ClickFix Campaigns Abuse Legitimate Services for Persistent Access
ClickFix campaigns leverage legitimate services for persistent access via social engineering.
Two distinct campaigns, dubbed ClickFix, have been observed abusing legitimate cloud services to gain persistent access within victim environments. These attacks rely on social engineering tactics to trick users into executing malicious payloads, which then establish a foothold using cloud-based infrastructure. The methods employed highlight a growing trend of threat actors leveraging trusted services to evade detection and maintain access.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonClickFix campaigns exploit social engineering to manipulate users into voluntarily executing malicious payloads, bypassing many traditional security controls. By abusing legitimate cloud services such as trusted SaaS platforms, attackers blend malicious traffic with normal business activity, making detection significantly harder. This highlights a critical gap in user awareness training and the limitations of perimeter-based defenses when attackers operate through trusted channels. Organizations that lack behavioral monitoring and robust endpoint controls are especially vulnerable to this style of persistent access establishment.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.