Executive Summary
This report sheds light on a sophisticated malware campaign aimed at YouTube creators through spearphishing. The attackers exploit trusted brand names and professional collaboration offers to deliver malicious attachments. By employing the Clickflix technique for malware delivery, they further enhance their deception. The email subject lines and content are meticulously designed to mimic legitimate business opportunities, such as promotions, partnership proposals, and marketing collaborations.
While targeting YouTube creators is not a new tactic, as we have previously covered a similar campaign in this report, the use of the Clickflix technique represents a new advancement that requires further investigation.
Threat actors are using the Clickflix technique to target YouTube creators through phishing emails disguised as promotional materials, contracts, or business proposals. These emails contain malicious attachments, such as Word documents, PDFs, or Excel files, serving as the initial infection vector. The attack relies on social engineering, tricking victims into copying and pasting PowerShell scripts that execute malware on their systems. Once activated, the malware steals browser data, including login credentials, cookies, and wallets, or grants remote access to attackers. This campaign specifically exploits YouTube creators' interest in brand deals and partnerships to increase its effectiveness.
Overview:
CloudSEK's Threat Research team has uncovered a malware campaign in which threat actors impersonate popular brands Pictory and their professional collaboration offers as a disguise to distribute malware using clickflix technique. In the email below, the threat actor presents a brand collaboration proposal from the Pictory team (Video creation platform).
Once the user clicks on the payment form link, a Google document opens containing all the details for further process given.
Below the Google document ask to open a “Wire-transfer form” in Word file for a smooth payment process.
Interestingly Threat actor has created a fake Microsoft webpage that resembles Microsoft Word. The page also displayed an error message that said the “‘Word Online’ extension is not installed,” and presented two options to continue: “How to fix” and “Auto-fix”.
Clicking the “How to fix” button copied a base64-encoded PowerShell command to the computer’s clipboard, and the message on the page changed to instruct the target to open a PowerShell terminal and right-click the console window. Right-clicking a terminal window pasted the content of the clipboard and executed the PowerShell.
Analysis and Attribution:
While checking in source code of the webpage, scripts appear to be heavily obfuscated and designed to manipulate browser behavior, likely for malicious or deceptive purposes.
This malicious webpage includes user-agent-based detection and only executes when accessed from a PC or laptop.
Injecting content in Clipboard
The line from the clipboard contains a Base64-encoded PowerShell command that accesses the URL specified there and executes the page’s content. Inside this content is an obfuscated PowerShell script that ultimately downloads the malicious payload.
Script Breakdown & Analysis:
This PowerShell script appears to be a piece of malicious code designed to gather certain files and interact with remote servers to potentially execute harmful payloads. Here's a breakdown of what each part does:
DNS Flush: Clears the DNS cache to eliminate traces of prior malicious activity.
Scheduled Job Persistence: The script creates a scheduled job “fs3s3s8s” that runs indefinitely every minute, maintaining persistence.
Environment Access: This retrieves the path to the "Recent" folder, which typically stores recently accessed files. It then searches for files with a .normaldaki extension in that folder. These files could be malicious files or decoys used for further execution.
HTTP Requests: Fetches malicious content from remote servers for execution.
Base64 Decoding and Dynamic Code Execution: Executes Base64-encoded scripts, an obfuscation technique used in malware.
Dynamic Assembly Loading: The script dynamically loads and executes code in memory, avoiding detection by not writing to disk.
Command & Control:
The malware communicates with Command and Control (C2) servers to exfiltrate stolen data. Initially, it attempts to make a DNS request to flowers.what-is-game.xyz
After infecting a system, a stealer establishes communication with command and control (C2) servers to exfiltrate stolen data. It attempts to connect to C2 server domains using the ".xyz" top-level domain (TLD). Threat actors utilize Content Delivery Networks (CDNs) for payload distribution and C2 servers for data exfiltration.
DNS request to cdn.findfakesnake.xyz and Cat-watches-site.xyz 104.78.173.167
DNS request to Cdn.cart-newlocate.xyz
Process Tree:
Browser and Cookies:
Lumma stealer attempts to steal all browser data by targeting stored credentials, cookies, autofill information, and browsing history. It can extract saved passwords, session tokens, and other sensitive details from web browsers, allowing attackers to gain unauthorized access to accounts.
Mozilla-based applications:
The stealer collects user data from specific paths associated with various Mozilla-based applications, including Firefox, Thunderbird, and Pale Moon, along with lesser-known browsers like K-Meleon and Cyberfox. These data paths are usually located in the user's AppData folder under Roaming.
