[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_kCBZR5esSJOnHTRmDxmcCykdEdC7szxJRtnV434104":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":50},"9c6b9421-78b4-4ac2-86e9-4c67fe7b0f5c","clickfix-social-engineering-evolves-to-hijack-domain-controllers-via-png-hidden-malware","126e0036-a1ed-4600-91da-7c1d5e8e1b0f","ClickFix Social Engineering Evolves to Hijack Domain Controllers via PNG-Hidden Malware","ClickFix attacks exploit human trust by presenting fake verification prompts and spoofed websites that convince users to manually execute malicious PowerShell commands, bypassing technical defenses entirely. By hiding executable payloads inside PNG images (steganography), attackers evade signature-based detection tools that might otherwise flag suspicious binaries. Once a user is tricked into running the initial command, attackers pivot laterally using WinRM and PsExec to reach Windows domain controllers, establishing persistent reverse SSH tunnels and stealing credentials. This matters because compromising a domain controller effectively hands attackers the keys to an entire organization's identity infrastructure, enabling them to impersonate any user and maintain long-term covert access.","**Immediate actions:**\n- Block or restrict PowerShell execution via Group Policy for standard users, enforcing Constrained Language Mode or requiring signed scripts only.\n- Deploy application control (e.g., AppLocker or Windows Defender Application Control) to prevent execution of binaries dropped or extracted by user-initiated scripts.\n- Alert on and block outbound WinRM and PsExec lateral movement activity from non-administrative endpoints.\n\n**Long-term improvements:**\n- Implement phishing-resistant MFA across all accounts, especially privileged and domain administrator accounts, to limit the blast radius of credential theft.\n- Conduct regular security awareness training focused on social engineering tactics, specifically fake CAPTCHA and browser verification lures used in ClickFix-style attacks.\n- Enforce network segmentation to restrict direct user-workstation access to domain controllers, permitting only authorized management traffic.\n\n**Detection measures:**\n- Monitor and alert on anomalous PowerShell invocations, especially those downloading remote content or invoking encoded commands from browser or user-context processes.\n- Enable and centralise logging of WinRM, PsExec, and SSH tunnel activity to detect lateral movement and reverse tunnel establishment early.\n- Inspect image file uploads and downloads using content-aware scanning to detect steganographically hidden executables in PNG and other image formats.",[12,13,14,15,16],"MITRE ATT&CK T1204.002: User Execution: Malicious File","MITRE ATT&CK T1027.003: Obfuscated Files or Information: Steganography","MITRE ATT&CK T1210: Exploitation of Remote Services","NIS2 Article 21(2)(g)","CIS Control 16: Application Software Security (v8)",{"NIS2 Article 21(2)(g)":18,"CIS Control 16: Application Software Security (v8)":19,"MITRE ATT&CK T1210: Exploitation of Remote Services":20,"MITRE ATT&CK T1204.002: User Execution: Malicious File":21,"MITRE ATT&CK T1027.003: Obfuscated Files or Information: Steganography":22},"This point requires organisations to implement basic cyber hygiene and staff training, which would directly reduce susceptibility to the social engineering lures central to ClickFix attacks.","Restricting and hardening how applications — including browsers and scripting engines like PowerShell — can execute code would limit the ability of ClickFix prompts to spawn malicious processes.","Attackers used WinRM and PsExec for lateral movement after the initial compromise, which falls under this technique covering abuse of remote service protocols to move through a network.","This technique covers attackers tricking users into manually executing malicious content — exactly what ClickFix does by prompting users to run PowerShell commands disguised as verification steps.","This technique specifically describes hiding malicious payloads within image files such as PNGs, which is the core evasion method used in this evolved ClickFix campaign.","published","2026-11-11T11:21:35.969503+00:00","2026-11-11T11:21:35.953+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Fclickfix-attacks-evolve\u002F","clickfix-attacks-evolve-to-hide-malware-in-png-images-and-hijack-windows-domain-372933","ClickFix Attacks Evolve to Hide Malware in PNG Images and Hijack Windows Domain Controllers",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[44],{"id":45,"date":46,"edition":47,"title":48,"audio_url":49},"03d32e5f-1fa3-4caf-b218-f35eab71437c","2026-11-11","afternoon","ThreatNoir Afternoon Brief — November 11","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-11\u002Fthreatnoir-afternoon-brief-2026-11-11.mp3",[51,55,59],{"slug":52,"name":53,"problem":54},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":56,"name":57,"problem":58},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":60,"name":61,"problem":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]