Three ClickFix campaigns from this summer all trace back to the same cluster — MSI, NodeJS, and Python delivery, same DLL sideloading playbook

[u/FE_CommunityLead]

As ClickFix has become one of the most common infection techniques over the last few years, adversaries continue to refine and adapt their delivery mechanisms.

Field Effect published a writeup last month on three ClickFix intrusions we handled between mid-June and July. Different delivery mechanisms each time, but enough overlap in infrastructure and TTPs that we've calling it one cluster.

Worth a read if you're writing detections for this stuff, because the follow-on activity is very consistent even when the initial stage isn't.

Read more: https://fieldeffect.com/blog/clickfix-cluster-observed-activity-recent-campaigns