Chromium-based browsers:
Next, it retrieves data from specific paths associated with various Chromium-based browsers, such as Google Chrome, Opera, Brave, and alternatives like Vivaldi and Yandex. Additionally, it identifies directories related to gaming and other software, highlighting locations where user data may be stored locally.
Wallet and Authenticator Extensions:
Then, it extracts data from 280 cryptocurrency wallets if they are present on the system, targeting those included in a predefined list.
Hunting Threat Actor Infrastructure:
Our in-depth investigation into the threat actor's infrastructure revealed that a Google Drive account embedded with a malicious Clickflix URL for YouTube Authors' payments was linked to the email “[email protected].” We also noted that it was last updated on 18/02/2025.
During our OSINT investigation on “[email protected],” we discovered an interesting Google Maps review for Capri Motel, located at Okul Cad, Gökçedere, Mutlu Sk. 2/A, 77400 Termal/Yalova, Türkiye. The review was authored by someone using the name Aubree Chapman. This account could either belong to the threat actor or be a compromised account.
MITRE ATT&CK Tactics and Techniques:
Indicators of Compromise (IoCs):
Conclusion:
The Clickflix social engineering technique represents a highly deceptive method for malware delivery. By embedding base64-encoded scripts within seemingly legitimate error prompts, attackers manipulate users into unknowingly executing a series of actions that trigger malicious PowerShell commands. These commands typically download and execute payloads, such as HTA files, from remote servers, leading to the deployment of malware like Lumma Stealer.
Once the malware is active, it initiates various malicious operations, including stealing users' personal data and transmitting it to its command and control (C2) server. The attack chain often incorporates stealth and persistence mechanisms, such as clearing clipboard contents and running processes in the background to evade detection. By disguising harmful scripts as system alerts or troubleshooting messages, attackers effectively trick users into facilitating the execution of malware, resulting in system compromise.
Recommendations for Mitigating the Clickflix Malware Campaign
To protect against the Clickflix malware campaign, organizations and individuals should implement the following security measures:
1. User Awareness & Training
- Educate users, especially content creators and influencers, about social engineering tactics used in malware distribution.
- Encourage skepticism toward unsolicited emails or messages offering sponsorships, monetization opportunities, or software downloads.
- Provide security awareness training on identifying phishing links, suspicious attachments, and misleading pop-ups.
2. Email & Web Filtering
- Implement advanced email filtering solutions to detect and block phishing attempts containing malicious links or attachments.
- Use domain reputation analysis to prevent access to known malicious websites.
- Enable Safe Browsing features in browsers to warn users about harmful websites.
3. Endpoint Protection & Threat Detection
- Deploy next-generation antivirus (NGAV) and endpoint detection and response (EDR) solutions to identify and block suspicious script executions.
- Monitor for unusual PowerShell activities, especially commands related to Base64 decoding and remote payload execution.
- Configure application whitelisting to prevent unauthorized script execution.
4. Network Security Controls
- Implement web proxies and firewall rules to restrict access to domains associated with Clickflix campaigns.
- Enable network traffic monitoring to detect connections to known command and control (C2) infrastructure.
- Use DNS filtering to block requests to malicious sites that host malware payloads.
5. Incident Response & Threat Hunting
- Develop an incident response plan to handle potential infections caused by Clickflix-based attacks.
- Conduct regular security audits and forensic analysis on compromised systems to detect hidden malware.
- Use threat intelligence services to stay updated on new tactics, techniques, and procedures (TTPs) used by attackers.
6. Patch & System Hardening
- Keep operating systems, browsers, and security software updated to mitigate vulnerabilities that attackers exploit.
- Disable unnecessary PowerShell and Windows Script Host (WSH) features if not required for daily operations.
- Restrict the execution of macros and unsigned scripts to reduce the risk of script-based attacks.
By adopting a multi-layered security approach, organizations and individuals can significantly reduce the risk of falling victim to the Clickflix malware campaign.
References
- #Traffic Light Protocol - Wikipedia
- https://www.cloudsek.com/blog/how-threat-actors-exploit-brand-collaborations-to-target-popular-youtube-channels
Related Posts:
How Threat Actors Exploit Brand Collaborations to Target Popular YouTube Channels
Lumma Stealer Chronicles: PDF-themed Campaign Using Compromised Educational Institutions' Infrastructure