ClickFix Shifts to Windows Terminal Evasion
💡Phishing evades Defender/training via Terminal—protect Windows AI workstations.
⚡ 30-Second TL;DR
What Changed
Attackers direct Win+X → I to launch wt.exe instead of Win+R Run
Why It Matters
This evasion boosts phishing success against Windows users, risking data in AI dev environments. Enterprises must update training beyond Run dialog warnings. Heightens urgency for endpoint detection refinements.
What To Do Next
Update security training to block pasting commands in Windows Terminal on dev machines.
Key Points
- •Attackers direct Win+X → I to launch wt.exe instead of Win+R Run
- •Paste hex-encoded PowerShell from fake CAPTCHA/verification lures
- •Downloads renamed 7-Zip to extract malware, adds scheduled tasks and Defender exclusions
- •Alternative chain: XOR batch file, VBScript via MSBuild LOLBin, browser code injection
🧠 Deep Insight
Background and context from public sources — not the original article. 7 sources cited.
🔑 Enhanced Key Takeaways
- •The Windows Terminal variant deploys Lumma Stealer via QueueUserAPC() injection into chrome.exe and msedge.exe processes to harvest browser credentials like Web Data and Login Data.[1][2]
- •A parallel attack chain downloads a batch script to AppData\Local, writes VBScript to %TEMP%, and leverages MSBuild as a LOLBin for execution.[1]
- •ClickFix campaign originated in 2024 as social engineering tricking users into pasting commands via Run dialog, malvertising, and fake CAPTCHAs, evolving to evade multi-line warnings.[5][6]
🛠️ Technical Deep Dive
- •Hex-encoded, XOR-compressed PowerShell command pasted into wt.exe spawns additional Terminal/PowerShell instances for decoding, ZIP download, and renamed 7-Zip extraction.[1]
- •Final payload in C:\ProgramData\app_config\ctjb uses QueueUserAPC() for process injection into browsers, targeting high-value artifacts for exfiltration.[2]
- •Alternative pathway employs reflective PE loading, API hashing, position-independent shellcode, and PE downloader for memory-only execution to bypass file-based detections.[3]
🔮 Future ImplicationsAI analysis grounded in cited sources
⏳ Timeline
📎 Sources (7)
Factual claims are grounded in the sources below. Forward-looking analysis is AI-generated interpretation.
- thehackernews.com — Microsoft Reveals Clickfix Campaign
- securityaffairs.com — Microsoft Warns of Clickfix Campaign Exploiting Windows Terminal for Lumma Stealer
- radar.offseq.com — How Clickfix Opens the Door to Stealthy Stealc Inf 765d6586
- Microsoft — Clickfix Variant Crashfix Deploying Python Rat Trojan
- Microsoft — Think Before You Clickfix Analyzing the Clickfix Social Engineering Technique
- proofpoint.com — Security Brief Clickfix Social Engineering Technique Floods Threat Landscape
- sisainfosec.com — Critical Alerts Covering Clickfix Evolves AI Supply Chain Attacks and Enterprise Zero Days
Weekly AI Recap
Read this week's curated digest of top AI events →
👉Related Updates
AI-curated news aggregator. All content rights belong to original publishers.
Original source: Computerworld ↗
This is a summary, not the original. Read the source, or get the weekly briefing.
Weekly AI briefing
One email a week. Unsubscribe anytime.