ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers

ClickFix attacks exploit human trust by presenting fake verification prompts and spoofed websites that convince users to manually execute malicious PowerShell commands, bypassing technical defenses entirely. By hiding executable payloads inside PNG images (steganography), attackers evade signature-based detection tools that might otherwise flag suspicious binaries. Once a user is tricked into running the initial command, attackers pivot laterally using WinRM and PsExec to reach Windows domain controllers, establishing persistent reverse SSH tunnels and stealing credentials. This matters because compromising a domain controller effectively hands attackers the keys to an entire organization's identity infrastructure, enabling them to impersonate any user and maintain long-term covert access.