Lazarus APT Hackers Using ClickFix Technique to Steal Sensitive Intelligence Data

Cybersecurity: Advanced Persistent Threat Analysis

The Lazarus APT group has employed the ClickFix social engineering technique to enhance its malware distribution methodology. This approach is used to exfiltrate sensitive intelligence data from targeted organizations. The group, identified as APT-Q-1 by security researchers, integrates deceptive user interface manipulation with traditional espionage tactics.

ClickFix Technique Overview

The ClickFix technique involves presenting victims with fake technical issues, guiding them through “fixes” that actually execute malicious code. This method has been integrated into existing fake recruitment campaigns, creating a complex attack vector that combines job opportunity lures with technical deception.

Attack Vector

Security analysts identified the campaign through a malicious batch script that downloads disguised NVIDIA software, deploying the group’s BeaverTail information stealer. The attack initiates when victims visit fraudulent interview websites, which prompt them to resolve fake camera configuration issues.

A PowerShell command downloads and extracts a malicious ZIP archive, initiating the infection. The group targets both Windows and macOS platforms, with tailored payloads for different architectures.

Malware Deployment and Persistence Mechanisms

The core malware package, distributed as “nvidiaRelease[.]zip” (MD5: f9e18687a38e968811b93351e9fca089), is designed for cross-platform compatibility and persistent access.

The initial script executes a sequence to download and expand the archive, deploying a script that performs system reconnaissance. On Windows 11 systems, an additional backdoor is executed, enabling command execution and file manipulation. This component communicates with command-and-control servers, allowing remote operations.

Core Malware Components

The malware achieves persistence through registry modification, ensuring execution across system reboots. The BeaverTail component communicates with a secondary command-and-control server, supporting redundant capabilities for sustained access.