ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services

""Instead of launching PowerShell directly, the attacker uses this script to control how execution begins and to avoid more common, easily recognized execution paths," Blackpoint researchers Jack Patrick and Sam Decker said in a report published last week. In doing so, the idea is to transform the App-V script into a living-off-the-land (LotL) binary that proxies the execution of PowerShell through a trusted Microsoft component to conceal the malicious activity."

""The starting point of the attack is a fake CAPTCHA verification prompt that seeks to trick users into pasting and executing a malicious command on the Windows Run dialog. But here is where the attack diverges from traditional ClickFix attacks. The supplied command, rather than invoking PowerShell directly, abuses " SyncAppvPublishingServer.vbs," a signed Visual Basic Script associated with App-V to retrieve and execute an in-memory loader from an external server using "wscript.exe.""

"In 2022, two different threat actors from China and North Korea, tracked as DarkHotel and BlueNoroff, were observed leveraging the LOLBin exploit to stealthily execute a PowerShell script. But this is the first time it has been observed in ClickFix attacks. "Adversaries may abuse SyncAppvPublishingServer.vbs to bypass PowerShell execution restrictions and evade defensive counter measures by 'living off the land,'" MITRE notes in its ATT&CK framework."

Attackers start with a fake CAPTCHA prompt that tricks users into pasting a command into the Windows Run dialog. The supplied command invokes the signed App‑V Visual Basic script SyncAppvPublishingServer.vbs via wscript.exe to retrieve and execute an in‑memory loader from an external server. The App‑V script proxies PowerShell execution through a trusted Microsoft component, enabling living‑off‑the‑land execution that can bypass PowerShell restrictions and defensive controls. The campaign delivers the Amatera information stealer. Misuse of SyncAppvPublishingServer.vbs has appeared previously (for example, DarkHotel and BlueNoroff in 2022), but this is the first observed use in ClickFix-style attacks.

Read at The Hacker News