![Kb4Threatlabs's tweet photo. PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"
KnowBe4 Threat Labs is tracking a sophisticated phishing campaign that flips the script on traditional email security. What looks like a routine, urgency-driven OneDrive lure is actually a gateway to an entire multi-purpose hosting setup packed with credential harvesters, droppers, and spyware.
Here is exactly how the threat actors are evolving the notorious ClickFix technique to bypass modern endpoint security:
The Attack Flow Breakdown
The Lure: Targets receive an email with the subject or body claiming an urgent past-due document needs tracking: "We have an urgent past due, please review secure OneDrive attachment and let's rectify today." The email carries a malicious attachment named Review Past Due Doc. zip.
The Trigger: Inside the ZIP is a .lnk shortcut. Clicking it doesn't download a file instead, it redirects the victim to a landing page that silently injects a malicious PowerShell command directly into their clipboard.
The Social Engineering (ClickFix): A fake verification prompt tricks the user into manually pressing Win + R, pasting the command, and hitting enter. Because the victim manually interacts with the terminal, traditional attachment scanning and URL filters see nothing out of the ordinary.
DNS TXT Staging: The injected clipboard stager fetches its payload instructions using DNS TXT records. The actual payload instructions never touch HTTP requests or email headers they only exist in the DNS response at execution time.
The Attacker's Infrastructure & Payload Arsenal
Pivoting to the operator's parent domain revealed a massive hosting setup designed for large-scale operations
ZIP Archives: Obfuscated .js and .vbs scripts acting as initial droppers.
MSI Files: Masquerading as legitimate software installers (some even abusing names like ConnectWise) to drop password stealers and Remote Monitoring and Management (RMM) tools.
ISO Images: Bundled spyware that leverages background processes to maintain persistent access.
This campaign proves that threat actors are moving far beyond simple credential theft. They are playing the long game using victim-assisted execution and network-level evasion to establish full, post-compromise control over environments.
Indicators of Compromise (IOCs)
Domains:
document-auth[.]icu
italy-news[.]info
lootrioya[.]info
Key Hashes:
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef (Review Past Due Doc. zip)
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30 (RMM / MSI Installer)
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8 (Password Stealer)
#ThreatIntel #Phishing #Cybersecurity #ClickFix #InfoSec #KnowBe4 #M365 #OAuth](https://pbs.twimg.com/media/HLbEXtMaUAEdAml.jpg)
![Kb4Threatlabs's tweet photo. PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"
KnowBe4 Threat Labs is tracking a sophisticated phishing campaign that flips the script on traditional email security. What looks like a routine, urgency-driven OneDrive lure is actually a gateway to an entire multi-purpose hosting setup packed with credential harvesters, droppers, and spyware.
Here is exactly how the threat actors are evolving the notorious ClickFix technique to bypass modern endpoint security:
The Attack Flow Breakdown
The Lure: Targets receive an email with the subject or body claiming an urgent past-due document needs tracking: "We have an urgent past due, please review secure OneDrive attachment and let's rectify today." The email carries a malicious attachment named Review Past Due Doc. zip.
The Trigger: Inside the ZIP is a .lnk shortcut. Clicking it doesn't download a file instead, it redirects the victim to a landing page that silently injects a malicious PowerShell command directly into their clipboard.
The Social Engineering (ClickFix): A fake verification prompt tricks the user into manually pressing Win + R, pasting the command, and hitting enter. Because the victim manually interacts with the terminal, traditional attachment scanning and URL filters see nothing out of the ordinary.
DNS TXT Staging: The injected clipboard stager fetches its payload instructions using DNS TXT records. The actual payload instructions never touch HTTP requests or email headers they only exist in the DNS response at execution time.
The Attacker's Infrastructure & Payload Arsenal
Pivoting to the operator's parent domain revealed a massive hosting setup designed for large-scale operations
ZIP Archives: Obfuscated .js and .vbs scripts acting as initial droppers.
MSI Files: Masquerading as legitimate software installers (some even abusing names like ConnectWise) to drop password stealers and Remote Monitoring and Management (RMM) tools.
ISO Images: Bundled spyware that leverages background processes to maintain persistent access.
This campaign proves that threat actors are moving far beyond simple credential theft. They are playing the long game using victim-assisted execution and network-level evasion to establish full, post-compromise control over environments.
