INTRODUCTION
ClickFix is a social engineering attack technique that tricks users into manually executing malicious code on their devices by masquerading as routine browser verification checks.
Reliance Cyber Security Operations Centre (SOC) and Incident Response team have identified an evolution in tactics being employed, utilising living-off-the-land-binaries and scripts (LOLBAS), command line obfuscation and WebDAV network share mapping for data exfiltration.
Unlike traditional ClickFix campaigns that attempt to launch PowerShell or mshta.exe directly from the Windows Run prompt, this variant leverages pcalua.exe (Windows Program Compatibility Assistant) to break process lineage and bypass Endpoint Detection and Response (EDR) agent heuristics. Upon execution, the payload fetches a remote script via mshta to initialise a WebDAV connection, mounting a remote attacker-controlled network share on the endpoint for data exfiltration.
Technical analysis: Campaign breakdown
Initial Access & Social Engineering
Threat actors rely on browser-based social engineering to bypass standard web filters and trick users into executing local system commands. This is typically achieved by presenting a window which instructs the user to paste commands into the Windows Run dialog box. The chain of events follows the pattern:
- Clipboard Hijacking: JavaScript running in the background of the lure page silently writes an obfuscated command-line string to the victim’s system clipboard without requiring explicit copy confirmation.
- Execution Lure: On-screen instructions direct the victim to complete manual verification steps using keyboard shortcuts:
- Press Win + R (opens Windows Run dialog).
- Press Ctrl + V (pastes the payload from the clipboard).
- Press Enter (runs the pasted command).
Execution & Defence Evasion Mechanics
Once the user confirms the Run prompt, the payload executes through a multi-layered chain designed to evade Endpoint Detection and Response (EDR) platforms and Security Information and Event Management (SIEM) detection rules.
- LOLBAS Exploitation (pcalua.exe):
- The pasted payload executes C:\Windows\system32\pcalua.exe under explorer.exe.
- Evasion Mechanism: pcalua.exe (Windows Program Compatibility Assistant) acts as a trusted proxy wrapper to indirectly launch secondary shells (PowerShell / cmd.exe). This differs from normal parent-child process lineage, attempting to blind traditional EDR process-tree detection rules.
- Command Line Obfuscation (Caret Insertion):
- Obfuscated Pattern: Parameter strings use caret symbols (e.g., m^s^h^t^a and h^t^t^p^s^:^/^/).
- Evasion Mechanism: SIEM detection rules relying on exact string matches fail to trigger. When passed to the command interpreter (cmd.exe or PowerShell), the CLI strips the carets as escape characters, rendering the underlying string as mshta https://… during runtime.
- Execution Abstraction (saps):
- The command invokes saps, the built-in PowerShell alias for Start-Process.
- It passes cmd.exe with /v /c flags to evaluate and execute the obfuscated mshta command string.
Secondary stage & network share mapping
- Remote Payload Retrieval: mshta.exe connects to the adversary C2 server to download and execute an HTML Application (HTA) script.
- WebDAV Drive Mounting: The executed script initialises Windows WebDAV services on the endpoint to mount a remote, attacker-controlled network share mapped to the malicious domain.
- Data Exfiltration: The persistent mapped drive allows adversaries to interact with the local file system, staging and exfiltrating sensitive data directly over the WebDAV share.
Indicators of compromise
Caution is recommended when adding the provided indicators of compromise for blocking, this is due to the IP addresses (version 4 and version 6) provided being Cloudflare owned content delivery network (CDN) addresses, this could have a far greater negative impact than potential positive gains.
| Indicator Type | Value | Context / Function |
| Domain | fine-work-team[.]com | Primary C2 / Payload Delivery Domain |
| Domain | Edsy[.]brain-bright[.]net | Primary C2 / Payload Delivery Domain |
| Domain | Wss[.]vectorplatform[.]cc | C2/Payload Delivery Domain |
| Domain | Geo[.]estimator-undermostshelving[.]in[.]net | C2/Payload Delivery Domain |
| IPv4 Address | 172.67.164[.]11 | Data exfiltration IP |
| IPv4 Address | 104.21.82[.]2132 | Data exfiltration IP |
| IPv4 Address | 104.21.48[.]2333 | Data exfiltration IP |
| IPv4 Address | 172.67.152[.]1744 | Data exfiltration IP |
| IPv6 Address | 2a09[:]bac0[:]69[::]671[:]d12f | Observed IP address associated with initial access landing page |
| Process / Binary | C:\Windows\system32\pcalua.exe | Program Compatibility Assistant used for defence evasion |
| Process / Binary | mshta.exe | Microsoft HTML Application Host used to fetch remote payload |
Mitre ATT&CK Mapping
| Tactic | Technique ID | Technique Name | Context |
| Initial Access | T1204.001 | User Execution: Malicious Link | Social engineering prompting user to press Win+R + Ctrl+V. |
| Defence Evasion | T1218 | System Binary Proxy Execution | Abusing pcalua.exe as a proxy binary to sever process lineage. |
| Defence Evasion | T1027 | Obfuscated Files or Information | Caret insertion (m^s^h^t^a) to evade SIEM CLI detection rules. |
| Execution | T1218.005 | System Binary Proxy Execution: Mshta | Invoking mshta.exe via HTTPS URL to run arbitrary scripts. |
| Exfiltration | T1048 / T1021.002 | Exfiltration Over Alternative Protocol / SMB/Windows Admin Shares | Spawning WebDAV to map malicious domain and exfiltrate host data. |
[1] https://ipinfo.io/172.67.164.1 [2] https://ipinfo.io/104.21.82.213 [3] https://ipinfo.io/104.21.48.233 [4] https://ipinfo.io/172.67.152.174
Detection & mitigation strategies
Threat Detection Rules
WebDAV Client Activity: Monitor network connections originating from svchost.exe hosting the WebClient service (davclnt.dll) or outbound traffic with WebDAV-Miniredir user-agent headers connecting to untrusted external hostnames.
Process Lineage Anomalies: Trigger high-severity alerts whenever pcalua.exe spawns command interpreters (powershell.exe, cmd.exe) or scripting host utilities (mshta.exe, wscript.exe, cscript.exe).
Caret Pattern CLI Auditing: Monitor process creation logs (Event ID 4688 / Sysmon Event ID 1) for excessive caret usage (^) within command-line arguments containing mshta, http, or PowerShell.
Hardening & Prevention
Disable Windows Run Dialog: Restrict user access to the Win + R Run prompt via Group Policy (User Configuration -> Administrative Templates -> Start Menu and Taskbar -> Remove Run menu from Start Menu) for standard employee accounts.
Disable WebClient Service: Disable the Windows WebClient service across enterprise endpoints if WebDAV shares are not explicitly required by business operations.
Attack Surface Reduction (ASR): Enable Defender ASR rules blocking child process creation from office apps/browsers and restricting arbitrary remote script executions.
User Awareness Training: Conduct targeted awareness sessions explaining the “ClickFix” attack vector—reiterating that legitimate web applications will never instruct users to run keyboard commands (Win + R, Ctrl + V) to complete verification steps.
Proactive threat hunting for this activity should focus on querying endpoint process logs for pcalua.exe executions involving command-line flags -a and -c, as well as monitoring outbound connections over ports 80/443 utilising WebDAV redirector clients.