Summary:
Between late 2024 and early 2025, Proofpoint researchers observed a notable trend in which multiple state-sponsored threat actors, including groups from North Korea, Iran, and Russia began using the ClickFix social engineering technique, which was previously popular among cybercriminals. This technique, characterized by pop-up instructions prompting victims to manually run malicious PowerShell commands, was initially seen in early 2024 in campaigns by cybercrime actors like TA571. Since then, it has spread rapidly across the threat landscape, eventually catching the attention of state actors seeking novel infection methods.

Rather than transforming entire campaigns, state actors such as TA427 (North Korea), TA450 (Iran), and Russian-linked groups UNK_RemoteRogue and TA422 used ClickFix to replace traditional installation and execution stages within existing infection chains. TA427 used this technique in phishing campaigns targeting North Korea-focused researchers, directing victims to spoofed diplomatic meeting invitations that led to decoy PDFs and PowerShell commands, ultimately delivering QuasarRAT. Infrastructure supporting this operation relied on dynamic DNS services and compromised servers in South Korea, with tailored content in multiple languages to bolster the social engineering narrative.

TA450, an Iranian group also known as MuddyWater, employed ClickFix in a broader phishing campaign across the Middle East, impersonating Microsoft to trick recipients into running PowerShell commands that installed remote monitoring tools like Level. This marked a notable expansion beyond their typical Israeli targeting. Meanwhile, UNK_RemoteRogue, a suspected Russian group, used ClickFix in a campaign spoofing Microsoft Office to deliver malicious JavaScript and PowerShell, while TA422 (APT28) leveraged it in phishing emails posing as Google spreadsheets, which led users through reCAPTCHA gates to execute Metasploit payloads.


Security Officer Comments:
Despite the tactic's creative blend of deception and user interaction, Proofpoint noted that none of these actors continued to use ClickFix in sustained campaigns immediately afterward. Most returned to traditional methods, possibly indicating limited short-term success or that the technique is still being evaluated. However, TA427's renewed use of ClickFix in April 2025 suggests ongoing experimentation and potential refinements.

While China has not yet been observed using this technique, Proofpoint believes this may be due to limited visibility rather than a lack of interest, and it is likely that Chinese threat actors are also experimenting with ClickFix behind the scenes.


Suggested Corrections:

IOCs:
https://www.proofpoint.com/us/blog/...d-90-days-state-sponsored-actors-try-clickfix