Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1105156" data-attributes="member: 32260">WHHLight vs. ClickFix attacks[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/fake-google-meet-conference-errors-push-infostealing-malware.133286/post-1105071[/URL][URL unfurl=&quot;false&quot;]https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clickfix-deception-a-social-engineering-tactic-to-deploy-malware/[/URL][URL unfurl=&quot;false&quot;]https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/[/URL]Attack flow (example from McAfee):phishing email HTML attachment ---&gt;&nbsp; ClickFix abusing Explorer ----&gt; LOLBin (CMD, PowerShell) downloads HTA payload ----&gt; HTA payload executed[ATTACH=full]285851[/ATTACH]This attack is blocked by WHHLight default settings even without tools (FirewallHardening, ConfigureDefender, DocumentsAntiExploit).The payload is dropped into UserSpace, so it can be blocked by SRP restrictions. Many such attacks can be prevented by SRP restrictions, but some would require non-default settings. The best prevention against ClickFix is FirewallHardening. The default &quot;Recommended H_C&quot; BlockList will block the malware delivery via LOLBins.</blockquote>

[QUOTE="Andy Ful, post: 1105156, member: 32260"] [B][SIZE=5]WHHLight vs. ClickFix attacks[/SIZE][/B] [URL unfurl="false"]https://malwaretips.com/threads/fake-google-meet-conference-errors-push-infostealing-malware.133286/post-1105071[/URL] [URL unfurl="false"]https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clickfix-deception-a-social-engineering-tactic-to-deploy-malware/[/URL] [URL unfurl="false"]https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/[/URL] Attack flow (example from McAfee): phishing email HTML attachment ---> ClickFix abusing Explorer ----> LOLBin (CMD, PowerShell) downloads HTA payload ----> HTA payload executed [ATTACH type="full" alt="1729343884206.png"]285851[/ATTACH] This attack is blocked by WHHLight default settings even without tools (FirewallHardening, ConfigureDefender, DocumentsAntiExploit). The payload is dropped into UserSpace, so it can be blocked by SRP restrictions. Many such attacks can be prevented by SRP restrictions, but some would require non-default settings. The best prevention against ClickFix is FirewallHardening. The default "Recommended H_C" BlockList will block the malware delivery via LOLBins. [/QUOTE]

Verification