTok" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TikTok</span></a> videos now push <a href="https://mastodon.thenewoil.org/tags/infostealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infostealer</span></a> <a href="https://mastodon.thenewoil.org/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> in <a href="https://mastodon.thenewoil.org/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> attacks</p><p><a href="https://www.bleepingcomputer.com/news/security/tiktok-videos-now-push-infostealer-malware-in-clickfix-attacks/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/tiktok-videos-now-push-infostealer-malware-in-clickfix-attacks/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a></p>
Threat Insight<p>State-sponsored threat actors often leverage techniques first developed and deployed by cybercriminal actors. One example is <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a>, a highly effective technique that involves clever <a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>socialengineering</span></a>.</p><p>Listen as Proofpoint threat research experts Selena Larson, Sarah Sabotka, and Saher Naumaan deep dive into how modern <a href="https://infosec.exchange/tags/espionage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>espionage</span></a> and <a href="https://infosec.exchange/tags/cybercrime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybercrime</span></a> are increasingly blurring lines.</p><p>Stream DISCARDED now:<br>Apple Podcasts: <a href="https://brnw.ch/21wSNbM" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">brnw.ch/21wSNbM</span><span class="invisible"></span></a><br>Spotify: <a href="https://brnw.ch/21wSNbL" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">brnw.ch/21wSNbL</span><span class="invisible"></span></a><br>Web player: <a href="https://brnw.ch/21wSNbN" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">brnw.ch/21wSNbN</span><span class="invisible"></span></a></p>
The New Oil<p>Hackers now testing <a href="https://mastodon.thenewoil.org/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> attacks against <a href="https://mastodon.thenewoil.org/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Linux</span></a> targets</p><p><a href="https://www.bleepingcomputer.com/news/security/hackers-now-testing-clickfix-attacks-against-linux-targets/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/hackers-now-testing-clickfix-attacks-against-linux-targets/</span></a></p><p><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://mastodon.thenewoil.org/tags/FOSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>FOSS</span></a></p>
Bob Carver<p>Macs under threat from thousands of hacked sites spreading malware — how to stay safe<br><a href="https://www.tomsguide.com/computing/online-security/macs-under-threat-from-thousands-of-hacked-sites-spreading-malware-how-to-stay-safe" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">tomsguide.com/computing/online</span><span class="invisible">-security/macs-under-threat-from-thousands-of-hacked-sites-spreading-malware-how-to-stay-safe</span></a><br><a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/Apple" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Apple</span></a> <a href="https://infosec.exchange/tags/Macs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Macs</span></a> <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/socialengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>socialengineering</span></a></p>
Taggart :donor:<p>FWIW, 100% of <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> attacks I've seen have added some kind of inline comment at the end of the command string like <code>I am not a robot</code> to sell the ruse. Definitely worth a threat hunt on command line history.</p><p><a href="https://infosec.exchange/tags/ThreatHunting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatHunting</span></a> <a href="https://infosec.exchange/tags/ThreatIntel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntel</span></a> <a href="https://infosec.exchange/tags/ThreatIntelligence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThreatIntelligence</span></a></p>
Brad<p>2025-04-22 (Tuesday): Always fun to find the fake CAPTCHA pages with the <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> style instructions trying to convince viewers to infect their computers with malware. </p><p>Saw <a href="https://infosec.exchange/tags/StealC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>StealC</span></a> from an infection today. </p><p>Indicators available at <a href="https://github.com/malware-traffic/indicators/blob/main/2025-04-22-IOCs-for-ClickFix-style-campaign-leading-to-StealC-infection.txt" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">github.com/malware-traffic/ind</span><span class="invisible">icators/blob/main/2025-04-22-IOCs-for-ClickFix-style-campaign-leading-to-StealC-infection.txt</span></a></p><p><a href="https://infosec.exchange/tags/ClipboardHijacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClipboardHijacking</span></a> <a href="https://infosec.exchange/tags/Pastejacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Pastejacking</span></a></p>
