Microsoft has warned customers that risk actors are leveraging a brand new variant of the ClickFix method to ship malware.
The ClickFix assault technique has been more and more used up to now 12 months by each cybercriminals and state-sponsored risk teams.
The assault includes attackers displaying a pretend error message on a compromised or malicious web site. The message instructs the goal to handle the problem by urgent particular keys, then performing further steps (eg, operating a command). By following the attacker’s directions, the consumer unknowingly grants elevated permissions, downloads malware, or executes attacker-supplied scripts.
In a latest ClickFix assault noticed by Microsoft the attacker requested targets to run a command that executes a customized DNS lookoup.
“The preliminary command runs by cmd.exe and performs a DNS lookup towards a hard-coded exterior DNS server, somewhat than the system’s default resolver. The output is filtered to extract the ‘Title:’ DNS response, which is executed because the second-stage payload,” Microsoft defined.
This tactic allows the attacker to achieve their infrastructure and validate execution of the second-stage payload, rising their probabilities of evading detection by mixing malicious site visitors into common community site visitors.
The second-stage payload downloads and executes a malicious Python script designed for reconnaissance. The ultimate payload is then dropped and a persistence mechanism is deployed.
The ultimate payload is a distant entry trojan named ModeloRAT, which allows attackers to gather details about the compromised system and execute different payloads.
Whereas Microsoft has not shared any info on the assaults, Huntress reported just lately {that a} risk actor tracked as KongTuke had been deploying ModeloRAT by a ClickFix variant dubbed CrashFix. The marketing campaign was geared toward company environments.
Associated: Over 300 Malicious Chrome Extensions Caught Leaking or Stealing Person Knowledge
Associated: RATs within the Machine: Inside a Pakistan-Linked Three-Pronged Cyber Assault on India
Associated: New ‘ZeroDayRAT’ Adware Equipment Allows Whole Compromise of iOS, Android Gadgets
