ClickFix attacks and image-based C2: what should SOC teams do?

TL;DR: A ClickFix-style intrusion used a Windows Run dialog PowerShell command, downloaded a ZIP from attacker infrastructure, hid a folder, set a registry Run key for persistence, and used shellcode with dead drop and victim-specific tasking, according to Blackpoint Cyber. The pattern shows how execution, persistence, and command and control now blend into ordinary-looking activity, so detection must follow the full chain rather than single indicators.

Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “Blackpoint SOC Threat Pulse: Week of 9/21”.

Key questions

Q: What breaks when users are tricked into running PowerShell commands themselves?

A: The usual assumption that malicious code enters as a file or attachment breaks immediately.

Q: Why do registry Run keys make post-compromise persistence so effective?

A: Registry Run keys matter because they convert a one-time execution event into a repeatable startup path that survives reboots and user logins.

Q: How can security teams detect image-based command and control?

A: Teams should look for strange combinations of web retrievals, image files that behave like tasking containers, and short-lived endpoint activity that follows unusual script execution.

Practitioner guidance

• Harden native script execution paths Restrict PowerShell usage for standard users, apply constrained language modes where appropriate, and alert on Run dialog launches that spawn networked script activity.
• Monitor persistence locations continuously Track registry Run keys, startup folders, and other user-writable persistence points as high-signal changes after any suspicious script execution or archive download.
• Correlate endpoint and memory artefacts Look beyond file hashes by collecting process trees, in-memory shellcode indicators, and child network connections when shell activity precedes beaconing.

Bottom line: This incident shows how a simple user-run PowerShell command can become a full intrusion path when the attacker combines social engineering, payload staging, and startup persistence.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →