Beyond the click: Click Fix Meets Steganography

What are Click FIX & Steganography?

Click FIX

Click Fixing is a social engineering attack that manipulates users into executing malicious scripts themselves.

It begins when a user lands on a malicious or compromised website that displays a fake CAPTCHA or human verification page. This page instructs the victim to complete three steps — exactly as shown in the images from sandbox analysis:

Press Windows + R
Press CTRL + V
Press Enter

These steps cause the victim to unknowingly execute a malicious command through the Windows Run dialogue, often invoking legitimate Windows utilities (LOLBins) such as mshta.exe. This enables attackers to deliver and run malware without dropping an obvious executable.

This technique has been rising rapidly and has now evolved through its combination with steganography.

Steganography

Steganography is the practice of hiding malicious content within an ordinary, non-secret file to evade detection. Attackers commonly use Least Significant Bit (LSB) steganography to embed malicious scripts inside seemingly normal images, such as PNG files.

When a victim opens or downloads the file, the malware hidden inside it is decoded and reconstructed – often without the victim having any idea anything is happening.

Figure 2. Example of malware embedded inside a PNG using Least Significant Bit (LSB) steganography. The attacker hides code inside an innocent-looking image and sends it to the victim, who unknowingly triggers the malware when opening the file. From [blog.httpcs.com]

How does the attack work?

Recent threat activity shows Click Fix campaigns increasingly using fake Windows security update screens. These screens mimic legitimate update messages, such as:

“Working on updates. Please do not turn off your computer.
Part 3 of 3: Check security.”

Victims are then instructed to run a command that triggers mshta.exe, for example:

This initiates the first stage of malware delivery.

The executed command fetches an image file from the attacker’s server. Although the file looks like a standard PNG, it contains an embedded malicious script using steganography.

A loader on the victim’s device decodes the hidden bytes from within the image and reconstructs a full malicious executable or payload – completing the entire infection chain.

This method has been observed in multiple malware families, including LummaC2, and recent research shows new variants embedding encrypted .NET assemblies inside PNG files, as reported by Huntress.

Risk & Impacts

A successful Click Fix malware attack can lead to:

Credential harvesting

Data exfiltration

C2 beaconing

Backdoor installation

Ransomware deployment

Because execution is initiated by the user via a trusted system utility, traditional defences are frequently bypassed.

Scalability

Click Fix campaigns are expanding rapidly.

According to InfosecurityMagazine, Click Fix social engineering attacks have surged by 517% in the past six months, now becoming the second most common vector behind phishing.

Exploitation

The threat relies on:

Lack of user awareness

High trust in system prompts

Abuse of legitimate Windows utilities (LOLBins)

Payloads hidden inside images to bypass detection

Together, these elements create a scalable and highly effective attack vector.

Remediation

User education

Educate users to recognise fake verification pages and understand that system updates or CAPTCHA checks never require using the Run dialogue or executing commands manually.

Email Filtering

Advanced filtering reduces the likelihood of phishing emails redirecting users to Click Fix-style malicious sites.

Web Protection

Actively monitor and block new IOC domains and prevent access to malicious URLs before users reach them.

Endpoint Detection & Response (EDR)

Ensure EDR is enabled and fully monitoring. Behavioural detection can identify misuse of LOLBins such as mshta.exe and PowerShell.

Group Policy Hardening

Disable the Run dialog for standard users

Implement strict PowerShell execution policies

Limit access to LOLBins where operationally possible

Monitoring

Continuously monitor legitimate OS processes for unusual behaviours such as:

mshta.exe initiating outbound connections

Unexpected image downloads

Decoding operations on image files

Suspicious PowerShell or .NET assembly loading

This level of telemetry is essential for detecting steganography-based loaders.

Stay ahead of emerging threats like Click Fix and Steganography.
If you’d like to understand your organisation’s exposure or need support strengthening your defences, our CREST-accredited SOC team is here to help. Get in touch with our experts today.

Our Sources: