Full transcript
0:00Step one, hold down the Windows key and
0:03press the R key on your keyboard. And
0:05step two, hold down the control key and
0:08press V on your keyboard. And step
0:11three, press enter. This is clickfix.
0:15It's a social engineering lure or lie to
0:19trick someone into voluntarily
0:21installing a virus on their computer or
0:24running malware. Clickfix is an old
0:27technique. It's been around for years,
0:30but was especially popular in the August
0:32and September time frame of last year in
0:352024. Some info stealer malware variants
0:38like Llama Stealer that will try to rip
0:41out your passwords and cookies and
0:43stored in cache credentials on your
0:45computer would use this trick where they
0:47would look like a capture or an online
0:50verification setup to interact with some
0:53website. And these websites would
0:55pre-poison what is in your clipboard so
0:58that when you press CtrlV on your
1:00keyboard, the hotkey to paste in the
1:03copy and paste functionality, it's going
1:05to end up putting in some malware or
1:08whatever code or command they want you
1:10to run. And that Windows key plus R is
1:13the hotkey to open the run dialogue box
1:16in Windows. So this whole technique just
1:19prays off of people not knowing about
1:22computers or not having the education or
1:24awareness to understand what those hot
1:26keys on your keyboard do and what's
1:28really happening when you follow those
1:30simple steps. The thing is though, this
1:33spread like wildfire. Throughout the
1:36past year, there have been tons,
1:38thousands, if not tens of thousands of
1:40new ClickFix malware or different
1:42variants or different sort of
1:44instructions and lies or these social
1:47engineering lures to trick you, mom,
1:50dad, grandma, grandpa, sons or
1:52daughters, or anyone into running
1:54malware. And I've covered this in past
1:56videos, and it's made its rounds across
1:58the internet, even with other
2:00researchers coming up with different
2:02variations or alternatives to fire off a
2:05payload or run a command in another
2:08easy, simple, and just natural way to
2:10get to one opportunity to execute code.
2:13Even something like naturally in the
2:15Windows file explorer. Mr. Docs called
2:18this file fix, but it's still really
2:20just clickfix at the end of the day with
2:22extra steps. And some other folks came
2:24up with what they called download fix or
2:27terminal fix and all these other names
2:29for really just different variations.
2:32Again, just taking advantage of the
2:34social engineering lure or lie for
2:37people that just don't have the
2:39awareness and education. But recently,
2:41the whole world has gotten into even
2:43more conversations of security and
2:45privacy with new laws, regulations, or
2:48policies that demand your ID
2:50verification. And while there are things
2:52that we already do on the internet that
2:54we're pretty desensitized to, like, oh,
2:57clicking a capture button or clicking
2:58accept, yes, I consent to storing
3:01cookies on your computer. There will be
3:03more things that hackers, thread actors,
3:06and adversaries will take advantage of.
3:08And I think it's worth knowing what
3:10these are, what they look like, so
3:12you've got that education and awareness,
3:13so you know what to identify and defend
3:16against. So, I had an idea. all of these
3:20different ClickFix variations. What if
3:23there were a website or a wiki that kind
3:26of explained and showcased what all
3:28these are and what more there could be?
3:32So, in this video, I want to talk to you
3:33about that idea, show you what's been
3:35put together, and really dig into it.
3:37But before we do, please let me take
3:39just a quick moment to tell you about
3:40the sponsor of today's video, Keeper
3:42Security. You know about all the threats
3:45that we face within cyber security and
3:48you know what it takes to keep up with
3:50everything. But the thing is it takes
3:52time. Time that we as people don't
3:55always have. But artificial intelligence
3:57when used the right way really does help
3:59you scale. So check out the latest
4:02version of Keeper AI. A powerful feature
4:05included with Keeper Pam. It brings real
4:07time AI powered threat detection and
4:10response right into your privilege
4:12sessions. Keeper AI tracks your SSH
4:15sessions live and in the moment. It uses
4:17a Gentic AI to analyze what users are
4:20doing at each and every command and
4:22flags anything suspicious or malicious
4:24activity. It reveals realtime risk
4:27scoring from low to critical. And every
4:29flag comes with full context. So you're
4:32not just told something happened, you
4:34know why it's risky. If it sees
4:36something dangerous, it can terminate
4:37the session instantly. And you can set
4:40up custom rules, match specific
4:42patterns, or use regular expressions,
4:44whatever fits your environment, and it
4:46plays nice with any LLM provider,
4:49whether that's AWS Bedrock, Azure,
4:52Google Vertex AI, Grock, or other
4:54self-hosted runtimes. Every session gets
4:57an encrypted AI generated summary and
5:00video playback, so your team has
5:02everything you need for auditing,
5:04incident response, and proving you've
5:06got it covered. Insider threat detection
5:08automated. Manual log reviews, not
5:11anymore. And just too many false
5:13positives gone. Check out Keeper AI and
5:16everything else Keeper Security has to
5:18offer with my link below in the video
5:20description. jh.live/keeper-ai.
5:24Huge thanks to Keeper for sponsoring
5:26this video.
5:29All right, so way back at the end of
5:32July, a teammate of mine, my video
5:34editor, Nord Garren, had created a Slack
5:36channel and invited me called ClickFix
5:393. And I was a little bit amused and
5:41interested. Oh, what is this? And he
5:43says, "Look, turns out you can use other
5:46binaries to get a shell or command
5:48prompt or command line or code execution
5:51on Windows." And that makes sense.
5:53There's nothing new or novel there. He
5:55suggests look if you use FTP like the
5:57file transfer protocol and FTP.exe
6:01the native natural and built-in utility
6:03to use that protocol on Windows from the
6:06command line. You can just use a command
6:08to execute PowerShell or any other
6:10command that you want. Same way you
6:12could do this with TNET. And I said,
6:14"Oh, uh, isn't that just like using a
6:17different LOL bin or living off the land
6:19binary?" And just in case folks aren't
6:21familiar, LOL bins or these living off
6:24the land binary scripts and libraries is
6:26an archive and sort of collection
6:28catalog of all the different potential
6:31native and natural already installed and
6:33built into your computer programs and
6:35applications that could be used to do
6:38some other damage. And I say damage as
6:40in malicious activity things for hacking
6:42or post exploitation. And Nord Garren
6:45continues with a little bit more of an
6:46explanation as to how that could be done
6:48with like Telnet or FTP. Usually in that
6:50case, you could provide just an
6:52exclamation point as a prefix to a
6:54command that you might end up entering.
6:56And it's as if you ran that from the
6:58command line or the Windows key and Run
7:01dialogue box. And he notes, look, we're
7:03probably going to see that for a whole
7:05lot of the upload your ID for
7:06verification stuff. But initially I was
7:09struggling with that idea because well
7:11it is just a lull bin at that point like
7:14a living off the land binary. People are
7:16already pretty well familiar with living
7:18off the land binaries and normally those
7:20run from the command line. So to an
7:22average user they look sketchy to begin
7:24with. But what if they were like natural
7:27graphical user interface windows that
7:29might look a little bit more convincing?
7:31Granted, then there would be more steps
7:34for that end user or victim to walk
7:36through, like, oh, click this button,
7:38type this here, press this, but then
7:41that might even be more effective, like
7:44you're walking through a whole
7:45procedural article on how to do
7:48something, how to fix in this clickfix
7:50lie. Maybe that's even more convincing.
7:54It is just social engineering. So, we
7:57bounce around this idea a little bit
7:59more. And while the FTP exe example is
8:02one thing in that that's an opportunity
8:04to execute a command and it would even
8:06spawn a whole another child process. So
8:08it's not under explore.exe. That's a
8:11neat variation. I get the idea. What if
8:15for all of those different
8:16opportunities, all those different
8:18variations and all the potential lies or
8:20social engineering scams, what if there
8:22were a big giant resource like similar
8:26to LOL bins living off the land binaries
8:28or GTFO bins or LOL RMM or all those
8:32different research articles and
8:34collection of cataloged information as
8:37to how this could be used with clickfix
8:40and it's not just Windows, right?