Indicators of Compromise (IOCs)
Domains:
document-auth[.]icu
italy-news[.]info
lootrioya[.]info
Key Hashes:
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef (Review Past Due Doc. zip)
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30 (RMM / MSI Installer)
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8 (Password Stealer)
#ThreatIntel #Phishing #Cybersecurity #ClickFix #InfoSec #KnowBe4 #M365 #OAuth](https://pbs.twimg.com/media/HLbEWoEb0AAExWP.jpg)
![Kb4Threatlabs's tweet photo. PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"
KnowBe4 Threat Labs is tracking a sophisticated phishing campaign that flips the script on traditional email security. What looks like a routine, urgency-driven OneDrive lure is actually a gateway to an entire multi-purpose hosting setup packed with credential harvesters, droppers, and spyware.
Here is exactly how the threat actors are evolving the notorious ClickFix technique to bypass modern endpoint security:
The Attack Flow Breakdown
The Lure: Targets receive an email with the subject or body claiming an urgent past-due document needs tracking: "We have an urgent past due, please review secure OneDrive attachment and let's rectify today." The email carries a malicious attachment named Review Past Due Doc. zip.
The Trigger: Inside the ZIP is a .lnk shortcut. Clicking it doesn't download a file instead, it redirects the victim to a landing page that silently injects a malicious PowerShell command directly into their clipboard.
The Social Engineering (ClickFix): A fake verification prompt tricks the user into manually pressing Win + R, pasting the command, and hitting enter. Because the victim manually interacts with the terminal, traditional attachment scanning and URL filters see nothing out of the ordinary.
DNS TXT Staging: The injected clipboard stager fetches its payload instructions using DNS TXT records. The actual payload instructions never touch HTTP requests or email headers they only exist in the DNS response at execution time.
The Attacker's Infrastructure & Payload Arsenal
Pivoting to the operator's parent domain revealed a massive hosting setup designed for large-scale operations
ZIP Archives: Obfuscated .js and .vbs scripts acting as initial droppers.
MSI Files: Masquerading as legitimate software installers (some even abusing names like ConnectWise) to drop password stealers and Remote Monitoring and Management (RMM) tools.
ISO Images: Bundled spyware that leverages background processes to maintain persistent access.
This campaign proves that threat actors are moving far beyond simple credential theft. They are playing the long game using victim-assisted execution and network-level evasion to establish full, post-compromise control over environments.
Indicators of Compromise (IOCs)
Domains:
document-auth[.]icu
italy-news[.]info
lootrioya[.]info
Key Hashes:
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef (Review Past Due Doc. zip)
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30 (RMM / MSI Installer)
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8 (Password Stealer)
#ThreatIntel #Phishing #Cybersecurity #ClickFix #InfoSec #KnowBe4 #M365 #OAuth](https://pbs.twimg.com/media/HLbEVgraAAECMuH.png)
Olivia
Online
waysa
@waysa10
why are you so angry?
Joined June 2019
1.7K Following
86 Followers
389 Posts
I have been seeing reverse engineering / malware analysis courses that cost thousands of dollars. Do you know you can actually learn that for free, right? There are also a bunch of other courses out there that are way cheaper or even free:
- https://t.co/x0CWhENuTj
- https://t.co/dAUX2IulA9
- https://t.co/XD7BMbQbQB
- https://t.co/HyAEehO3F9
- https://t.co/NffYBgFmWD
- https://t.co/pJUPZCLVWz
- https://t.co/DldwPTTz6N
- https://t.co/RdKdLqZp8H
https://t.co/qBnJ7YpxsA
PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"
KnowBe4 Threat Labs is tracking a sophisticated phishing campaign that flips the script on traditional email security. What looks like a routine, urgency-driven OneDrive lure is actually a gateway to an entire multi-purpose hosting setup packed with credential harvesters, droppers, and spyware.
Here is exactly how the threat actors are evolving the notorious ClickFix technique to bypass modern endpoint security:
The Attack Flow Breakdown
The Lure: Targets receive an email with the subject or body claiming an urgent past-due document needs tracking: "We have an urgent past due, please review secure OneDrive attachment and let's rectify today." The email carries a malicious attachment named Review Past Due Doc. zip.
The Trigger: Inside the ZIP is a .lnk shortcut. Clicking it doesn't download a file instead, it redirects the victim to a landing page that silently injects a malicious PowerShell command directly into their clipboard.
The Social Engineering (ClickFix): A fake verification prompt tricks the user into manually pressing Win + R, pasting the command, and hitting enter. Because the victim manually interacts with the terminal, traditional attachment scanning and URL filters see nothing out of the ordinary.
