ClickFix Disguises a Fake Word Online Message to Lure Victims into DarkGate Infection

A new social engineering campaign, “ClickFix,” is tricking users into running malicious PowerShell commands under the guise of browser troubleshooting.

Unlike typical malware that self-installs, ClickFix relies on user interaction, a deceptive “support-style” tactic that directly leads to a DarkGate malware infection.

Sponsored

class="wp-block-heading" id="h-fake-word-online-extension-message">Fake Word Online Extension Message

The attack begins when users encounter a fake browser alert claiming that the “Word Online” extension is not installed.

A pop-up prompts them to click a “How to fix” button, supposedly to restore functionality. Behind this seemingly harmless message lies a malicious script embedded in the webpage’s HTML code.

Upon inspection, analysts discovered multiple layers of Base64-encoded and reversed strings, used to conceal a PowerShell command. When decoded, this command attempts to download an HTA (HTML Application) file from a remote server:

The malicious file is saved locally at C:UsersPublicnC.hta and executed via the Start-Process command, triggering the infection chain.

The PowerShell script also clears the clipboard (Set-Clipboard -Value” “) and ends its own session (exit) to hide traces and hinder analysis.

Clipboard Injection and Multi-Stage Payload

A JavaScript segment embedded in the same HTML page manages the user interface and clipboard activity. When the victim clicks the “How to fix” button, the malicious PowerShell command is copied to the clipboard.

Victims are then instructed to press Windows + R, open the Run dialog, and paste (CTRL + V) the copied command, thereby unknowingly executing malware instructions.

This user-driven execution downloads and launches dark.hta, which connects to a command-and-control (C2) server and retrieves additional scripts.

It creates directories on the C drive, drops an AutoIt script (.a3x), and executes it automatically to deploy further payloads.

Analysis of the fckhffh.a3x file indicates the use of the DES encryption algorithm, followed by the creation of a secondary DOS executable, believed to initiate DarkGate operations and data exfiltration routines.

Security telemetry links this activity to the following MITRE ATT&CK techniques:

• T1059.001: PowerShell used for in-memory execution
• T1027: Obfuscation via Base64 and reverse encoding
• T1036: Masquerading as legitimate troubleshooting tools
• T1071.001: Payload fetched over HTTP(S)

Researchers warn that ClickFix evades detection because the user manually initiates the malicious command, making it appear legitimate to standard antivirus tools.

To stay protected, users should avoid copying code from pop-ups or websites offering quick “fixes.” Enterprises can mitigate risk by disabling the Windows Run command via Group Policy and enforcing an application allowlist.

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates

The post ClickFix Disguises a Fake Word Online Message to Lure Victims into DarkGate Infection appeared first on Cyber Security News.