8:42because it's social engineering because
8:44it's a lie and some deception that could
8:46be done just as well on Mac or Linux or
8:49using a command line tool or a graphical
8:52user interface tool. Some of these could
8:54take advantage of the user account
8:56control like escalating privileges to
8:57run as admin. Some could have a
8:59different parent and child process
9:01relationship. Some might even have a
9:03different setup like not just the
9:04Windows key and R. Maybe you had
9:06instructions to open up the task manager
9:09and then you could just run a new task
9:12whether you had the run dialogue box as
9:14well here but you could click the check
9:15box to oh create this task with
9:18administrator privileges and well that's
9:20just one example we've seen even
9:22previously with a lot of the commotion
9:24the Windows key and X hotkey that opens
9:26up that power menu app that lets you
9:28open up a terminal or PowerShell or
9:31another file explorer and even run as
9:33admin with the user account control. But
9:35think of more than just the command
9:37prompt and think about all the different
9:39lies that one might be able to tell with
9:41this. Like if we were to go explore even
9:44inside of the C Windows system 32
9:47directory like Lulins, right? Using that
9:50idea of living off the land binaries
9:52naturally installed on your Windows
9:54computer. Think of all the tools that
9:56you might be able to research or look up
9:58and wonder how could this get me to a a
10:02location where we could execute a
10:04command or b a file explorer that will
10:07allow us to actually run something with
10:10file fix. Let's say I were to use the
10:13credential wizard like oh I'm trying to
10:15back up or save my passwords. Say I
10:17click next and then I were to browse for
10:19a location. Well, what's to stop me from
10:22here pasting in whatever payload that
10:24would we want to run? Think of all the
10:26gamers that might be trying to get their
10:28video game to run and they're so used to
10:30running dxag.exe
10:32to get the info about their graphics
10:34card. Well, what if this website lied to
10:37them and said, "Oh, send us the output
10:39of your DX diagonics card information.
10:43Go ahead and save all this information
10:45and paste in whatever payload happens to
10:47be in that file browser." Say there was
10:50some website even that lied and said,
10:52"Oh, you have a virus. You have malware
10:54installed on your computer." You can run
10:56a custom scan or remove it with the
10:58official Microsoft malicious software
11:00removal tool. They tell you fire up MRT,
11:04the Microsoft official malicious
11:06software removal tool that requires
11:08running as admin. And they give you
11:10these steps. They say, "Oh, run a
11:12customized scan where you could choose a
11:14folder and again paste in whatever
11:17payload you want." All of this that is a
11:20lie, but leveraging any and all of the
11:24native natural builtin and part of your
11:27computer living off the land binaries
11:30purposely used for clickfix and this
11:33scam. I got to thinking, you know, maybe
11:36a resource like that could be handy for
11:39detection engineers to be able to see,
11:40oh, what else is out there? or maybe get
11:42some sigma rules, see the parent and
11:44child process relationship, understand
11:46the artifacts, and for folks to be able
11:48to reference if uh-oh something were to
11:50go down and ultimately just to raise
11:52awareness as to how this could all be
11:54put to use. So, I made it or tried to
11:58started to. Anyway, good old chat GPT,
12:01good old cursor, me and my AI guy went
12:04ahead and slapped out, crapped out the
12:06ClickFix wiki, clickfix.wiki, wiki, just
12:09some GitHub pages that you could explore
12:11where you could simply search for
12:13anything that might be pertinent with
12:15anything that you're looking for or
12:17filter for specific platforms or
12:20whatever. Granted, I didn't fill out a
12:22whole lot of info here, but the
12:23capabilities and, you know, trigger on
12:26each of these is there. But take a look.
