I think I have a nice compromise #ClickFix ...fix for those places that just can't live without some Explorer niceties.

There is an alternative to the "Disable Windows shortcuts" GPO, which not only disables Win+ shortcuts, but also things like using UNC paths in the Explorer address bar.

Of course, Geoff Chappell lights the way.

I believe that GPO applies the REST_NORUN reg key and not REST_NOWINKEYS policies—despite the name.

If I apply the REST_NORUN reg setting directly, I get the same behavior as the GPO. The popup pictured here appears.

But if I instead set the REST_NOWINKEYS dialog, the Win+R shortcut is disabled, but other stuff (like UNC paths in explorer) still works! Now, this doesn't remove the Run command from the start menu, but it is at least a safety. Oh and one more thing: because that shortcut is now unregistered, you can register it yourself for something like a lil daemon that pops a message box saying Hey did a website tell you to do this? Don't!

You can try both settings.

REST_NORUN: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun

REST_NOWINKEYS: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoWinKeys

UPDATE: You can additionally disable only Win+R by setting HKEY_CURRENT_USER\SOFTWARE\Microsoft\CurrentVersion\Explorer\Advanced\DisabledHotkeys to a String value containing the Win shortcuts you want to disable. So a single R will do the trick. Note this only works at the user level.

Hackers now testing #ClickFix attacks against #Linux targets

https://www.bleepingcomputer.com/news/security/hackers-now-testing-clickfix-attacks-against-linux-targets/

New ClickFix campaign alert! This evolving cyberattack now targets both Windows & Linux users by tricking them into running malicious console commands under the guise of “browser updates” or CAPTCHA tests. Currently harmless but watch out! Threat actor: APT36 (Pakistan). Stay safe & informed! #CyberSecurity #ClickFix #Linux #Windows #APT36 #InfoSec #TechRadar #newz

Read more: https://www.techradar.com/pro/security/new-clickfix-campaign-spotted-hitting-both-windows-and-linux-machines

New ClickFix Attacks Target Linux: A Shift in Cyber Threat Landscape

In a surprising twist, hackers are now adapting ClickFix attacks to target Linux systems, previously dominated by Windows vulnerabilities. This development highlights the evolving tactics of cybercrim...

https://news.lavx.hu/article/new-clickfix-attacks-target-linux-a-shift-in-cyber-threat-landscape

New ClickFix Attacks Target Linux: A Shift in Cyber Threat Landscape

In a surprising twist, hackers are now adapting ClickFix attacks to target Linux systems, previously dominated by Windows vulnerabilities. This development highlights the evolving tactics of cybercrim...

https://news.lavx.hu/article/new-clickfix-attacks-target-linux-a-shift-in-cyber-threat-landscape

iClicker Hack: A Cautionary Tale of ClickFix Malware Targeting Students

In a concerning breach, the iClicker platform was compromised by a ClickFix attack, leading to a sophisticated malware distribution scheme targeting students and educators. This incident highlights th...

https://news.lavx.hu/article/iclicker-hack-a-cautionary-tale-of-clickfix-malware-targeting-students

FWIW, 100% of #ClickFix attacks I've seen have added some kind of inline comment at the end of the command string like I am not a robot to sell the ruse. Definitely worth a threat hunt on command line history.

2025-04-22 (Tuesday): Always fun to find the fake CAPTCHA pages with the #ClickFix style instructions trying to convince viewers to infect their computers with malware.

Saw #StealC from an infection today.

Indicators available at https://github.com/malware-traffic/indicators/blob/main/2025-04-22-IOCs-for-ClickFix-style-campaign-leading-to-StealC-infection.txt

State-sponsored hackers embrace #ClickFix #SocialEngineering tactic

https://www.bleepingcomputer.com/news/security/state-sponsored-hackers-embrace-clickfix-social-engineering-tactic/

North Korea, Iran, and Russia-backed hackers are using a social engineering trick called ClickFix to run malicious code on victims’ machines.

