When AI Becomes the Bait, Inovasys Becomes the Barrier

What appears to be a legitimate installation step can quickly lead to credential theft, browser session compromise, sensitive document collection, and business data exfiltration.

At Inovasys, emerging threats like this become more than intelligence reports. By analyzing every stage of the campaign, we turn real-world attacker behavior into stronger detection and protection mechanisms for our clients.

How the ClickFix Attack Worked

The attack began when users searching for AI software were directed to fake installation pages through sponsored advertisements or manipulated search results.

Victims were instructed to copy and run a PowerShell command that appeared to be part of the installation process. Once executed, the command used trusted Windows utilities such as PowerShell and MSHTA to retrieve and launch malicious content.

The attack was designed to:

 - Execute malicious payloads through PowerShell and MSHTA.
 - Hide malicious HTA code inside MP3 content.
 - Decode and execute payloads directly in memory.
 - Create short-lived scheduled tasks.
 - Steal browser credentials and authentication data.
 - Search local and synchronized business directories.
 - Collect and exfiltrate sensitive documents.

By using native Windows components and minimizing files written to disk, the attackers made the activity appear similar to legitimate installation or administrative behavior.

How Inovasys Turns This Threat Into Protection

At Inovasys, the ClickFix campaign has been integrated into our Threat Detection and Response framework.

Our monitoring and defense mechanisms now cover the main behaviors associated with this attack, including:

- Detection of suspicious PowerShell commands
- Identification of MSHTA executing remote content
- Recognition of encoded and obfuscated execution
- Monitoring of unusual scheduled task creation
- Detection of browser credential access attempts
- Alerting on repeated access to sensitive files
- Identification of possible data exfiltration activity

Threat hunting was also conducted using the identified indicators of compromise, with no related activity detected within the available client logs.

By mapping these techniques into our security controls, we help protect clients not only from this specific campaign, but also from future attacks that use similar methods.

Your Security, Strengthened With Every Threat

Every emerging attack strengthens the Inovasys defense stack.
Every campaign we analyze becomes another protection layer for our clients.

Cybersecurity is continuous, intelligence-driven, and built to evolve. With Inovasys, your organization gains a cybersecurity partner that transforms global threats into proactive protection across your Digital Transformation Ecosystem.