ClickFix Spoof of “Word Online” Used to Spread DarkGate Malware

A recently identified social engineering campaign leverages a counterfeit "Word Online" extension error message to distribute DarkGate malware.

This campaign utilizes the "ClickFix" technique, which involves tricking users into executing malicious commands under the guise of legitimate troubleshooting steps, circumventing traditional security measures through user interaction.

The attack initiates with a deceptive message indicating that the "Word Online" extension is missing from the user's browser. Analysis of the HTML code reveals multiple segments of base64-encoded content integrated within the page structure. The attackers employ an advanced obfuscation method using a reverse function combined with nested Base64 encoding layers.

The fraudulent interface prompts users to click a "How to fix" button to view documents offline. This action triggers a multi-layered attack designed to deliver DarkGate malware to unsuspecting systems. The double-encoding method serves as a concealment strategy to evade detection by security scanners and complicate static analysis.

A malicious JavaScript snippet embedded at the end of the HTML page forms the attack's core. Upon decoding the initial Base64 value, an additional layer of Base64-encoded data is uncovered.

When users click the "How to fix" button, the script decodes a hidden PowerShell command and automatically copies it to the user's clipboard. The attack relies on social engineering, instructing users to press Windows+R to open the Run dialog and then CTRL+V to paste the clipboard contents.

The decoded PowerShell command connects to a compromised WordPress site at linktoxic34[.]com, downloading an HTA (HTML Application) file named "dark.hta" to the local path c:\users\public\nC.hta. The script then executes this file using Start-Process, launches the malicious payload, clears the clipboard to remove evidence, and terminates the PowerShell session to avoid detection.

Upon execution, the HTA file communicates with the attacker's infrastructure to retrieve a remote PowerShell script. This script creates directories on the C drive and deploys AutoIt executables and scripts that operate automatically. The AutoIt component continues the infection chain by creating additional directories, dropping files, and ultimately deploying a DOS file that serves as the final DarkGate payload.

Since users unknowingly initiate the malicious command, traditional antivirus solutions may not immediately detect the initial compromise. The rise of ClickFix attacks represents a concerning evolution in social engineering, exploiting user trust and familiarity with standard troubleshooting procedures to bypass technical security controls.

Infected systems may exhibit symptoms such as degraded performance, unexpected files or system settings changes, unauthorized browser toolbars or extensions, search redirections, excessive pop-up advertisements, and suspicious network traffic communicating with command-and-control servers.

Organizations should implement comprehensive security awareness training to recognize ClickFix-style social engineering tactics, deploy endpoint detection and response solutions capable of monitoring PowerShell and script execution, enforce application allowlisting to prevent unauthorized executables from running, and maintain updated security patches across all systems and browsers.

File Name SHA-256

HTML File 1533221ca97e88f5010b4a8b4d392232034dd07f154b13d4413c19693c0304c3

Dark.hta ca628638c20f6a67ac80782dc872e1e06b84cda68accf5e912ade6645c689f04

PS File 40be7be16cdaa414898db0014d26afd9cf516ba209f074a95c346227e690acd4

.Zip File fab36431b9760b48eb84d671e7c10e16e0754ec86517d665c10811cd0670e06b

AutoIt Script File 4f5f733c7ca71d514991ac3b369e34ce1c3744ff604c88481522edced14cc22c

Based on reporting by GBHackers.