ClickFix Lure Pushes Trojan Zoom/WebEx Installers

How the Attack Worked

Cisco Talos tracked a financially motivated, Russian-speaking group identified as UAT-11795, active since at least June of last year. The group's initial access method relies on a ClickFix social engineering technique: a webpage entices the user to copy and run a command to "fix" an issue. That command stealthily downloads and executes a remotely hosted weaponized HTA file, which runs an embedded VBScript that drops a batch file into the user's application temporary folder.

From there, the infection chain proceeds to install trojanized installers for legitimate, trusted software such as Zoom, WebEx, MobaXterm, DBeaver, and FaceIT. These fake installers are staged on attacker-controlled domains. Once installed, the campaign deploys previously undocumented tools, including a remote access trojan and a PowerShell-based in-memory implant, to steal credentials, browser data, and cryptocurrency wallet assets. Talos also noted an unusual fallback command-and-control method using a Polygon smart contract, reflecting a high level of sophistication.

Why It Succeeded

The attack succeeds by exploiting trust in everyday workflows. Employees are conditioned to follow on-screen instructions to resolve technical issues, and a prompt to run a command to "fix" a problem does not always register as suspicious. Similarly, requests to reinstall or update common conferencing and remote-access tools like Zoom or WebEx can seem routine, especially for remote and hybrid workers who rely on these tools daily. The use of legitimate, well-known software names as cover makes the trojanized installers more convincing, and reliance on the fact that an installer is signed can create false confidence that it is safe.

What to Watch For

• Any webpage asking a user to copy and paste a command to run on their computer
• Instructions to execute scripts or commands that download files from the internet
• No clear verification that an instruction is coming from the organization's actual IT team
• Software installers sourced from anywhere other than the official vendor site or approved company portal
• Unexpected prompts to reinstall or update conferencing or remote-access tools

Building Resistance

Organizations should train staff to treat any copy/paste command request from a website as high risk and to verify such requests through known IT channels before acting. Software installation should be restricted to approved sources, such as a company software portal or vetted vendor sites, with clear guidance to verify download origin when in doubt. Security teams should also avoid treating a signed installer as automatic proof of safety, and should be able to answer where a given binary came from as readily as whether a known vulnerability has been patched. Techniques referenced include T1204.001, T1204.002, and T1656.

What is the ClickFix social engineering technique?

ClickFix entices a user to execute a command shown on a webpage in order to fix a supposed problem, but running it stealthily downloads and executes a weaponized HTA file that begins the infection chain.

Which legitimate software was trojanized in this campaign?

The attackers used trojanized installers for well known tools including Zoom, WebEx, MobaXterm, DBeaver, and FaceIT to steal credentials and cryptocurrency.

Who is behind this campaign?

Cisco Talos tracked a Russian-speaking, financially motivated actor identified as UAT-11795, active since at least June of last year.

Does a signed installer mean the software is safe?

No. Researchers noted that users should not assume a signed installer means a program is safe, since trojanized installers were used to deliver malware in this campaign.