In the ever-evolving landscape of cybersecurity, a new threat has emerged, one that is both insidious and cunning. The ClickFix attack, a technique that has been making waves in the digital underworld, has taken a turn for the worse. This time, hackers have employed a sophisticated strategy, leveraging native Windows tools to reduce the risk of detection. What makes this particularly fascinating is the way in which these malicious actors have managed to exploit the very foundations of the Windows operating system, leaving security software struggling to keep up.
The ClickFix attack campaign, uncovered by the CyberProof Threat Research Team, is a prime example of how hackers are constantly adapting and finding new ways to bypass security measures. This particular iteration, discovered in April 2026, showcases a clever use of social engineering and native Windows utilities. By avoiding common tools like PowerShell and rundll32, which are easily identified by security software, the hackers have managed to fly under the radar.
One of the key aspects of this attack is the use of cmdkey and regsvr32, two trusted Windows utilities. These LOLBins, as they are known in the hacker community, allow the malicious actors to operate without raising suspicion. The user is tricked into manually initiating the process, making it appear legitimate. A fake 'I am not a robot' comment is even included in the malicious command, adding a layer of realism to the Cloudflare security check impersonation.
The attack chain begins with a fake CAPTCHA-like security check or browser error, enticing users to press the Windows key and R (Win + R) and paste a specific command. This command, when executed, connects to a server at IP address 151.245.195.142 using a UNC path, fetching a file named demo.dll. This 64-bit Windows DLL file operates silently, using a function called DllRegisterServer to launch a hidden CreateProcessA call. It then sets up a scheduled task on the computer, named RunNotepadNow, to maintain persistence.
What makes this attack particularly challenging to detect is the fact that the task instructions are not stored on the computer, but rather retrieved from a remote file called 777.xml. This allows the hackers to change the instructions at will without sending a new file, making it difficult to anticipate their next move. The server at 151.245.195.142, which was already down at the time of writing, further complicates the matter.
The implications of this attack are far-reaching. By relying on trusted Windows components and avoiding obvious malware drops, the attackers have achieved a high degree of stealth while maintaining execution reliability. This raises a deeper question: how can we, as users and security professionals, stay one step ahead of these evolving threats?
In my opinion, the best defense against such attacks is user awareness and education. It is crucial to never copy-paste code from unknown sources, no matter how convincing the CAPTCHA may appear. Additionally, security software must continue to evolve and adapt to these new threats, employing advanced machine learning and behavioral analysis to detect and mitigate such attacks. The battle against cybercrime is an ongoing one, and it requires a multi-faceted approach.
As we move forward, it is essential to keep an eye on the trends and tactics employed by these malicious actors. The ClickFix attack campaign serves as a stark reminder that the digital landscape is constantly changing, and we must remain vigilant and proactive in our defense. Only through a combination of user awareness, advanced security measures, and continuous research can we hope to stay ahead of the curve in this never-ending game of cat and mouse.
