New ClickFix Phishing Campaign Deploys Havoc Framework via PowerShell

Overview

A newly discovered ClickFix phishing campaign is tricking users into executing malicious PowerShell commands that deploy the Havoc post-exploitation framework for remote access. Researchers from Fortinet’s Fortiguard Labs identified the attack, which abuses Microsoft cloud services, including SharePoint and Graph API, to evade detection and blend into legitimate traffic.

ClickFix attacks use fake error messages to convince victims to manually copy and execute malicious PowerShell commands, leading to system compromise and lateral movement within corporate networks.

How the ClickFix Attack Works

1️⃣ Phishing Email & Fake Error Message

• Victims receive a phishing email with an HTML attachment (‘Documents.html’).
• Opening the file displays a fake OneDrive error (0x8004de86).

• Users are prompted to fix the issue by copying a PowerShell command into their clipboard.

Phishing attachment displaying fix instructions
Source: BleepingComputer

2️⃣ Malicious PowerShell Execution

• The PowerShell script retrieves another script from the attacker’s SharePoint server.

• Sandbox Evasion: The script checks for a sandbox environment before execution.
• Registry Modification: A flag is added to the registry, marking that the script was executed.
• Python Deployment: If Python is missing, the script installs it to execute additional payloads.

3️⃣ Deployment of the Havoc C2 Framework

• A Python script is downloaded and executed to deploy Havoc as an injected DLL.
• Havoc is a post-exploitation framework similar to Cobalt Strike, used for remote control, privilege escalation, and lateral movement.
• Graph API Evasion: Communication between the infected device and the attacker’s C2 infrastructure is routed through Microsoft Graph API, disguising malicious traffic as legitimate cloud activity.