ClickFix Shifts to Windows Terminal Evasion

🔑 Enhanced Key Takeaways

• •The Windows Terminal variant deploys Lumma Stealer via QueueUserAPC() injection into chrome.exe and msedge.exe processes to harvest browser credentials like Web Data and Login Data.[1][2]
• •A parallel attack chain downloads a batch script to AppData\Local, writes VBScript to %TEMP%, and leverages MSBuild as a LOLBin for execution.[1]
• •ClickFix campaign originated in 2024 as social engineering tricking users into pasting commands via Run dialog, malvertising, and fake CAPTCHAs, evolving to evade multi-line warnings.[5][6]

🛠️ Technical Deep Dive

• •Hex-encoded, XOR-compressed PowerShell command pasted into wt.exe spawns additional Terminal/PowerShell instances for decoding, ZIP download, and renamed 7-Zip extraction.[1]
• •Final payload in C:\ProgramData\app_config\ctjb uses QueueUserAPC() for process injection into browsers, targeting high-value artifacts for exfiltration.[2]
• •Alternative pathway employs reflective PE loading, API hashing, position-independent shellcode, and PE downloader for memory-only execution to bypass file-based detections.[3]

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline