Investigating a New Click-Fix Variant

Atos researchers identified a new ClickFix variant using WebDAV and a trojanized Electron app to deliver malware while evading EDR detection.

• •A phishing CAPTCHA page prompts users to run a net use command via Win+R, mounting a remote WebDAV share and executing a batch script.
• •The script downloads a trojanized WorkFlowy Electron app with malicious code injected into the app.asar archive's main.js.
• •Malicious code blocks legitimate app execution, beacons to C2 every 2 seconds with victim ID, hostname, and username, and can drop additional payloads.
• •This variant bypassed Microsoft Defender for Endpoint and was detected only through RunMRU registry key threat hunting.

This summary was automatically generated by AI based on the original article and may not be fully accurate.