Mostly AFK

[Mostly AFK @ExpectedErr0r]

@IAMERICAbooted I see! I have trust issues with some of its work especially in detailed malware analysis or pivoting infrastructure and right now im doing it to track its path and steps, im not sure if this is the right way

[Mostly AFK @ExpectedErr0r]

@IAMERICAbooted TY for this! I will read and try to apply these!!

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Threat Intelligence has identified a cluster of compromised websites leading to ClickFix attacks. Instead of downloading and executing remote payloads like the typical attack pattern, in this attack, the websites pre-fetch a script payload into the browser cache disguised as a PNG file.

When a user is later tricked into executing the malicious command, the cached website content is already on the device, loaded, and ready to be executed. This helps to hide the payload script and helps bypass the character limit of the Run dialog.

ClickFix attacks persuade users to execute attacker-supplied commands under the guise of verification or repair. In this specific campaign, a fake lure instructs users to open Windows Run, paste clipboard content and press Enter.

The injected page uses browser caching to stage the larger VBScript payload separately from the Run command. The command invokes cmd.exe to recursively enumerate files whose names start with "f_” in the browser’s profile folder such as %LOCALAPPDATA%\Mozilla\Firefox\Profiles.

It compares each file’s byte length with an expected value. Rather than searching for a marker within the contents like previous attacks, it copies a size-matching cache entry to %LOCALAPPDATA%\Temp\t.vbs, giving the cached payload a VBScript extension, then executes it with wscript.exe. Copy output and errors are suppressed. The expected size varies across variants.

The VBScript collects host information through WMI, retrieves v.ps1 from cocojambo[.]us[.]com/alfa, and launches PowerShell without a profile and with execution-policy bypass. A later PowerShell stage downloads the next-stage payload as cab.dat, then reads and executes its contents in a hidden window. The PowerShell stage triggers .NET compilation using csc.exe and cvtres.exe, then launches timeout.exe.

Subsequent payloads load .NET assemblies into memory and inject code into timeout.exe to target browser and device credentials. The injected process launches PowerShell to retrieve another in-memory stage from capsysnet[.]vg and makes outbound connections to ciliabula[.]cc.

The payload modifies the per-user PowerShell registry configuration to use the Bypass execution policy, then unpacks Python with tar.exe and creates a scheduled task that launches a Python payload through pythonw.exe for persistence.

Microsoft Defender provides layered protection across the ClickFix attack chain. Defender SmartScreen and Defender for Office 365 help block malicious sites, links, attachments, and fake CAPTCHA lures, while Defender for Endpoint detects suspicious command execution and outbound connections through alerts like “Possible ClickFix activity”. Defender Antivirus blocks malicious command execution as Trojan:Win32/ClickFix and Trojan:Win32/TermFix.

Microsoft recommends cloud-delivered, web, and network protection, application control, and PowerShell script-block logging. Hunt across browser activity, RunMRU registry key, WScript/PowerShell child processes and scheduled tasks, not download events alone. A CAPTCHA should not ask users to run code. Users shouln not paste commands from verification prompts into Run, Terminal or PowerShell and should treats such requests as potential initial access attempts.

[Mostly AFK @ExpectedErr0r]

@Gootloader @MsftSecIntel And regardless of run dialog i think one of the important elements is the hidden clipboard copy that happens to the victim. Tried to solve this via clipboard formatting:

https://t.co/AbBZpbif3B

[Mostly AFK @ExpectedErr0r]

ClickFix attacks abuse the clipboard — the webpage data included differs when JavaScript writes to it vs a user copying text.

ClipGuard is a Windows tray app that detects JS-injected payloads being pasted into execution surfaces.

https://t.co/YD0lRc5baA

[Mostly AFK @ExpectedErr0r]

@SquiblydooBlog @malwrhunterteam Ty for sharing just curious , do you not run into cyber blocks while working through this

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Defender Experts observed phishing campaigns targeting organizations across multiple industries that distributed legitimate RMM software via meeting invitations, PDF-themed lures, software update prompts, and other social engineering content. https://t.co/9T8duLQgx0

After execution, the software established a remote management foothold and was used to deploy a second remote access platform, creating redundant access channels that supported persistent access and follow-on activity, including information collection and credential access operations.

