Notifications
Clear all
Topic starter
08/07/2026 7:03 pm
TL;DR: A ClickFix campaign impersonating Google Meet tricks users into running obfuscated PowerShell and delivers SalatStealer to harvest browser credentials, session cookies, autofill data, and cryptocurrency wallet artifacts, according to Gurucul. The lesson is that user-assisted execution plus legitimate Windows tooling can bypass traditional controls and turn endpoint compromise into identity theft at scale.
NHIMG editorial — based on content published by Gurucul: ClickFix Abuse: Fake Google Meet Delivers SalatStealer
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams respond to ClickFix-style social engineering campaigns?
A: Treat them as identity compromise pathways, not just phishing.
Q: Why do browser cookies and autofill records matter to IAM teams?
A: Because they can function as session and authentication shortcuts.
Q: What breaks when PowerShell and BITSAdmin are allowed to run unchecked on user endpoints?
A: The defender loses the distinction between normal administration and attacker staging.
Practitioner guidance
- Block user-assisted script execution paths Restrict PowerShell, script interpreters, and Windows Run usage on endpoints that handle privileged access or sensitive browser sessions.
- Treat browser profiles as credential stores Inventory which users and endpoints retain decrypted browser sessions, autofill data, and wallet extensions.
- Monitor living-off-the-land downloader abuse Alert on BITSAdmin, PowerShell download-and-execute patterns, and temporary-directory binaries that appear immediately after script activity.
What's in the full article
Gurucul's full blog covers the operational detail this post intentionally leaves for the source:
- Full infection-chain walkthrough from the fake Google Meet page to SalatStealer execution and exfiltration.
- MITRE ATT&CK mapping and indicator-of-compromise details for PowerShell abuse, BITSAdmin, and staged payload delivery.
- Binary-level observations on browser decryption, wallet targeting, and the specific data stores SalatStealer reads.
- Network telemetry and IOC material that implementation teams can use to tune detections and triage alerts.
👉 Read Gurucul's analysis of the ClickFix campaign that delivered SalatStealer →
ClickFix social engineering and browser theft: what IAM teams miss?
Explore further
08/07/2026 7:26 pm
ClickFix works because trust in local execution paths is still a security assumption. The attack does not need privilege escalation or kernel exploitation when the victim can be coached into launching the first malicious process themselves. That means many endpoint and email controls are still tuned to the wrong failure mode. Practitioners should treat user-assisted execution as an identity event, not only as malware delivery.
A few things that frame the scale:
- From our research: When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How can organisations limit the damage from stolen browser secrets?
A: Reduce persistence, reduce reuse, and reduce privilege. Shorter session lifetimes, stronger endpoint hardening, and tighter control over where credentials are cached make harvested browser secrets less useful after theft. The key is to stop a local compromise from becoming a broad identity event.
👉 Read our full editorial: ClickFix abuse shows how browser credentials get stolen
