Unmasking ClickFix Attacks: A Deep Dive into the ClickGrab Threat Intelligence Platform

By /

Listen to this Post

Featured Image

Introduction:

The cybersecurity landscape is perpetually evolving, with adversaries constantly refining their tradecraft. ClickFix attacks represent a sophisticated threat vector, leveraging user interaction to deploy malicious payloads. The ClickGrab project provides an automated, open-source intelligence platform that captures and analyzes these attacks in near real-time, offering defenders unparalleled insight into the tools, techniques, and procedures (TTPs) used by threat actors.

Learning Objectives:

  • Understand the components and data flow of the ClickGrab threat intelligence collection platform.
  • Learn to analyze captured artifacts, including binaries, scripts, and IOCs, using provided tools and manual techniques.
  • Implement defensive measures and hunting queries based on the latest ClickFix attack TTPs.

You Should Know:

1. Accessing and Parsing ClickGrab JSON Reports

The nightly JSON reports are a treasure trove of IOCs. You can use command-line tools to quickly parse and extract data for analysis.
`curl -s https://raw.githubusercontent.com/MHaggis/ClickGrab/main/nightly_reports/clickgrab_report_2025-09-04.json | jq ‘.artifacts[] | .sha256’`

Step-by-step guide:

  1. The `curl -s` command silently fetches the latest JSON report from the public GitHub repository.
  2. The output is piped `|` to jq, a powerful JSON processor.
  3. The jq filter `.artifacts[] | .sha256` iterates through all objects in the “artifacts” array and extracts the “sha256” hash value for each.
  4. This output can be redirected to a file (> iocs.txt) for use in block lists or threat intelligence platforms.

2. Querying for Downloaded Payloads

Attackers often drop secondary payloads. The reports detail these files.
`jq ‘.artifacts[] | select(.type == “downloaded_file”) | .file_path’ report.json`

Step-by-step guide:

  1. After downloading a report, use `jq` to parse the local file report.json.
  2. The `select(.type == “downloaded_file”)` function filters the artifacts array to only show objects where the “type” key matches “downloaded_file”.
  3. For each matching object, the `.file_path` value is extracted, showing where on the disk the malicious file was placed.

3. Extracting Network Indicators

Quickly build a network block list from the captured data.

`jq ‘.network_activity[] | .destination_ip’ report.json | sort -u`

Step-by-step guide:

  1. This `jq` command accesses the “network_activity” array in the report.
  2. It extracts every “destination_ip” value, which represents the IP addresses with which the malware communicated.
  3. The `sort -u` command sorts the list of IPs and removes duplicates (-u for unique), providing a clean list for firewall rules.

4. Analyzing Process Execution Chains

Understanding the process tree is key to identifying parent-spawned malicious activity.

`jq ‘.processes[] | {parent: .parent_name, command: .command_line}’ report.json`

Step-by-step guide:

  1. This command extracts data from the “processes” array.
  2. For each process, it creates a new JSON object `{}` containing two key-value pairs: the “parent_name” (renamed to “parent”) and the “command_line” (renamed to “command”).
  3. This output helps analysts visualize the execution chain, e.g., seeing that `mshta.exe` was launched by `explorer.exe` to run a malicious script.

5. Windows Hunting with PowerShell

Use the extracted IOCs to hunt for related activity across your enterprise network.
`Get-CimInstance -ClassName Win32_Process -Filter “Name LIKE ‘%wscript%'” | Select-Object Name, CommandLine, ProcessId`

Step-by-step guide:

  1. This PowerShell command queries Windows Management Instrumentation (WMI) for process information.
    2. `Get-CimInstance` is used to retrieve instances of the `Win32_Process` class.
  2. The `-Filter` parameter narrows the results to processes where the name is like “wscript” (a common LOLBin for script execution).
  3. The results are piped to `Select-Object` to display the name, full command line, and process ID, helping to identify suspicious script execution.

6. Linux Hunting with grep

Check for suspicious command-line arguments on Linux endpoints.

`ps aux | grep -E “(curl.-o|wget.-O)”`

Step-by-step guide:

  1. The `ps aux` command lists all running processes on a Linux system.
  2. The output is piped to `grep` to search for patterns.

3. The `-E` flag enables extended regular expressions.

  1. The pattern `(curl.-o|wget.-O)` will match any process that is either `curl` with the `-o` (output) flag or `wget` with the `-O` (output document) flag, which are common in one-liner downloaders used by attackers.

7. YARA Rule for Detection

Create a simple YARA rule to detect malware based on patterns in the ClickGrab reports.

rule Suspicious_JS_Dropper {
meta:
author = "Defender"
description = "Detects JavaScript likely acting as a dropper"
strings:
$a = "new ActiveXObject"
$b = "cmd.exe"
$c = /https?:\/\/[^\s"]+.exe/
condition:
all of them and filesize < 200KB
}

Step-by-step guide:

  1. This YARA rule is saved to a file (e.g., js_dropper.yar).
  2. The `strings` section defines patterns to look for: the use of ActiveX, invocation of cmd.exe, and a URL ending in .exe within the text.
  3. The `condition` requires that all strings are present and that the file is smaller than 200KB to avoid false positives on large libraries.
  4. Use the YARA tool to scan files: yara js_dropper.yar file_to_scan.js.

What Undercode Say:

  • The automation and public availability of tools like ClickGrab significantly lower the barrier to entry for high-fidelity threat intelligence, democratizing security research.
  • Defenders must shift from reactive blocking to proactive hunting, using the behavioral data provided by these reports to anticipate adversary moves.

Analysis: The ClickGrab project exemplifies the power of open-source intelligence (OSINT) in modern cybersecurity. By systematically capturing and dissecting ClickFix attacks, it provides a continuous stream of actionable data that is otherwise difficult to obtain. This approach moves beyond static IOC sharing and into the realm of behavioral analysis, revealing not just what the malware is, but how it operates. For security teams, the imperative is to integrate this flow of intelligence into their SIEM, EDR, and threat-hunting workflows. The provided commands and code snippets are the first step in operationalizing this data, transforming raw JSON reports into enhanced visibility and stronger defensive postures across both Windows and Linux environments.

Prediction:

The public dissection of ClickFix TTPs will force adversaries to innovate rapidly, leading to an increase in fileless techniques, more sophisticated living-off-the-land bin (LOLBin) abuse, and greater use of encryption for C2 communications. However, the defensive community’s ability to automate analysis and share findings will also accelerate. We predict a rise in AI-powered analysis tools that can automatically correlate data from platforms like ClickGrab with telemetry from EDRs to generate predictive attack graphs, enabling preemptive mitigation before large-scale campaigns can launch.

🎯Let’s Practice For Free:

IT/Security Reporter URL:

Reported By: Michaelahaag Clickgrabnightlyreportsclickgrabreport – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: