{"id":7912,"date":"2025-03-03T14:02:24","date_gmt":"2025-03-03T14:02:24","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/hackers-use-clickfix-trick-via-sharepoint\/"},"modified":"2025-03-03T14:02:25","modified_gmt":"2025-03-03T14:02:25","slug":"hackers-use-clickfix-trick-via-sharepoint","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/hackers-use-clickfix-trick-via-sharepoint\/","title":{"rendered":"Hackers Use ClickFix Trick via SharePoint"},"content":{"rendered":"\n<\/p>\n
\n

\ue802<\/i>Mar 03, 2025<\/span>\ue804<\/i>Ravie Lakshmanan<\/span><\/span>Cybercrime \/ Malware<\/span><\/p>\n<\/div>\n

\n
\n<\/p>\n

<\/a>\n<\/div>\n

Security experts have discovered a new phishing campaign that utilizes the ClickFix technique to deploy an open-source command-and-control framework known as Havoc<\/a>.<\/p>\n

According to Fortinet ForEGuard Labs, “the threat actor conceals each malware stage behind a SharePoint site and employs a modified version of Havoc Demon in conjunction with the Microsoft Graph API to obscure C2 communications within trusted, well-known services,” as stated in a technical report<\/a> shared with The Hacker News.<\/p>\n

The attack begins with a phishing email containing an HTML attachment (“Documents.html”) that, when opened, displays an error message. This error message uses the ClickFix technique<\/a> to deceive users into copying and executing a malicious PowerShell command into their terminal or PowerShell, thereby triggering the next stage of the attack.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n<\/center>\n<\/div>\n

The command is designed to download and execute a PowerShell script hosted on an adversary-controlled SharePoint server. The newly downloaded PowerShell checks if it’s being run within a sandboxed environment before proceeding to download the Python interpreter (“pythonw.exe”), if it’s not already present in the system.<\/p>\n

\n
\n\"Havoc
\n<\/a>\n<\/div>\n

The next step involves fetching and executing a Python script from the same SharePoint location that serves as a shellcode loader for KaynLdr<\/a>, a reflective loader written in C and ASM that’s capable of launching an embedded DLL, in this case, the Havoc Demon agent<\/a> on the infected host.<\/p>\n

Fortinet explained that “the threat actor uses Havoc in conjunction with the Microsoft Graph API to conceal C2 communication within well-known services.” The framework supports features to gather information, perform file operations, as well as carry out command and payload execution, token manipulation, and Kerberos attacks.<\/p>\n

Meanwhile, Malwarebytes revealed that threat actors are continuing to exploit a known loophole<\/a> in Google Ads policies to target PayPal customers with bogus ads served via advertiser accounts that may have been compromised.<\/p>\n

\n

\n
\n\"Cybersecurity\"
\n<\/a>
\n
\n
Source Link<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\ue802Mar 03, 2025\ue804Ravie LakshmananCybercrime \/ Malware Security experts have discovered a new phishing campaign that utilizes the ClickFix technique to deploy an open-source command-and-control framework known as Havoc. According to…<\/p>\n","protected":false},"author":19,"featured_media":7913,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[22],"tags":[46,39,32,31,33,34,35,40,36,37,42,44,43,41,38,45],"class_list":["post-7912","post","type-post","status-publish","format-standard","has-post-thumbnail","category-cybersecurity","tag-computer-security","tag-cyber-attacks","tag-cyber-news","tag-cyber-security-news","tag-cyber-security-news-today","tag-cyber-security-updates","tag-cyber-updates","tag-data-breach","tag-hacker-news","tag-hacking-news","tag-how-to-hack","tag-information-security","tag-network-security","tag-ransomware-malware","tag-software-vulnerability","tag-the-hacker-news"],"jetpack_featured_media_url":"https:\/\/fusionmindlabs.com\/blogs\/wp-content\/uploads\/sites\/9\/2025\/03\/clickfix.png","_links":{"self":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/7912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/comments?post=7912"}],"version-history":[{"count":1,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/7912\/revisions"}],"predecessor-version":[{"id":7914,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/posts\/7912\/revisions\/7914"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media\/7913"}],"wp:attachment":[{"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/media?parent=7912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/categories?post=7912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fusionmindlabs.com\/blogs\/wp-json\/wp\/v2\/tags?post=7912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}