How this ClickFix campaign leads to Redline Stealer

Executive Summary

Okta Threat Intelligence has observed an evolving cyber threat that leverages deceptive CAPTCHA pages to distribute a range of malicious payloads.

These campaigns, often referred to as a "ClickFix" or "Prove You Are Human" campaign, exploit user trust and problem-solving instincts to bypass conventional security measures.

ClickFix attacks typically begin with malvertising (users tricked into clicking paid search results) or links in phishing emails, either of which redirects a user to websites that impersonate well-known brands.

The attacks attempt to manipulate users into executing malicious commands by imitating legitimate security checks. A user that executes these commands enables system compromise, data theft and delivery of malware to the end user’s device.

Okta Threat Intelligence identified and analyzed a ClickFix campaign targeting Okta brands that leverages deceptive CAPTCHA verification pages. Okta has submitted takedown requests, where appropriate, and reported other suspicious domains (see Indicators of Compromise in Appendix A) to various third party reputation services.

The primary objective of ClickFix campaigns is to deliver one of several credential-stealing malware and Remote Access Trojans (RATs). These malware families are designed to harvest sensitive information, including credentials, web data, and cryptocurrency wallet details saved to a user device, enabling financial fraud and unauthorized access to compromised systems.

Okta Threat Intelligence assesses that the diversity of malware families being deployed by ClickFix phishing sites indicates that these campaigns are part of a “Crime-As-A-Service” (CaaS) ecosystem. In these markets, attackers pay a third party service to deliver their choice of malware to victims (each victim referred to as a “load”), rather than the service acting exclusively for a specific malware “gang” that deploys a single malware variant.

The evolving sophistication of these attacks, including their promotion on underground forums and the re-use of malicious infrastructure, highlights the need for heightened user awareness and an ability to respond quickly to compromised devices.

Threat Analysis

Social Engineering for Initial Access

ClickFix campaigns rely on human interaction to bypass automated security measures. The attack chain typically unfolds through several distinct stages:

The compromise often begins with malicious search engine advertisements that lure unsuspecting users.

For example, a search query for a tool or an organization's HR portal might display a sponsored ad leading to a malicious site.

Threat Response

What we’re doing
We’re actively engaged in the following activities to mitigate this threat:

• Continuously monitoring for newly registered phishing domains and infrastructure associated with ClickFix campaigns that imitate Okta brands.
• Proactively filing abuse reports with relevant registrars and hosting providers to initiate takedown requests for identified malicious sites.
• Providing guidance and assistance to organizations to enhance the security of their Okta environments and investigate any suspicious activity related to potentially compromised accounts.

Protective Controls

Recommendations for customers

• Restrict access to sensitive applications to devices that are managed by Endpoint Management tools and protected by endpoint security tools. We also recommend assessing the range of additional hygiene detections available for MacOS devices using Okta Advanced Posture Checks (currently in Early Access). For access to less sensitive applications, require registered devices (using Okta FastPass) that exhibit indicators of basic hygiene.
• Implement perimeter detection controls (email and web filtering) that prevent user access to known malicious sites.
• Windows administrators should consider allowlisting the execution of trusted, digitally-signed PowerShell scripts on end user devices and deny all others.
• If using an isolated/managed browser solution, explore the viability of restricting the copy and paste of content from the browser to specific applications (such as the clipboard or command line tools).
• Enrol users in phishing resistant authenticators and enforce phishing resistance in policy. Okta authentication policies can also be used to restrict access to user accounts based on a range of customer- configurable prerequisites. Deny or require higher assurance for requestsfrom rarely-used networks or when requests to access applications deviates from previously established patterns of user activity.
• Train users to identify indicators of suspicious emails, phishing sites and common social engineering techniques such as ClickFix attacks. Ensure they understand what is expected from CAPTCHA responses or browser updates, and to be wary of messages instructing them to perform unusual manual steps using system tools (Terminal, PowerShell etc). Make it easy for users to report potential issues by configuring End User Notifications and Suspicious Activity Reporting.

Observing and responding to phishing infrastructure:

• Review application logs (Okta logs, web proxies, email systems, DNS servers, firewalls) for any evidence of communication with any such suspicious domains.
• Monitor the domains regularly to see if the contents change.
• If content hosted on the domain violates copyright or legal marks, consider providing evidence and issuing a takedown request with the domain registrar and/or web hosting provider.

Appendix A: Indicators of Compromise

This is an ongoing investigation, and additional IOCs may be identified as the campaign evolves. Organizations are advised to remain vigilant and implement the recommended mitigation strategies. Below are the IOCs observed.