ClickFix campaign now uses fake Windows updates to spread malware

Summary:

The ClickFix malware campaign has evolved to distribute ransomware and info-stealers through fake Windows update screens. Typically triggered via phishing emails, malvertising, or poisoned search results, the attack displays realistic-looking update prompts urging immediate installation. Victims who approve the “update” unknowingly execute code that disables security tools, deploys secondary payloads (e.g., BlackCat ransomware), and establishes persistent backdoors. The malware specifically targets outdated Windows 10/11 systems and mimics Microsoft’s UI design elements to appear legitimate.

What This Means for You:

• Impact: Full system compromise, data theft, and encryption for ransom demands.
• Fix: Immediately run offline scans with Windows Defender (mpcmdrun -Scan -ScanType 2).
• Security: Enable “Tamper Protection” in Windows Security to block unauthorized changes.
• Warning: Never install updates from pop-ups – only use Settings > Windows Update.

Solutions:

Solution 1: Verify and Install Legitimate Updates

Microsoft never pushes updates through browser pop-ups. To manually check/install updates securely:

1. Press Win + I > Update & Security
2. Select Check for updates

Compare your current version using winver in Command Prompt against Microsoft’s official Windows release health dashboard.

Solution 2: Deep Scan with Microsoft Safety Scanner

1. Download from Microsoft’s official site: https://aka.ms/WindowsSafetyScanner
2. Run MSERT.exe /fullscan in Administrator Command Prompt

This portable tool detects and removes ClickFix-associated threats like Emotet downloaders without conflicting with existing antivirus software.

Solution 3: Restore System Using Clean Boot State

1. Run msconfig > Boot tab > Check Safe boot + Network
2. Reboot and reset hosts file: cmd /c "echo. > %windir%\System32\drivers\etc\hosts"
3. Block malicious domains: netsh advfirewall firewall add rule name="BlockClickFix" dir=out remoteip=193.32.162.0/24 action=block

Solution 4: Audit Scheduled Tasks and Services

ClickFix creates persistence via rogue scheduled tasks. To investigate:

1. Run schtasks /query /fo list /v > tasks.txt
2. Check for tasks named “WindowsUpdateAssistant” or similar
3. Remove suspicious entries: schtasks /delete /tn "MaliciousTaskName" /f

People Also Ask:

• Q: How do I spot a fake Windows update? A: Legitimate updates never show browser pop-ups with countdown timers.
• Q: Does ClickFix affect macOS/Linux? A: Currently Windows-only, but cross-platform scripts may follow.
• Q: Can I manually remove ClickFix malware? A: Yes – delete suspicious files in %LocalAppData%\Temp\~winupdate and restore registry defaults.
• Q: Where to report attacks? A: Forward phishing emails to report@phishing.gov and infected samples to Microsoft Security Response Center.

Protect Yourself:

• Always verify update authenticity via Windows Settings > Update History
• Bookmark Microsoft’s official update catalog (catalog.update.microsoft.com)
• Configure daily backups to external drives using wbadmin start backup -backupTarget:E: -include:C:
• Enable Hardware-enforced Stack Protection in Windows Security > Device Security

Expert Take:

“ClickFix exemplifies adversary-in-the-middle (AitM) tactics – they intercept update requests to inject malicious payloads while maintaining the appearance of legitimacy. Implement certificate pinning and HTTPS scanning to break this attack chain.” – Karla A. | Malware Reverse Engineer

Tags:

• detect fake windows 10 update malware
• remove clickfix ransomware from pc
• windows update phishing attack prevention
• microsoft defender offline scan tutorial
• how to verify legitimate windows security updates
• blackcat ransomware infection through system updates

*Featured image via source

Edited by 4idiotz Editorial System