DNS TXT Staging: The injected clipboard stager fetches its payload instructions using DNS TXT records. The actual payload instructions never touch HTTP requests or email headers they only exist in the DNS response at execution time.
The Attacker's Infrastructure & Payload Arsenal
Pivoting to the operator's parent domain revealed a massive hosting setup designed for large-scale operations
ZIP Archives: Obfuscated .js and .vbs scripts acting as initial droppers.
MSI Files: Masquerading as legitimate software installers (some even abusing names like ConnectWise) to drop password stealers and Remote Monitoring and Management (RMM) tools.
ISO Images: Bundled spyware that leverages background processes to maintain persistent access.
This campaign proves that threat actors are moving far beyond simple credential theft. They are playing the long game using victim-assisted execution and network-level evasion to establish full, post-compromise control over environments.
Indicators of Compromise (IOCs)
Domains:
document-auth[.]icu
italy-news[.]info
lootrioya[.]info
Key Hashes:
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef (Review Past Due Doc. zip)
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30 (RMM / MSI Installer)
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8 (Password Stealer)
#ThreatIntel #Phishing #Cybersecurity #ClickFix #InfoSec #KnowBe4 #M365 #OAuth
![Kb4Threatlabs's tweet photo. PHISH ALERT: From a Simple Phishing Email to a Full Attack Arsenal: The Evolution of "ClickFix"
KnowBe4 Threat Labs is tracking a sophisticated phishing campaign that flips the script on traditional email security. What looks like a routine, urgency-driven OneDrive lure is actually a gateway to an entire multi-purpose hosting setup packed with credential harvesters, droppers, and spyware.
Here is exactly how the threat actors are evolving the notorious ClickFix technique to bypass modern endpoint security:
The Attack Flow Breakdown
The Lure: Targets receive an email with the subject or body claiming an urgent past-due document needs tracking: "We have an urgent past due, please review secure OneDrive attachment and let's rectify today." The email carries a malicious attachment named Review Past Due Doc. zip.
The Trigger: Inside the ZIP is a .lnk shortcut. Clicking it doesn't download a file instead, it redirects the victim to a landing page that silently injects a malicious PowerShell command directly into their clipboard.
The Social Engineering (ClickFix): A fake verification prompt tricks the user into manually pressing Win + R, pasting the command, and hitting enter. Because the victim manually interacts with the terminal, traditional attachment scanning and URL filters see nothing out of the ordinary.
DNS TXT Staging: The injected clipboard stager fetches its payload instructions using DNS TXT records. The actual payload instructions never touch HTTP requests or email headers they only exist in the DNS response at execution time.
The Attacker's Infrastructure & Payload Arsenal
Pivoting to the operator's parent domain revealed a massive hosting setup designed for large-scale operations
ZIP Archives: Obfuscated .js and .vbs scripts acting as initial droppers.
MSI Files: Masquerading as legitimate software installers (some even abusing names like ConnectWise) to drop password stealers and Remote Monitoring and Management (RMM) tools.
ISO Images: Bundled spyware that leverages background processes to maintain persistent access.
This campaign proves that threat actors are moving far beyond simple credential theft. They are playing the long game using victim-assisted execution and network-level evasion to establish full, post-compromise control over environments.
Indicators of Compromise (IOCs)
Domains:
document-auth[.]icu
italy-news[.]info
lootrioya[.]info
Key Hashes:
7b7981c99d59595fe15377df84695bb72ce0b85560a3935f930657b2d162e5ef (Review Past Due Doc. zip)
adcd15f3d6b87f84d106ea426fa824fd20c9d64f6d199ce92580884290785f30 (RMM / MSI Installer)
d7d2f0ee187549f3f4a114d716be12521fbf62d6d26e2ac23d2a32d521d08fd8 (Password Stealer)
#ThreatIntel #Phishing #Cybersecurity #ClickFix #InfoSec #KnowBe4 #M365 #OAuth](https://pbs.twimg.com/media/HLbEYmWbkAA2Y6f.jpg)
Who to follow
Cyber Advising
@cyber_advising
Cyber Security Consulting | Ethical Hacking & Exploit Research
Intel 471
@Intel471Inc
Your Voice of Reason and Truth
Eric Capuano - Bsky: @eric.zip
@eric_capuano
Co-Founder @recon_infosec | SANS DFIR Instructor | IANS Faculty | https://t.co/yUXCSu2Yso | ⬡ ❤ @shortxstack
Threat Actors are "Bringing Their Own Forensics"
In a recent ClickFix campaign, we saw threat actors likely related to Interlock Ransomware, running Volatility (https://t.co/Vq0vkvWutb) directly on victim machines.
