--- analysis: A static domain blocklist is insufficient for an ephemeral TDS. This hunt correlates rare domain lookups (baseline role) with specific URI patterns and JSON-formatted exfiltration queries across two different telemetry surfaces (DNS and HTTP), something a single rule cannot perform without significant noise. blind_spots: - id: no-http-path-visibility question: whether a host requested a specific .js file or .php endpoint requires: TLS interception or browser-level telemetry risk: If HTTPS traffic is not intercepted, the url_path column in hb_http_activity will be empty or unavailable, leaving the hunt to rely solely on rare domain lookups in DNS. stage: tds-redirection-and-payload-delivery - id: dns-over-https-blindness question: what domains were resolved via non-standard DNS resolvers requires: endpoint-level DoH query logging risk: If the browser or malware uses DNS-over-HTTPS (DoH), the queries will not appear in hb_dns_activity, missing the TDS infrastructure resolution. stage: compromised-wordpress-injection coverage: - stage: compromised-wordpress-injection status: covered steps: - wordpress-inventory-scoping - rare-tds-dns-lookups - stage: tds-redirection-and-payload-delivery status: covered steps: - payload-script-http-activity - rare-tds-dns-lookups - reason: Handled in the follow-on hunt focusing on the PowerShell dropper and clipboard interaction. stage: clickfix-clipboard-social-engineering status: out_of_scope - reason: Requires hb_process_activity and hb_script_activity; out of scope for the web delivery phase. stage: powershell-payload-execution status: out_of_scope - reason: Belongs to the infection aftermath hunt. stage: rat-persistence-and-dropper-cleanup status: out_of_scope - reason: Involves specific RAT C2 traffic patterns handled in a separate network hunt. stage: netsupport-rat-c2-and-data-theft status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The iClickFix framework has compromised over 3,800 WordPress sites and uses a novel YOURLS-based TDS to evade detection; identifying these redirections early prevents the critical NetSupport RAT payload from executing. methodology: model-assisted trigger: intel-report hypothesis: An adversary is using compromised WordPress sites to redirect visitors through a YOURLS-based Traffic Distribution System to fetch ClickFix-style malicious scripts. labels: - hunt - attack.t1566 - attack.t1059.001 - attack.t1090.003 name: iClickFix Web Redirection and Delivery parameters: lookback_days: default: '14' description: Days of history to examine. type: number payload_paths: default: - /fffa.js - /ofofo.js - /liner.php - /gigi description: Specific URI paths used for stage delivery scripts. from: kind: article observed: '2025-11-01' ref: https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/ type: list[path] scope_hosts: default: [] description: Optionally narrow the hunt to specific hosts; leave empty for the whole estate. type: list[host] tds_domains: default: - ksfldfklskdmbxcvb.com - ototaikfffkf.com - ksdkgsdkgkgmgm.pro - booksbypatriciaschultz.com - ahpc.gov.gh description: Infrastructure domains identified in the iClickFix report. from: kind: article observed: '2025-11-01' ref: https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/ type: list[domain] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/ gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The hunt begins by identifying local WordPress installations as they are the strategic entry points. However, the redirection and payload delivery typically occur on user workstations visiting these sites. Analysts should run the DNS and HTTP queries unscoped if no internal WordPress servers are found. references: - name: 'Meet IClickFix: a widespread WordPress-targeting framework using the ClickFix tactic' url: https://blog.sekoia.io/meet-iclickfix-a-widespread-wordpress-targeting-framework-using-the-clickfix-tactic/ related: - hunt: iclickfix-powershell-payload-execution reason: This hunt identifies the web-based redirection; a subsequent hunt focuses on the PowerShell command execution and RAT deployment. relation: follows scenario: stages: - name: Malicious JavaScript Injection observables: - ic-tracker-js - ksfldfklskdmbxcvb.com - ahpc.gov.gh - dns-prefetch slug: compromised-wordpress-injection tactic: initial-access techniques: - T1566 - name: TDS Redirection and Script Fetching observables: - ototaikfffkf.com/fffa.js - ksdkgsdkgkgmgm.pro/ofofo.js - booksbypatriciaschultz.com/liner.php - 'x-robots-tag: noindex' - YOURLS admin panel slug: tds-redirection-and-payload-delivery tactic: execution techniques: - T1566 - name: ClickFix Clipboard Social Engineering observables: - navigator.clipboard.writeText - Verify you are human - Ctrl + V - Win + R - Unusual Web Traffic Detected slug: clickfix-clipboard-social-engineering tactic: collection techniques: - T1115 - name: Malicious PowerShell Downloader observables: - powershell -w hidden -nop -c - scottvmorton.com/tytuy.json - 05b03a25e10535c5c8e2327ee800ff5894f5dbfaf72e3fdcd9901def6f072c6d - 8db6.ps1 slug: powershell-payload-execution tactic: execution techniques: - T1059.001 - name: NetSupport RAT Persistence and Evasion observables: - ProgramData\S1kCMNfZi3\ - client32.exe - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run - SecureModule Engine v1.0.0 - RunMRU slug: rat-persistence-and-dropper-cleanup tactic: persistence techniques: - T1555 - name: Command and Control and Data Theft observables: - pusykakimao.com:443 - fnotusykakimao.com:443 - /fakeurl.htm - client32.ini - licensee KAKAN slug: netsupport-rat-c2-and-data-theft tactic: command-and-control techniques: - T1041 - T1090.003 - T1021.001 - T1555 summary: IClickFix is a WordPress-targeting framework that compromises legitimate sites to inject malicious JavaScript and redirect users through a YOURLS-based Traffic Distribution System. Victims are tricked by a ClickFix-style fake CAPTCHA lure into executing a PowerShell command that downloads and deploys the NetSupport RAT for persistent remote access and data exfiltration. series: index: 1 slug: iclickfix-wordpress-targeting-framework-using-clickfix title: 'iClickFix: WordPress-targeting framework using ClickFix' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent web: category: siem name: Web server / proxy logs telemetry: - network tlp: clear type: investigation --- # iClickFix Web Redirection and Delivery The iClickFix framework compromises WordPress sites to redirect visitors through a YOURLS-based Traffic Distribution System (TDS). This hunt identifies the early stages of the infection chain. It starts by identifying hosts that could be affected (those running WordPress), then fans out to monitor DNS for rare lookups and HTTP telemetry for specific JavaScript payload patterns like ofofo.js and liner.php. An agent weighs the evidence from these surfaces to distinguish the TDS from legitimate traffic, and an analyst reviews the hits to confirm the redirection. ## wordpress-inventory-scoping Find hosts that run WordPress or related packages, as they represent the compromised entry points or strategic internal targets. ```sqlite target=endpoint role=scoping ~~~yaml expected: A list of hosts running WordPress. Silence means no local WordPress installations were detected, though the hunt still proceeds to find workstation victims who visit external compromised sites. reads: - device_hostname - package_name - package_version - vendor_name silence: not_evidence_of_absence source: hb_software_inventory verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, package_name, package_version, vendor_name FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%wordpress%' OR LOWER(vendor_name) LIKE '%wordpress%' ``` ## redirection-analysis-fan-out parallel: - → rare-tds-dns-lookups - → payload-script-http-activity join: → triage-redirection-verdict ## rare-tds-dns-lookups Identify hosts resolving the reported TDS domains, focusing on those that are rare across the fleet. ```sqlite target=endpoint role=baseline params=(tds_domains=tds_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A list of hosts resolving malicious or suspicious .pro domains. Malicious TDS domains should have very low prevalence. Silence means no known TDS infrastructure was resolved. prevalence: by: device_hostname key: - domain rare_below: 5 reads: - device_hostname - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT LOWER(query_hostname) AS domain, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_dns_activity WHERE (instr(',' || '{{tds_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.pro') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY LOWER(query_hostname) HAVING hosts <= 5 ORDER BY hosts ASC ``` ## payload-script-http-activity Detect the actual transfer of the ClickFix-style JavaScript payloads using reported path patterns and URI exfiltration formats. ```sqlite target=web role=detection-candidate params=(payload_paths=payload_paths, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: HTTP requests to payloads like ofofo.js or URI queries containing JSON-formatted host data. This is a high-fidelity indicator of redirection activity. reads: - device_hostname - time - url_hostname - url_path - url_query silence: not_evidence_of_absence source: hb_http_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, url_hostname, url_path, url_query, time FROM hb_http_activity WHERE (instr(',' || '{{payload_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0 OR (LOWER(url_path) LIKE '%.php' AND url_query LIKE '%"host":%')) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## triage-redirection-verdict ```agent target=hunter cite: required context: - rare-tds-dns-lookups - payload-script-http-activity max_iterations: 3 objective: Determine if any host resolved a malicious domain and then fetched a JavaScript payload associated with the iClickFix framework. success_criteria: A list of malicious or suspicious hosts with cited rows from both DNS and HTTP logs. tools: - endpoint - web ``` ## redirection-routing if~: "the triage verdict is malicious for at least one host involving both a rare domain and a payload path" (confidence: high, judge=hunter) then: → isolate-host indeterminate: → manual-redirection-review unavailable: → manual-redirection-review (blind_spot: no-http-path-visibility) else: → manual-redirection-review ## isolate-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and clear the clipboard of the current user to prevent accidental ClickFix execution. ``` → manual-redirection-review ## manual-redirection-review ```manual target=analyst Check the browser history on affected hosts for visits to the compromised WordPress sites and subsequent hops to TDS domains like ksdkgsdkgkgmgm.pro. ``` → reporting-and-cleanup ## reporting-and-cleanup ```manual target=analyst Document the found indicators and whether the redirection led to the PowerShell execution stage; update the detection team if the YOURLS redirection patterns have evolved. ``` → end