- Security researchers discovered a new clickfix campaign
- The goal is to implement Havoc Post-utilization framework
- The frame is hosting a Microsoft SharePoint account
Hackers have been watched abuse by Microsoft SharePoint to distribute Havoc Post-Exploitation Framework in a new clickfix phishing attack.
Cybersecurity scientists Fortiguard Labs, who have been tracking the campaign since last year, highlighted how Clickfix is a type of scam that we probably all have encountered at least once. Cyber criminals would hijack a site and create an overlay showing a false error message (for example: “Your browser is outdated and to see the contents of the web page you need to update it”). The false message will cause the victim to get actions that are usually completed by downloading and running malware or sharing sensitive information, such as passwords or banking data.
This campaign is the same, although it requires a little more activity from the victim. The attack chain starts with a phishing -e -mail that carries a “limited message” as a .html attachment. Running the attachment shows a false error saying “does not connect to OneDrive – Update DNS cache manually”. The site also has a “how to solve” button that copies a Powershell command to Windows Clipboard, and then shows a message on how to insert and run it.
Rising threat of clickfix
Driving this script then runs another that hosts The Attackers’ SharePoint Server, which in turn downloads a python script that releases Havoc Post-Explotehed Framework as a .dll file.
Havoc is a post-utility framework designed for advanced red teaming and opponent simulation that provides modular capabilities for stealthy command and control (C2) operations. It offers features such as performance of memory, encrypted communication and evasion techniques to bypass modern security defense.
Clickfix has become insanely popular in the last few months. At the end of October last year, a new malware variant was observed that compromised thousands of WordPress sites, which installed a malicious plugin that would serve the clickfix attack.
Just a few weeks before scientists false destroyed Google meeting calls, which was also a variant of the clickfix attack.
Via Bleeping computer
