{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "The iClickFix framework has compromised over 3,800 WordPress sites and uses a novel YOURLS-based TDS to evade detection; identifying these redirections early prevents the critical NetSupport RAT payload from executing." }, "name": "iClickFix Web Redirection and Delivery", "type": "investigation", "labels": [ "hunt", "attack.t1566", "attack.t1059.001", "attack.t1090.003" ], "series": { "slug": "iclickfix-wordpress-targeting-framework-using-clickfix", "index": 1, "title": "iClickFix: WordPress-targeting framework using ClickFix", "total": 2 }, "related": [ { "hunt": "iclickfix-powershell-payload-execution", "reason": "This hunt identifies the web-based redirection; a subsequent hunt focuses on the PowerShell command execution and RAT deployment.", "relation": "follows" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A static domain blocklist is insufficient for an ephemeral TDS. This hunt correlates rare domain lookups (baseline role) with specific URI patterns and JSON-formatted exfiltration queries across two different telemetry surfaces (DNS and HTTP), something a single rule cannot perform without significant noise.", "coverage": [ { "stage": "compromised-wordpress-injection", "steps": [ "wordpress-inventory-scoping", "rare-tds-dns-lookups" ], "status": "covered" }, { "stage": "tds-redirection-and-payload-delivery", "steps": [ "payload-script-http-activity", "rare-tds-dns-lookups" ], "status": "covered" }, { "stage": "clickfix-clipboard-social-engineering", "reason": "Handled in the follow-on hunt focusing on the PowerShell dropper and clipboard interaction.", "status": "out_of_scope" }, { "stage": "powershell-payload-execution", "reason": "Requires hb_process_activity and hb_script_activity; out of scope for the web delivery phase.", "status": "out_of_scope" }, { "stage": "rat-persistence-and-dropper-cleanup", "reason": "Belongs to the infection aftermath hunt.", "status": "out_of_scope" }, { "stage": "netsupport-rat-c2-and-data-theft", "reason": "Involves specific RAT C2 traffic patterns handled in a separate network hunt.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Malicious JavaScript Injection", "slug": "compromised-wordpress-injection", "tactic": "initial-access", "techniques": [ "T1566" ], "observables": [ "ic-tracker-js", "ksfldfklskdmbxcvb.com", "ahpc.gov.gh", "dns-prefetch" ] }, { "name": "TDS Redirection and Script Fetching", "slug": "tds-redirection-and-payload-delivery", "tactic": "execution", "techniques": [ "T1566" ], "observables": [ "ototaikfffkf.com/fffa.js", "ksdkgsdkgkgmgm.pro/ofofo.js", "booksbypatriciaschultz.com/liner.php", "x-robots-tag: noindex", "YOURLS admin panel" ] }, { "name": "ClickFix Clipboard Social Engineering", "slug": "clickfix-clipboard-social-engineering", "tactic": "collection", "techniques": [ "T1115" ], "observables": [ "navigator.clipboard.writeText", "Verify you are human", "Ctrl + V", "Win + R", "Unusual Web Traffic Detected" ] }, { "name": "Malicious PowerShell Downloader", "slug": "powershell-payload-execution", "tactic": "execution", "techniques": [ "T1059.001" ], "observables": [ "powershell -w hidden -nop -c", "scottvmorton.com/tytuy.json", "05b03a25e10535c5c8e2327ee800ff5894f5dbfaf72e3fdcd9901def6f072c6d", "8db6.ps1" ] }, { "name": "NetSupport RAT Persistence and Evasion", "slug": "rat-persistence-and-dropper-cleanup", "tactic": "persistence", "techniques": [ "T1555" ], "observables": [ "ProgramData\\S1kCMNfZi3\\", "client32.exe", "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", "SecureModule Engine v1.0.0", "RunMRU" ] }, { "name": "Command and Control and Data Theft", "slug": "netsupport-rat-c2-and-data-theft", "tactic": "command-and-control", "techniques": [ "T1041", "T1090.003", "T1021.001", "T1555" ], "observables": [ "pusykakimao.com:443", "fnotusykakimao.com:443", "/fakeurl.htm", "client32.ini", "licensee KAKAN" ] } ], "summary": "IClickFix is a WordPress-targeting framework that compromises legitimate sites to inject malicious JavaScript and redirect users through a YOURLS-based Traffic Distribution System. Victims are tricked by a ClickFix-style fake CAPTCHA lure into executing a PowerShell command that downloads and deploys the NetSupport RAT for persistent remote access and data exfiltration." }, "severity": "high", "rationale": "The hunt begins by identifying local WordPress installations as they are the strategic entry points. However, the redirection and payload delivery typically occur on user workstations visiting these sites. Analysts should run the DNS and HTTP queries unscoped if no internal WordPress servers are found.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An adversary is using compromised WordPress sites to redirect visitors through a YOURLS-based Traffic Distribution System to fetch ClickFix-style malicious scripts.", "parameters": { "scope_hosts": { "type": "list[host]", "default": [], "description": "Optionally narrow the hunt to specific hosts; leave empty for the whole estate." }, "tds_domains": { "from": { "ref": "https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/", "kind": "article", "observed": "2025-11-01" }, "type": "list[domain]", "default": [ "ksfldfklskdmbxcvb.com", "ototaikfffkf.com", "ksdkgsdkgkgmgm.pro", "booksbypatriciaschultz.com", "ahpc.gov.gh" ], "description": "Infrastructure domains identified in the iClickFix report." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "payload_paths": { "from": { "ref": "https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/", "kind": "article", "observed": "2025-11-01" }, "type": "list[path]", "default": [ "/fffa.js", "/ofofo.js", "/liner.php", "/gigi" ], "description": "Specific URI paths used for stage delivery scripts." