Researchers tracked a real ClickFix-style social engineering campaign where victims are persuaded to paste and run a command that installs a fake “Spotify” Windows installer. The installer deploys a Node.js-based remote access trojan (ChainScript) that gives attackers interactive control, while hiding and rotating its command server by querying a Polygon blockchain smart contract.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You land on a site to install Spotify, and it tells you: “Paste this command to install.” That one step can hand over your PC. This ClickFix trick fires up msiexec, pulls down an installer dressed up as Spotify, Zoom, or Teams, then quietly spins up scripts and node.exe to drop a remote access tool called ChainScript. ChainScript even hides its command server by checking a Polygon blockchain smart contract before opening a WebSocket backchannel, so blocking a single domain won’t save you once it’s in. If any site tells you to copy and run a command to install Spotify, Zoom, or Teams, stop and call IT first, do nothing until they say it’s safe.
Researchers describe real-world “ClickFix” social-engineering lures that trick people into installing malware by downloading fake apps (like Spotify/Zoom/Teams) or copying commands into Terminal. One campaign abused a compromised, verified HBO Max Reddit account to run malicious ads, while another…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
South Korean agencies warned that a state-backed hacking group is actively targeting citizens and businesses using job-themed phishing emails and “watering hole” attacks on legitimate websites. The phishing lures include fake job applicants sending resume links and impersonated recruiters sending…
North Korea-linked BlueNoroff is using fake Zoom and Microsoft Teams meeting pages shared from hijacked trusted contacts (often via Telegram) to trick victims into “updating” Zoom/Teams and running malicious commands. The phishing kit also fingerprints the victim’s browser to identify installed…
This roundup describes several real-world social-engineering and human-abuse techniques, including trojanized “installer” lures (ClickFix), large-scale phone-based investment fraud, and stalkers misusing Chrome Sync after brief physical access. The items include clear workflows that can be turned…
Attackers are sending fake calendar meeting invites that can be automatically added to a victim’s calendar, even if the email is blocked. A documented example used a Google Calendar invite with a financial “invoice credit” lure to drive victims to a hosted webpage and download a malicious…
