Ransomware groups bypass patches by tricking Windows users into running ClickFix malware loaders
Attackers use social engineering to install loaders on Windows, creating access for potential ransomware deployment without exploiting software flaws.
Key points
- ClickFix campaigns trick users into running commands that install malware loaders.
- Forescout analysis links tactics to Vice Society and Rhysida ransomware activity.
- No software vulnerability is exploited; the attack relies on user interaction.
Windows systems are the target of a campaign using ClickFix social engineering to install malware loaders and Python tunnels. According to Cyber Security News, these tools create access that could support ransomware attacks. The incident relies on users running commands rather than exploiting a software flaw. No patch or fix exists because no product vulnerability is involved.
How it unfolded
- A late September incident showed a user running a command that started the infection chain.
- The chain used trusted Microsoft programs, hidden code, and encrypted network traffic.
- The attack was stopped before ransomware reached the affected systems.
Who is affected
Organizations with Windows systems are at risk if users engage with fake verification prompts. According to Forescout researchers, the tools and methods matched activity linked to Vice Society, a group associated with Rhysida ransomware. This connection suggests a likely ransomware goal, though it does not prove the group carried out this specific incident. The risk exists wherever users have access to command-line interfaces.
Our take on the response
The use of trusted Microsoft executables and DLL sideloading makes detection difficult. Forescout’s October 14 analysis describes how the installer delivers the payload. The malware uses encrypted traffic and dead-drop methods to locate command servers. Security teams must monitor for unusual process injections and registry changes. The absence of a software flaw means technical controls alone may not stop the initial user interaction.
Who needs to act first
Managed service providers should prioritize systems where users have administrative privileges or frequent access to PowerShell and Windows Terminal. Teams usually begin by reviewing recent command-line activity for suspicious scripts or batch files. Check whether endpoint detection platforms are configured to alert on DLL sideloading attempts. Verify that users have been trained to recognize fake verification prompts. Reduce exposure by restricting command-line access for standard users until policy reviews are complete.
Background: Social engineering
Social engineering tactics manipulate human psychology to bypass technical security controls. Attackers use urgency, authority, or empathy to trick victims into revealing sensitive data or performing actions. You defend against these methods by verifying identity through out-of-band channels and validating requests before execution.
Read the full guide: Social Engineering Tactics: How Attackers Bypass Technical Defenses
What to do and how to stay safe: Windows
- Monitor for unauthorized registry startup entries and scheduled tasks that run hourly.
- Inspect network traffic for encrypted connections to unknown command servers.
- Review process injection activity involving trusted Microsoft executables.
- Educate users to reject unsolicited commands presented as system fixes.
Step-by-step guide: Social Engineering Myths: 6 Beliefs That Leave You Vulnerable
General security guidance from the Patch Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is there a CVE for this ClickFix attack?
No CVE exists because the attack does not exploit a software vulnerability.
What malware loaders were identified in this campaign?
Researchers identified Lorem Ipsum Loader and AxolotlLoader samples.
Which cybercrime group is linked to these tactics?
The activity matches patterns associated with Vice Society and Rhysida ransomware.
