Top News

In a ClickFix attack, users are tricked into running PowerShell commands under the guise of a fake security verification process. Learn why commands like `irm` and `iex` are dangerous and how to identify suspicious pages.

Cybercriminals are now compelling users to execute malicious commands on their own computers, rather than simply downloading malware directly. This technique, known as "ClickFix," leverages the branding of legitimate websites and trusted security services like Cloudflare to present a fake verification process to the user. Users are then asked to paste a command into Windows Terminal or PowerShell to complete the verification.

One such ClickFix attack pattern was observed in an older Proof of Concept (PoC) linked to the Nilesat website. In this instance, the webpage displayed mimicked Cloudflare’s security verification process; however, instead of performing a standard browser action to verify, the user was instructed to open Windows Terminal and manually execute a specific command.

It is important to clarify that this refers to an older PoC example involving Nilesat, and the website has since been remediated. The purpose of this report is not to question Nilesat's current security posture, but to illustrate how social-engineering techniques like ClickFix operate.

What were users asked to do in the name of Cloudflare verification?

In the older PoC, the fake verification page instructed users to follow a series of steps. These included opening the Terminal using a Windows shortcut, pasting a provided PowerShell command, and pressing Enter.

The crucial aspect of this entire process was convincing the user that they were completing a legitimate security verification. In reality, they were being tricked into executing a PowerShell command on their own system.

This is the most dangerous aspect of a ClickFix attack. The attacker does not necessarily exploit a software vulnerability; instead, they persuade the user to perform an action that allows malicious code to execute on their system.

The Real Threat Was Hidden in the PowerShell Command

The command used in the older PoC included PowerShell commands such as `irm` and `iex`.

`irm` (Invoke-RestMethod) was used to fetch content from a remote server, while `iex` (Invoke-Expression) could execute the retrieved content within PowerShell.

This meant that the user did not necessarily see the full malicious payload within the command itself. The command could fetch content from an external server and then send it to the system for execution.

This behavior poses a significant security risk because the content on the remote server could be altered later. Consequently, simply looking at the command is not always enough to predict its ultimate behavior.

Payload Could Be Downloaded Using a Remote Server

In this older PoC, the PowerShell command was configured to fetch content from an external IP address.

The remote host featured in the PoC was:

http://158.94.211.92/

This was not part of any legitimate Cloudflare verification infrastructure. According to available VirusTotal analysis, the URL associated with this endpoint had been flagged by multiple security vendors as malicious, phishing-related, or linked to malware activity.

For this reason, any attempt by a verification page to download PowerShell content from an unknown IP address or external server should be treated as a serious warning sign.

Why Is Cloudflare's Name Used?

In "ClickFix" attacks, exploiting user trust is often more critical than the technical exploit itself.

Cloudflare is a well-known name, and users have frequently encountered its security checks on various websites. Attackers exploit this familiarity to create fake verification interfaces.

Users believe they are completing a standard website security verification. However, after a few steps, they are prompted to open the Terminal, paste a command, or execute a script.

This is the point where a routine verification process transforms into a potential social-engineering attack.

Legitimate Cloudflare Verification Does Not Require Opening the Terminal

This is the most important point for users to remember.

During a legitimate Cloudflare verification process, you:

There is no need to open Windows Terminal by pressing Windows + X.
There is no need to manually paste PowerShell commands.
There is no need to execute unknown commands by pressing Enter.
There is no need to download a script from a remote server and run it manually.
If a website asks you to follow such steps under the guise of Cloudflare verification, it should be treated as a serious security warning.

Important clarification regarding the old Nilesat PoC

This example involving Nilesat relates to an old Proof of Concept (PoC), and the website has since been fixed.

Therefore, this instance should not be viewed as a report on Nilesat's current security status. Its significance lies in the fact that it serves as an example to understand techniques like "ClickFix," utilizing a realistic-looking website and the identity of a trusted security brand.

In such attacks, a compromised website merely acts as a delivery mechanism, while the ultimate goal is to trick the user into performing a malicious action.

How can users protect themselves from ClickFix attacks?

If a website asks you to open Windows Terminal or PowerShell, copy-paste a command, and press Enter during a verification process, do not do so under any circumstances.

In particular, unknown commands containing terms like `powershell`, `iex`, or `irm` should not be executed without verification. Similarly, commands that download content from unknown IP addresses or unfamiliar domains could indicate a potential threat.

Most importantly, do not assume a page is legitimate simply because it displays the Cloudflare logo, name, or an interface resembling their verification process.

If a website asks you to run commands on your computer for verification purposes, it is likely a potential ClickFix attack rather than a standard security check.

Note: This PoC, along with all the IP addresses, technical demos, and attack procedures shown, was presented by cybersecurity researcher Santosh Kumar for research and awareness purposes.

---