12:28This was that DX DIAG example where you
12:31might fix your graphics driver. What a
12:33lie. Maybe you were looking through file
12:35history to save your important documents
12:37or back up your computer files in the
12:39lie steps here. Even digging through the
12:42event viewer. Uh-oh, your computer logs
12:44are corrupted. Here's the remote
12:46assistance utility. MSR is the official
12:49Microsoft remote assistance tool. Maybe
12:51there's a get remote support lie. And I
12:53started to go through each and every one
12:56of the system 32 binaries to see what
12:59could we scheme up. And I was thinking,
13:02you know, maybe this is kind of a cool
13:03like security research project. Maybe
13:05one of you might be interested in
13:07walking through those steps or going to
13:08track down what are all the
13:10opportunities there. But you might have
13:11noticed that conversation and the idea
13:14for this was way back at the end of July
13:16and now we're getting into October. Um,
13:19I realized I can't I I I don't have
13:22time. I'm I I wasn't able I'm not able
13:25to pour into the work, the effort, and
13:27the fun really the interesting stuff
13:29there to make that happen. And if I were
13:31to create this living off the land
13:34binaries resource like a lookalike of
13:36Lulins, but for ClickFix, I couldn't
13:39maintain it as like a community thing.
13:41Just realistically, I could give the
13:43idea to you all and here you go. I hope
13:45you run with it. But I was thinking,
13:47what if I put this together and actually
13:50helped maybe get something off the
13:51ground with some good friends that are
13:53doing cool security research and work
13:55like this, building out these living off
13:58the land catalog and inventory and
14:00archives. So I thought, why not bring it
14:02to the folks that made other resources
14:05like LOL drivers, living off the land
14:07drivers or LOL RMMs, living off the land
14:10remote monitoring and management
14:12utilities. And there are a whole lot of
14:13folks there, but Mike Haggus certainly
14:15stands out. He's one of the threat
14:17researchers over at Splunk. He hosts
14:19this cool Atomics on a Friday little
14:20show and project. He's a maintainer for
14:22LOL Drivers, LOL RMM, the atomic red
14:25team, and a lot of other awesome
14:26community projects. And Mike had
14:28actually already started a project about
14:31ClickFix. He had Click Grab, another
14:35living and breathing project that is
14:37already cutting up and digging into
14:38different ClickFix attacks, getting some
14:40of the payloads, including the
14:42mitigations and everything here. And
14:44that's ultimately what I wanted to make
14:46sure we could get into the ClickFix wiki
14:48was that look, you could use this
14:50registry key to disable the run dialogue
14:52box in the command line. You could turn
14:54off this setting for the power menu with
14:57the Windows key and X hotkey. As I got
15:00to thinking about this more though, I
15:02was really coming to the realization
15:04that, hey, maybe Mike could just take
15:07over and own what I've been trying to
15:09build out slowly but surely, but not
15:12really, ClickFix Wiki. He already has
15:14some awesome pipeline, tooling, and
15:17project for ClickGrab. So, could we just
15:20combine the two? Would he be up for it?
15:22I wanted to make sure this would be
15:23something that anyone could contribute
15:25to like that open- source project
15:27Lolassike repository and website. And I
15:30reached out. I just asked Mike, "Hey, do
15:32you think you could blend this into what
15:35you've got? Would you be willing to run
15:36with it?" And I asked his permission to
15:37share these DMs. And he said, "You know
15:39what? Yeah, actually, I really like the
15:42idea. I can see this becoming a
15:43community contribution type project. A
15:45lot of folks see these all the time, and
15:47hey, maybe it could just be someone that
15:49we crowdsource." So, I share with him
15:51the GitHub repository that's all AI slop
15:53and crap that I just pooped out. But, I
15:55wanted to showcase this in a video to
15:57get the idea out and about and then
15:59really just have it live somewhere
16:01proper. And I'm super happy because he
16:04was up for it. He said, "Yeah, you know
16:06what? This is super cool. We could build
16:07this in." So, if you go take a look at
16:09the Click Grab website, I'll leave a
16:11link in the video description and I'll
16:13point my old clickfix.wiki incomplete,
16:16not something that I can maintain. I'll
16:18redirect it over to his site, Mike's
16:20click grab project. All the stuff that
16:23it already did is still there. I didn't
16:24want to take any of that by any means.