Read: https://hackread.com/north-korea-iran-russia-hackers-clickfix-attacks/

This #threatintel research published by Proofpoint is really good. In-depth article including dozens of TTPs and IOCs related to the use of the #ClickFix social engineering technique for system compromise. Lots of detection and prevention opportunities here.
#cybersecurity

From: @threatinsight
https://infosec.exchange/@threatinsight/114355487219374694

#Interlock #ransomware gang pushes fake #IT tools in #ClickFix attacks

https://www.bleepingcomputer.com/news/security/interlock-ransomware-gang-pushes-fake-it-tools-in-clickfix-attacks/

Interlock Ransomware Gang Innovates with ClickFix Attacks: A New Threat Landscape

The Interlock ransomware gang has escalated its tactics by employing ClickFix attacks, leveraging social engineering to deceive users into executing malicious PowerShell commands. This method not only...

https://news.lavx.hu/article/interlock-ransomware-gang-innovates-with-clickfix-attacks-a-new-threat-landscape

New #ClickFix scam targets US users with fake MS Defender and CloudFlare pages.
The scam page is hosted on a domain registered back in 2006, pretending to be the Indo-American Chamber of Commerce.
The #phishing page loads only for US-based victims, as observed during analysis with a residential IP in #ANYRUN Sandbox.

Analysis session: https://app.any.run/browses/50395c46-41f5-4bb3-8205-61262ef4e63d/?utm_source=mastodon&utm_medium=article&utm_campaign=clickfix_scam&utm_term=160425&utm_content=linktoservice

URL: iaccindia[.]com
The page hijacks the full-screen mode and displays a fake “Windows Defender Security Center” popup.

It mimics the Windows UI, locks the screen, and displays urgent messages to panic the user.

Victims are prompted to call a fake tech support number (+1-…), setting the stage for further exploitation.

The phishing page may also display a fake CloudFlare message tricking users to execute a #malicious Run command.
Take a look: https://app.any.run/tasks/e83a5861-6006-4b1d-aba8-8536dcaa8057/?utm_source=mastodon&utm_medium=article&utm_campaign=clickfix_scam&utm_term=160425&utm_content=linktoservice

#IOCs:
supermedicalhospital[.]com
adflowtube[.]com
knowhouze[.]com
ecomicrolab[.]com
javascripterhub[.]com
virtual[.]urban-orthodontics[.]com

Streamline threat analysis for your SOC with #ANYRUN
#ExploreWithANYRUN

Since the apparition of the #Interlock ransomware, the Sekoia #TDR team observed its operators evolving, improving their toolset (#LummaStealer and #BerserkStealer), and leveraging new techniques such as #ClickFix to deploy the ransomware payload.

https://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/

North Korean hackers adopt #ClickFix attacks to target #crypto firms

https://www.bleepingcomputer.com/news/security/north-korean-hackers-adopt-clickfix-attacks-to-target-crypto-firms/

Bingo! Lots of modern techniques were tapped in this Unit 42 Timely threat intel repo:

• Adware affiliates on South African TLD .za, routing to a CrimeFlare TDS with short-lived URL params
• After expiration, they appear as benign "blogs"
• MSI files are different for each download
• MSI files do not work outside the infection chain
• MSI download pages are all .com and while odd they are readable word combinations.
• Win+R ClickFix technique, but in this case they are loading curl which in PS5 is an alias of Invoke-WebRequest. This can be seen with gal -Definition Invoke-WebRequest wget is also an alias and were removed in v7.

https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/ef284c86b45e329415e45bb2c38cc5c628bbbd49/2025-03-31-IOCs-for-evasive-campaign-pushing-Legion-Loader.txt

ClickFix and malware seem to prefer PowerShell aliases: iwr iex for obfuscation, so I thought why not simply disable and turn them into canaries.

Of course impact is highly org and user dependent, but since it's deployed per user+host profile, we can easily apply it to the primary, non-privileged or service identity.

And yes, still disable Win+R, Win+X, log and get control on EPs. If you're already hunting iwr, you hopefully know where they run as current user.

TDR analysts published an analysis of the new #ClearFake variant that relies on compromised websites injected with the malicious JavaScript framework, the #EtherHiding technique, and the #ClickFix social engineering tactic.

https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/