Key Takeaways

  • The attack used DLL sideloading to deploy Lorem Ipsum, then established an encrypted Python tunnel.
  • Defenders contained the intrusion, but the chain shows how ClickFix can progress from user interaction to persistent remote access.
  • Application control, script visibility, behavioral detection, and focused employee training can help reduce exposure.

A ClickFix intrusion deployed Lorem Ipsum through DLL sideloading and created an encrypted Python tunnel before defenders contained the attack, illustrating how a simple social-engineering prompt can develop into a more complex endpoint compromise.

The incident reflects the central risk of ClickFix. Rather than exploiting a conventional software vulnerability, the technique persuades a user to perform the critical action. Fake CAPTCHA checks, browser updates, and error messages commonly instruct targets to copy and paste attacker-supplied commands into PowerShell, Terminal, or the Windows Run dialog.

Once executed, those commands can retrieve additional components and give attackers room to change tactics. In this case, the chain moved into DLL sideloading, a technique that abuses the way legitimate applications load supporting libraries. A trusted executable may run while loading a malicious DLL placed where the application expects to find a legitimate file.

That distinction matters. Security controls looking mainly for unfamiliar executables can miss suspicious behavior occurring through an apparently legitimate process. The deployment of Lorem Ipsum also shows that ClickFix is not tied to one malware family or objective. It is better understood as an initial-access method that can support different payloads.

The encrypted Python tunnel added another layer. Tunneling can provide a protected communications path between a compromised endpoint and external infrastructure, potentially supporting remote access or command traffic while making inspection more difficult. Encryption alone is not evidence of malicious activity, of course. Most business traffic is encrypted. Context, including the process creating the connection and the commands preceding it, becomes crucial.

Many employees do not question a polished CAPTCHA page telling them to paste a quick fix into a system prompt. The instruction may look like troubleshooting rather than code execution. That small shift helps ClickFix sidestep some of the suspicion associated with attachments and traditional credential-harvesting pages.

The broader numbers suggest this is no fringe technique. NCC Group cited research showing ClickFix activity increased 517% in H1 2025 compared with H2 2024. NCC Group also ranked it as the second-most-common attack method in November 2025, behind phishing.

Campaign diversity is part of the problem. The Center for Internet Security tracked ClickFix activity from January through October 2025 that included two ransomware-distribution campaigns. One involved Interlock ransomware and affected a U.S. state, local, tribal, or territorial victim. Other observed ClickFix chains have delivered NetSupport RAT and Matanbuchus 3.0, a malware-as-a-service loader.

In practical terms, defenders should treat user-launched PowerShell, unusual Run-dialog activity, suspicious clipboard-to-command behavior, and script interpreters spawning network connections as connected signals. Python processes creating encrypted outbound tunnels may also warrant investigation when Python is uncommon on the affected endpoint or appears immediately after a browser-driven event.

Application control can narrow which programs and libraries execute. PowerShell and script logging can give responders a clearer sequence of events, while endpoint behavioral controls may identify unusual parent-child process relationships. DNS, proxy, and network telemetry can then help determine whether the endpoint contacted newly observed or otherwise suspicious infrastructure.

Training needs an update too. Generic warnings about links and attachments do not fully address a lure that asks users to paste commands themselves. Employees can be taught that websites should not require commands in PowerShell, Terminal, or Run to complete a CAPTCHA, install a browser update, or repair a viewing error. Reporting the prompt is safer than testing it.

That said, awareness is only one layer. ANY.RUN documents ClickFix as a malware-delivery pattern rather than a single fixed payload, reinforcing the value of detections based on behavior instead of filenames alone. The containment of this attack prevented the chain from proceeding further, but its combination of social engineering, DLL sideloading, and encrypted tunneling offers a useful warning: routine-looking user actions can quickly become full remote-access pathways.