16:26But now he's added the sweet technique
16:28section. You can see in the footer and
16:30in the navigation at the top here. And
16:32this is kind of the same interface that
16:34I had put together. Well, Chad GBT put
16:37together, right? And he's even added a
16:39heck of a lot more to have things
16:40specific to different platforms. You can
16:42see Mac in here. You can see a little
16:44bit of Linux here and there. And this
16:46could have even more contributions and
16:48we could build out all of those
16:50potential opportunities, the different
16:52variations of running. Here's one
16:54forexpress.exe,
16:56like one of the super old Windows
16:58binaries to build a self- extracting
17:00archives or packages and programs. And
17:02we've covered that in a YouTube video,
17:04but look, same sort of steps. You could
17:06have this stager really be anything,
17:08whether it's the Windows key in R,
17:09whether it's Windows key in X, whether
17:11it's some code execution as that cradle.
17:14and then these instructions or steps as
17:16the flow of what you'd follow through
17:17with. You're ending up using this other
17:20utility that might look legitimate and
17:22fool an end user clicking through the
17:24steps to get to the file browser. Really
17:27sweet stuff even has a try example
17:29opportunity for each and every one of
17:31these that shows you a little bit of
17:32that process. And that is of course just
17:35one of many. And while we have not even
17:37begun to get through all of the
17:39potential opportunities to think up what
17:41could be a little trick, a little
17:44technique, a little lie is what really
17:46all this is. And maybe it's worth kind
17:48of differentiating, you know, a social
17:50engineering lure versus the flow and
17:53steps that you walk through and the
17:55cradle or however you stage or start
17:57your first code execution input like
18:00Windows key R, Windows key X, whatever,
18:02file explorer way. and then what you
18:04would follow on after with the steps
18:06that carry that out. If we wanted to
18:08make it super abstract and like logical
18:10or even something that could be
18:12ingestable for more telemetry
18:14intelligence blah blah blah. Well, do
18:16you drill down to like oh a key? What is
18:19the controlV functionality on Windows
18:22versus command V or whatever on Mac or
18:24whatever F11? All these different
18:26hotkeys and things that your computer
18:28could do. I'm rambling, sorry. But think
18:30of like control S, the hotkey to oh save
18:33a page and then control L brings you to
18:35the address bar of that file explorer.
18:37Then you control V to paste and
18:39whatever. You could do the same with
18:40control O. You could do Ctrl P to open
18:42up the printer dialog box. Click through
18:44whatever save in F as use printer
18:47whatever. And then it does the exact
18:48same thing. I'm getting carried away.
18:50Sorry, but you get the idea, right? It's
18:53still click fix. still that trick but
18:57bundled up and decorated so that anyone
18:59could fall for any sort of thing.
19:02Really, it boils down to that user
19:04education and awareness as to what is
19:07this going to do on my computer when
19:10you're blindly following steps like
19:12monkey see monkey do because some
19:14website told you to do it. And then for
19:16the IT administrators, the CIS admins,
19:18the network owners, the folks that are
19:20trying to lock down, harden, and protect
19:21their environment from things like this,
19:23what are those hardening techniques?
19:25What are the mitigations we could use? I
19:28think we could slap that all into one
19:29resource because ClickFix has blown up
19:31to be a problem in its own right. I
19:34think I've heard some folks say, you
19:35know what, it is just as prevalent as
19:37fishing. In all reality, maybe even more
19:39so because you don't need to send an
19:41email anywhere. you're just setting up a
19:43website out in the internet and anyone
19:44could go to it. Anyway, I'll leave all
19:46the links for the stuff I've been
19:47rambling about in the video description.
19:49I'll leave a couple more of those
19:50remediations or mitigations or things
19:52you can use to harden and protect
19:53against this sort of thing. And I do
19:55want to raise that awareness as I think
19:57we'll see probably more of these sort of
20:00lies and scams and threats that could
20:03come with, you know, just the
20:05uncertainty that's uh all going on these
20:07days. That's it. That's the end of the
20:08video. I'm done talking. I've been
20:10talking for way too long. Uh, please do
20:11all those YouTube algorithm things.
20:12Like, comment, subscribe. See you in the
20:14next video. And please do give some love
20:15to our sponsors. Seriously, that's the
20:17only way the channel can keep doing what
20:18it's doing. Appreciate all your support.
20:20Link below.