New ‘Point-and-Click’ Phishing Kit Evades Security Filters to Deliver Malicious Payloads

Impact Solutions is a newly developed toolkit that has surfaced on cybercrime platforms, providing a comprehensive framework for executing sophisticated phishing campaigns. This toolkit facilitates malware delivery, allowing even inexperienced threat actors to bypass security filters and deliver malicious payloads through seemingly benign attachments.

The following details the functionality of Impact Solutions, the social engineering tactics it supports, and the defensive measures organizations can implement to combat these threats effectively.

Impact Solutions is marketed as a comprehensive payload delivery platform that automates the creation of weaponized files. Its user-friendly interface enables attackers to generate various malicious attachments without requiring coding skills. Key modules include:

Windows shortcut (.lnk) attachments disguised as legitimate documents Self-contained HTML files for HTML smuggling attacks Malicious SVG images with embedded scripts Payloads utilizing the Windows "Win+R" (Clickfix) Run dialog trick

The .lnk builder is notably advanced, allowing attackers to select a decoy file, such as a PDF invoice, displayed as an icon while secretly linking to an executable payload. Upon activation, the toolkit stealthily launches the downloader in the background while presenting the genuine PDF, thereby concealing the malware installation from victims.

Additional features include staged payloads that fetch secondary malware from remote servers and techniques to bypass User Account Control (UAC) prompts, detect virtual machines, and evade sandbox analysis. Impact Solutions claims compatibility with Microsoft SmartScreen and most antivirus engines, without needing code-signing certificates.

Impact Solutions excels in social engineering capabilities. Email templates are crafted around common business themes such as unpaid invoices, purchase orders, or cloud service notifications, targeting human trust rather than software vulnerabilities.

For example, a recipient may receive an "Invoice12345.pdf" attachment that is actually a .lnk file. When opened, it quietly executes a command to download malware into the user's AppData folder while displaying a dummy invoice document to maintain the appearance of legitimacy.

Multi-stage HTML attacks are also supported. Attackers can email a "secure invoice viewer" HTML file prompting victims to click a button to view their invoice. This action launches a payload via a file:// path or instructs users to enable browser settings, initiating malware execution under the guise of a routine permission request.

Another scenario involves spoofing the familiar Cloudflare "Checking your browser" screen, instructing users to press Win+R and paste a code. In reality, a Base64-encoded PowerShell command is copied to the clipboard, executing once pasted.

Traditional signature-based defenses are becoming less effective against kits like Impact Solutions, which continually adapt payloads and utilize icon spoofing and sandbox evasion. Behavioral AI platforms, which detect anomalies in communication patterns and context, offer an alternative approach.

For instance, Abnormal Security’s AI engine learns an organization’s typical email behavior—sender relationships, writing style, and attachment types—and flags deviations that suggest a social engineering attack. An unexpected influx of "invoice" attachments from a new sender or unusual requests to execute files via Win+R can trigger automated quarantines before harmful payloads reach employees.

As phishing kits become more accessible and advanced, organizations must transition from reactive signature updates to proactive behavioral analytics. Understanding the human-centered tactics involved and deploying adaptive AI solutions can help security teams block campaigns like Impact Solutions and protect users from evolving threats.

Based on reporting by GBHackers.