The activity highlights how threat actors continue to abuse legitimate administration tools to blend into normal IT operations while maintaining access and reducing detection opportunities. Read the full analysis for additional findings and guidance.

[Mostly AFK @ExpectedErr0r]

cosmosdatagrid[.]lol -> clickfix making the victim type cmd in run dialog, likely to evade RUNMRU based detections

leads to some stealer : vo4xuGy1768v27Jc-9Zyj8f4wKa0isL8r.exe

some kind of panel on 94.26.83[.]69

@skocherhan @malwrhunterteam

[Mostly AFK @ExpectedErr0r]

@threepointone This hits so close to home. Thank you for sharing this. Hope to apply some of these in my work. The spiral is so real and am really struggling to get out of it

[abuse.ch @abuse_ch]

🚨 ANNOUNCEMENT FOR TOP CONTRIBUTORS! 🚨

We’ve been working on something huge and the cat 🐈 is finally out of the bag 👀 ... https://t.co/x0TWKNn9PP and Spamhaus have officially partnered with Modat (@modat_magnify) to give FREE Magnify licenses to our top contributors! 🎉🔥

You give your time, brainpower, and expertise to this community 👏. You hunt down the bad guys every single day - we want to make sure you have the best tools 🛠️ to do what you do for the good of the internet every single day!

Consider this our way of saying THANK YOU�� 🙏 🙏

Top contributors - keep an eye out, we'll be reaching out in the coming weeks to get your access sorted.

More details in comments 👇

[Mostly AFK @ExpectedErr0r]

@abuse_ch @rifteyy this context also makes sense! ty

[Mostly AFK @ExpectedErr0r]

@abuse_ch @rifteyy hi there, I can also think of JAMESWT_WT who has been a really important contributor to the community. it would be great if you could review!

[George Pickett @georgepickett]

Once you get Astra access run this prompt against your codebase (or just a part of it). It's magic.

"Think from first principles about what we're trying to achieve here. Interrogate what you built before calling it done:

1. is anything here unnecessary, overly complicated, or based on weak assumptions? Challenge them.
2. What can be deleted entirely?
3. What can be simplified now that unnecessary pieces are gone?

Then make the changes. Prefer deleting over simplifying, simplifying over optimizing, and optimizing over automating.

It might be done too - you dont HAVE to go and make changes. if its good, leave it alone"

[Squiblydoo @SquiblydooBlog]

The code-signing certificate for "OpsBridge LLC" is revoked.
We continue to see new brands of RMM tools pop up and drop ScreenConnect immediately.

We (CertGraveyard) didn't report the cert, but other's aren't putting up with this either.

Others reported that OpsBridge was all kinds of suspicious: registered with throw-away email accounts, sold via Telegram, etc.

https://t.co/MkpOZxwcqh

Thanks for those reviewing, writing, tweeting, about this type of stuff. @ExpectedErr0r @0xBurgers @devmihaylov. Your work is seen and appreciated.

[Mostly AFK @ExpectedErr0r]

@0xBurgers @skocherhan @patialavii Very interesting so i guess this is a good pivot for expansion

[Mostly AFK @ExpectedErr0r]

Since the last week there is a volume of suspicious phishing E-mails delivering a MSI file linked to "OpsBridge LLC" which is subsequently dropping ScreenConnect. can't seem to find anything on this specific about this being a legitimate LLC.

@skocherhan @patialavii

[Mostly AFK @ExpectedErr0r]

@0xBurgers @skocherhan @patialavii smithmaximum06[@]https://t.co/GNBpYuepl5 -> not sure how concrete this is. has other bunch of suspicious domains as well

[Mostly AFK @ExpectedErr0r]

@0xBurgers @skocherhan @patialavii this is really cool. ty for sharing. not sure how linked this is : https://t.co/wjDkKyZdsW

[Mostly AFK @ExpectedErr0r]

@skocherhan @patialavii It's being delivered from compromised wordpress websites( in some cases)