New research reveals how threat actors are evolving social engineering tactics via 'ClickFix' and 'ClearFake' to bypass security and maintain long-term access to enterprise networks.
- Attackers are manipulating users into pasting malicious code into browser sessions or system run dialogs.
- Legitimate infrastructure, including Google Sheets and Docs, is being used to host malicious scripts.
- The campaigns target both individual cryptocurrency holders and high-value government organizations.
Two sophisticated cyber campaigns have recently been uncovered, utilizing a deceptive technique known as ClickFix. These attacks are designed to steal sensitive credentials and cryptocurrency, while simultaneously establishing deep, persistent access within compromised enterprise networks. The common thread between these separate operations is the abuse of trusted services to blend in with legitimate user behavior.
Researchers from Cisco Talos identified that the first campaign specifically targeted the browser. In a deviation from standard tactics, attackers coerced victims into retrieving malicious code from a publicly available Google Sheet. This code was then pasted into the Chrome navigation bar or through the TamperMonkey extension, allowing the attackers to inject loader scripts that persisted across multiple sessions.
The second campaign, attributed to a Russian threat actor, targeted a Ukrainian government organization using the ClearFake method. Victims were presented with a fraudulent Google CAPTCHA, which instructed them to execute a command in the Windows Run dialog. This action triggered the download of a DLL via WebDAV, deploying the Amatera infostealer and the NetSupport Manager for remote system control.
Why This Matters
BozokMedia analysis shows that the shift toward abusing legitimate cloud services like Google Workspace represents a strategic evolution in threat actor behavior. By moving the malicious payload to trusted domains, attackers effectively neutralize many signature-based detection tools that typically flag unknown or suspicious URLs.
"Both operations turn the victim into an active part of the infection chain and abuse services that users and defenders normally regard as legitimate."
Historically, social engineering relied on deceptive links or attachments. However, these new variants require the user to perform a manual action—copying and pasting code—which bypasses many automated browser protections and security sandboxes.
| Feature | Crypto-Theft Campaign | Ukrainian Gov Attack |
|---|---|---|
| Primary Tactic | ClickFix (Browser Injection) | ClearFake (Fake CAPTCHA) |
| Infrastructure Used | Google Sheets / TamperMonkey | WebDAV / Windows Run |
| Primary Goal | Cryptocurrency Theft | Espionage & Remote Access |
Frequently Asked Questions
1. How can I tell if a CAPTCHA is fake?
Legitimate CAPTCHAs will never ask you to copy and paste a command into your computer's Run dialog or browser console.
2. Why do hackers use Google Sheets for attacks?
Because Google is a trusted domain, security software is less likely to block the connection, making it an ideal host for malicious scripts.