ANY.RUN<p>🚨 New <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> scam targets US users with fake MS Defender and CloudFlare pages.<br>⚠️ The scam page is hosted on a domain registered back in 2006, pretending to be the Indo-American Chamber of Commerce.<br>🎯 The <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a> page loads only for US-based victims, as observed during analysis with a residential IP in <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ANYRUN</span></a> Sandbox. </p><p>👨‍💻 Analysis session: <a href="https://app.any.run/browses/50395c46-41f5-4bb3-8205-61262ef4e63d/?utm_source=mastodon&amp;utm_medium=article&amp;utm_campaign=clickfix_scam&amp;utm_term=160425&amp;utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">app.any.run/browses/50395c46-4</span><span class="invisible">1f5-4bb3-8205-61262ef4e63d/?utm_source=mastodon&amp;utm_medium=article&amp;utm_campaign=clickfix_scam&amp;utm_term=160425&amp;utm_content=linktoservice</span></a></p><p>📍 URL: iaccindia[.]com<br>The page hijacks the full-screen mode and displays a fake “Windows Defender Security Center” popup. </p><p>🎭 It mimics the Windows UI, locks the screen, and displays urgent messages to panic the user. </p><p>Victims are prompted to call a fake tech support number (+1-…), setting the stage for further exploitation. </p><p>🎣 The phishing page may also display a fake CloudFlare message tricking users to execute a <a href="https://infosec.exchange/tags/malicious" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malicious</span></a> Run command. <br>Take a look: <a href="https://app.any.run/tasks/e83a5861-6006-4b1d-aba8-8536dcaa8057/?utm_source=mastodon&amp;utm_medium=article&amp;utm_campaign=clickfix_scam&amp;utm_term=160425&amp;utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">app.any.run/tasks/e83a5861-600</span><span class="invisible">6-4b1d-aba8-8536dcaa8057/?utm_source=mastodon&amp;utm_medium=article&amp;utm_campaign=clickfix_scam&amp;utm_term=160425&amp;utm_content=linktoservice</span></a></p><p><a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>IOCs</span></a>: <br>supermedicalhospital[.]com <br>adflowtube[.]com <br>knowhouze[.]com <br>ecomicrolab[.]com <br>javascripterhub[.]com <br>virtual[.]urban-orthodontics[.]com </p><p>Streamline threat analysis for your SOC with <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ANYRUN</span></a> 🚀 <br><a href="https://infosec.exchange/tags/ExploreWithANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ExploreWithANYRUN</span></a></p>
Sekoia.io<p>Since the apparition of the <a href="https://infosec.exchange/tags/Interlock" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Interlock</span></a> ransomware, the Sekoia <a href="https://infosec.exchange/tags/TDR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TDR</span></a> team observed its operators evolving, improving their toolset (<a href="https://infosec.exchange/tags/LummaStealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>LummaStealer</span></a> and <a href="https://infosec.exchange/tags/BerserkStealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>BerserkStealer</span></a>), and leveraging new techniques such as <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> to deploy the ransomware payload. </p><p><a href="https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.sekoia.io/interlock-ranso</span><span class="invisible">mware-evolving-under-the-radar/</span></a></p>
Sekoia.io<p>🇰🇵 Sekoia <a href="https://infosec.exchange/tags/TDR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>TDR</span></a> team investigated a malicious campaign that employs fake job interview websites to deliver backdoors on Windows and macOS - <a href="https://infosec.exchange/tags/GolangGhost" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>GolangGhost</span></a> using <a href="https://infosec.exchange/tags/ClickFix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFix</span></a> tactic. Dubbed <a href="https://infosec.exchange/tags/ClickFake" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ClickFake</span></a> Interview, this campaign has been attributed to <a href="https://infosec.exchange/tags/Lazarus" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Lazarus</span></a>, a <a href="https://infosec.exchange/tags/DPRK" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>DPRK</span></a> state-sponsored threat actor, which has been targeting the cryptocurrency industry since at least 2017. </p><p><a href="https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">blog.sekoia.io/clickfake-inter</span><span class="invisible">view-campaign-by-lazarus/</span></a></p>
B'ad Samurai 🐐<p><span class="h-card" translate="no"><a href="https://infosec.exchange/@jernej__s" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>jernej__s</span></a></span> so Win+X is a tricky one, because you can't remove it with the same registry path you would for Run. This is because Run is an Explorer shortcut and WinX is system shortcut. I'm not actually targeting WinX itself but the PowerShell shortcuts, so I'm fine with it's basic function.</p><p>I have seen some ClickFix, I assume to work around the Win+R mitigations, request the user launch PowerShell with Win+X.</p><p>To remove the 2 shortcuts, simply rename the .lnk to like .lnk.disabled and it will immediately take effect, removing the shortcuts seen in Win+X.</p><p>The files are in the user's folder, so I just deployed a script to do this for all profiles in <code>/users/</code></p><p><a href="https://infosec.exchange/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>clickfix</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>phishing</span></a></p>
B'ad Samurai 🐐<p>ClickFix and malware seem to prefer PowerShell aliases: <code>iwr</code> <code>iex</code> for obfuscation, so I thought why not simply disable and turn them into canaries.</p><p>Of course impact is highly org and user dependent, but since it's deployed per user+host profile, we can easily apply it to the primary, non-privileged or service identity.</p><p>And yes, still disable Win+R, Win+X, log and get control on EPs. If you're already hunting <code>iwr</code>, you hopefully know where they run as current user.</p><p><a href="https://infosec.exchange/tags/powershell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>powershell</span></a> <a href="https://infosec.exchange/tags/clickfix" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>clickfix</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/automation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>automation</span></a></p>