CTI · reviewed · 2026-09-12

ClickFix Campaigns Targeting End Users via Legitimate Services

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1105 Ingress Tool Transfer Command and Control
• T1562 Impair Defenses Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ClickFix Campaign PowerShell Execution via Google Redirect Chains
id: b2c3d4e5-f6a7-8901-bcde-f12345678901
status: experimental
description: Detects ClickFix social engineering campaigns abusing Google redirect chains to execute malicious PowerShell or shell commands
references:
  - https://www.darkreading.com/
  - https://arstechnica.com/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1059
logsource:
  product: windows
  category: process_creation
detection:
  selection_powershell_from_browser:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'DownloadFile'
      - 'Net.WebClient'
  selection_cmd_from_browser:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
    Image|endswith:
      - '\cmd.exe'
    CommandLine|contains:
      - 'curl'
      - 'wget'
      - 'certutil'
      - 'bitsadmin'
  condition: selection_powershell_from_browser or selection_cmd_from_browser
falsepositives:
  - Legitimate browser-initiated script execution
level: medium

References

• https://www.darkreading.com/
• https://arstechnica.com/