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/", "gates": [ "dry-run", "lint", "critic" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/", "name": "Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic" } ], "blind_spots": [ { "id": "no-http-path-visibility", "risk": "If HTTPS traffic is not intercepted, the url_path column in hb_http_activity will be empty or unavailable, leaving the hunt to rely solely on rare domain lookups in DNS.", "stage": "tds-redirection-and-payload-delivery", "question": "whether a host requested a specific .js file or .php endpoint", "requires": "TLS interception or browser-level telemetry" }, { "id": "dns-over-https-blindness", "risk": "If the browser or malware uses DNS-over-HTTPS (DoH), the queries will not appear in hb_dns_activity, missing the TDS infrastructure resolution.", "stage": "compromised-wordpress-injection", "question": "what domains were resolved via non-standard DNS resolvers", "requires": "endpoint-level DoH query logging" } ] }, "name": "iClickFix Web Redirection and Delivery", "description": "The iClickFix framework compromises WordPress sites to redirect visitors through a YOURLS-based Traffic Distribution System (TDS). This hunt identifies the early stages of the infection chain. It starts by identifying hosts that could be affected (those running WordPress), then fans out to monitor DNS for rare lookups and HTTP telemetry for specific JavaScript payload patterns like ofofo.js and liner.php. An agent weighs the evidence from these surfaces to distinguish the TDS from legitimate traffic, and an analyst reviews the hits to confirm the redirection." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "iclickfix-wordpress-targeting-framework-using-clickfix", "index": 1, "title": "iClickFix: WordPress-targeting framework using ClickFix", "total": 2 }, "coverage": [ { "stage": "compromised-wordpress-injection", "steps": [ "wordpress-inventory-scoping", "rare-tds-dns-lookups" ], "status": "covered" }, { "stage": "tds-redirection-and-payload-delivery", "steps": [ "payload-script-http-activity", "rare-tds-dns-lookups" ], "status": "covered" }, { "stage": "clickfix-clipboard-social-engineering", "reason": "Handled in the follow-on hunt focusing on the PowerShell dropper and clipboard interaction.", "status": "out_of_scope" }, { "stage": "powershell-payload-execution", "reason": "Requires hb_process_activity and hb_script_activity; out of scope for the web delivery phase.", "status": "out_of_scope" }, { "stage": "rat-persistence-and-dropper-cleanup", "reason": "Belongs to the infection aftermath hunt.", "status": "out_of_scope" }, { "stage": "netsupport-rat-c2-and-data-theft", "reason": "Involves specific RAT C2 traffic patterns handled in a separate network hunt.", "status": "out_of_scope" } ], "rationale": "An adversary is using compromised WordPress sites to redirect visitors through a YOURLS-based Traffic Distribution System to fetch ClickFix-style malicious scripts.", "blind_spots": [ { "id": "no-http-path-visibility", "risk": "If HTTPS traffic is not intercepted, the url_path column in hb_http_activity will be empty or unavailable, leaving the hunt to rely solely on rare domain lookups in DNS.", "stage": "tds-redirection-and-payload-delivery", "question": "whether a host requested a specific .js file or .php endpoint", "requires": "TLS interception or browser-level telemetry" }, { "id": "dns-over-https-blindness", "risk": "If the browser or malware uses DNS-over-HTTPS (DoH), the queries will not appear in hb_dns_activity, missing the TDS infrastructure resolution.", "stage": "compromised-wordpress-injection", "question": "what domains were resolved via non-standard DNS resolvers", "requires": "endpoint-level DoH query logging" } ], "scoping_notes": "The hunt begins by identifying local WordPress installations as they are the strategic entry points. However, the redirection and payload delivery typically occur on user workstations visiting these sites. Analysts should run the DNS and HTTP queries unscoped if no internal WordPress servers are found.", "beyond_detection": "A static domain blocklist is insufficient for an ephemeral TDS. This hunt correlates rare domain lookups (baseline role) with specific URI patterns and JSON-formatted exfiltration queries across two different telemetry surfaces (DNS and HTTP), something a single rule cannot perform without significant noise." } }, { "id": "wordpress-inventory-scoping", "type": "query", "label": "Scope WordPress infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%wordpress%' OR LOWER(vendor_name) LIKE '%wordpress%'", "surface": "hb_software_inventory", "description": "Find hosts that run WordPress or related packages, as they represent the compromised entry points or strategic internal targets.", "expected_signal": "A list of hosts running WordPress. Silence means no local WordPress installations were detected, though the hunt still proceeds to find workstation victims who visit external compromised sites." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Scope WordPress infrastructure", "reads": [ "device_hostname", "package_name", "package_version", "vendor_name" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%wordpress%' OR LOWER(vendor_name) LIKE '%wordpress%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts running WordPress. Silence means no local WordPress installations were detected, though the hunt still proceeds to find workstation victims who visit external compromised sites.