Commonly a tool for defenders, the TAs are using it to:
Unit 42/DFIR ReportのDFIRプロ、Renzon (@r3nzsec) が(Intel/ARM) MacネイティブのCSVタイムライン分析ツール IRFlow Timeline をリリース！🎉🥳
CSVだけでなくTSV/XLSX/EVTX/Plasoにも対応。イメージは“Timeline ExplorerのMac版”だけど、アナライザーも豊富で圧倒的に優秀！💪
ずっと欲しかったツール…嬉しい…🥹🙏 #DFIR
🔗 https://t.co/iczzGaD7NV
🔗 https://t.co/RuZE1m5KMe
追伸：TEは約1GBまでだけど、IRFlow Timelineは約20GBまでインポート可能（それを超えるとクラッシュするので、その場合はTimesketch等のSIEMに…）
Threat-Actor-As-A-Prompt
I am no responsible for any suspensions or harm.
Good Luck.
https://t.co/Xvc8FbSKIt
.@trailofbits released our first batch of Claude Skills. Official announcement coming later.
https://t.co/vI4amorZrc
Hunting for EDR-Freeze https://t.co/LUblpLCgmW
The ClickFix Triage query has gotten an update with the recently used parameters from the ClickFix hunter project. If you haven't tried the query yet, give it a try in any ClickFix case, it collects the data you need to triage the incident in seconds.
https://t.co/4Gd5wNxPwq
@DanielMiessler https://t.co/lRhHvr8sls
This React2Shell exploit is being exploited in the wild by 🇨🇳, hop on it folks! 🔥
Bunch of links for you to get started on:
1. https://t.co/807ywVG88l
2. https://t.co/xXYWdikPc5
3. https://t.co/04vaF35GUe
4. https://t.co/Pi2sfhwKgj
5. https://t.co/aoNZhyaC9K
Microsoft Copilot AI going through my file system and finding 11TB of malware
Cloudflare went down because a ClickHouse change made a metadata query return duplicate columns. That blew up the size of a config file, it spread across the network and one module couldn’t handle the larger file and crashed. Everything after that was basically fallout from this chain reaction 😅
https://t.co/R4IPMw05ig
An idea I had some time ago was to create an open-source project with community contributions to centralize different social engineering lure techniques & native GUI tools that could be leveraged for ClickFix... a LOLBins-style site w/ mitigations. Video: https://t.co/uAFMm2qkXn
Cisco ASA/FP - Be on the lookout for calls to these URLs 👇
GET /+CSCOU+/MacTunnelStart.jar
GET /+CSCOL+/csvrloader64.cab
GET /+CSCOL+/csvrloader.jar
- Contain the Cisco SSL VPN Relay Loader
- Likely used for version fingerprinting
(CVE-2025-20333 / CVE-2025-20362)
@IceSolst And, these two:
https://t.co/ZhUAFqrNtA
https://t.co/YFw0eHdp5Q
@IceSolst And, this doesn't hurt either to have in the Bookmarks:
https://t.co/8SZmxDiZGM
Last Seen Users on Sotwe
caramelmachiato
Seen from United States
PasukanPemburuMemek
Seen from Indonesia
seisblu
Seen from United States
Edikusnadi
Seen from Indonesia
Exkung
Seen from Vietnam
Baú dos brothers 🔞
Seen from United States
esinden gizli
Seen from Turkey
แม่เสือใหญ่ แม่เสือสาว ทักเล่นๆ อย่าทักมา
Seen from Thailand
Gay Teen
Seen from United States
Nứng
Seen from Vietnam
Most Popular Users
Elon Musk 
@elonmusk
240.9M followers
Barack Obama
@barackobama
119.2M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Cristiano Ronaldo
@cristiano
111.4M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.9M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.1M followers
KATY PERRY
@katyperry
88.1M followers
Taylor Swift
@taylorswift13
82M followers
Lady Gaga
@ladygaga
73.5M followers
Virat Kohli
@imvkohli
70.6M followers
Kim Kardashian
@kimkardashian
70M followers
YouTube
@youtube
68.7M followers
Bill Gates
@billgates
64.1M followers
Neymar Jr
@neymarjr
63.4M followers
The Ellen Show
@theellenshow
62.4M followers
CNN
@cnn
61.9M followers
Selena Gomez
@selenagomez
61.2M followers
X
@x
60.8M followers