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-tds-dns-lookups", "type": "query", "label": "Rare lookups to TDS domains", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(query_hostname) AS domain, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{tds_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.pro') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(query_hostname) HAVING hosts <= 5 ORDER BY hosts ASC", "surface": "hb_dns_activity", "description": "Identify hosts resolving the reported TDS domains, focusing on those that are rare across the fleet.", "expected_signal": "A list of hosts resolving malicious or suspicious .pro domains. Malicious TDS domains should have very low prevalence. Silence means no known TDS infrastructure was resolved." }, "parents": [ { "id": "wordpress-inventory-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare lookups to TDS domains", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT LOWER(query_hostname) AS domain, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{tds_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.pro') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(query_hostname) HAVING hosts <= 5 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of hosts resolving malicious or suspicious .pro domains. Malicious TDS domains should have very low prevalence. Silence means no known TDS infrastructure was resolved.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "domain" ], "rare_below": 5 }, "verified_at": "2026-09-20" } }, { "id": "payload-script-http-activity", "type": "query", "label": "Detection of iClickFix script fetching", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "web", "content": "SELECT device_hostname, url_hostname, url_path, url_query, time FROM hb_http_activity WHERE (instr(',' || '{{payload_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR (LOWER(url_path) LIKE '%.php' AND url_query LIKE '%\"host\":%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_http_activity", "description": "Detect the actual transfer of the ClickFix-style JavaScript payloads using reported path patterns and URI exfiltration formats.", "expected_signal": "HTTP requests to payloads like ofofo.js or URI queries containing JSON-formatted host data. This is a high-fidelity indicator of redirection activity." }, "parents": [ { "id": "wordpress-inventory-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Detection of iClickFix script fetching", "reads": [ "device_hostname", "time", "url_hostname", "url_path", "url_query" ], "source": "hb_http_activity", "target": "web", "content": "SELECT device_hostname, url_hostname, url_path, url_query, time FROM hb_http_activity WHERE (instr(',' || '{{payload_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR (LOWER(url_path) LIKE '%.php' AND url_query LIKE '%\"host\":%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "HTTP requests to payloads like ofofo.js or URI queries containing JSON-formatted host data. This is a high-fidelity indicator of redirection activity.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-redirection-verdict", "type": "analytic", "label": "Triage redirection evidence", "config": { "cite": "required", "tools": [ "endpoint", "web" ], "context": [ "rare-tds-dns-lookups", "payload-script-http-activity" ], "objective": "Determine if any host resolved a malicious domain and then fetched a JavaScript payload associated with the iClickFix framework.", "description": "Evaluate the combined evidence from DNS and HTTP surfaces to determine if a host successfully navigated the iClickFix redirection chain.", "max_iterations": 3, "expected_signal": "A per-host verdict of malicious if a host resolved a TDS domain and subsequently fetched a known payload script.", "success_criteria": "A list of malicious or suspicious hosts with cited rows from both DNS and HTTP logs." }, "parents": [ { "id": "rare-tds-dns-lookups", "kind": "merge" }, { "id": "payload-script-http-activity", "kind": "merge" } ] }, { "id": "redirection-routing", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host involving both a rare domain and a payload path", "condition": "the triage verdict is malicious for at least one host involving both a rare domain and a payload path", "blind_spot": "no-http-path-visibility", "confidence": "high", "description": "Route the hunt based on whether the agent confirmed active malicious redirection.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-redirection-verdict" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Contain the infection immediately by isolating the compromised endpoint.", "instructions": "Isolate the host and clear the clipboard of the current user to prevent accidental ClickFix execution.", "action_approval": "required" }, "parents": [ { "id": "redirection-routing", "branch": "on_supports" } ] }, { "id": "manual-redirection-review", "type": "task", "label": "Manual redirection review", "config": { "assignee": "analyst", "description": "Verify the agent's verdict and look for evidence of the ClickFix lure in browser history or temporary files.", "instructions": "Check the browser history on affected hosts for visits to the compromised WordPress sites and subsequent hops to TDS domains like ksdkgsdkgkgmgm.pro." }, "parents": [ { "id": "redirection-routing", "branch": "default" }, { "id": "redirection-routing", "branch": "on_unavailable" }, { "id": "redirection-routing", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "reporting-and-cleanup", "type": "task", "label": "Reporting and cleanup", "config": { "assignee": "analyst", "description": "Record the hunt results and update blocklists if new domains are discovered.", "instructions": "Document the found indicators and whether the redirection led to the PowerShell execution stage; update the detection team if the YOURLS redirection patterns have evolved." }, "parents": [ { "id": "manual-redirection-review" } ] } ] }