Cybersecurity researchers at Google’s Mandiant have uncovered a sophisticated cyber attack campaign that uses fake security prompts to trick users into installing dangerous malware on their computers.

## The ClickFix Deception

The attack, tracked as UNC5518, employs a clever social engineering technique called “ClickFix.” Victims encounter what appears to be a legitimate CAPTCHA verification page while browsing the internet. However, these pages are actually traps designed to fool users into copying and running malicious code on their systems.

The scam typically begins when users click on poisoned search results or malicious advertisements. They’re then directed to a fake CAPTCHA page that instructs them to paste and execute a PowerShell command through Windows’ Run dialog box. This seemingly innocent action actually downloads and installs the CORNFLAKE.V3 backdoor onto their computer.

## CORNFLAKE.V3: A Versatile Cyber Weapon

CORNFLAKE.V3 represents a significant upgrade from its predecessors. Unlike earlier versions that could only download files, this backdoor can:

– Execute various types of malicious code including programs, scripts, and commands
– Collect system information and send it to criminal servers
– Maintain persistent access to infected computers
– Hide its communications through Cloudflare tunnels to avoid detection

The malware comes in both JavaScript and PHP versions, making it adaptable to different attack scenarios.

## Criminal Marketplace Operations

What makes this campaign particularly concerning is its business model. UNC5518 operates as an “access-as-a-service” provider, selling computer access to other criminal groups. Mandiant has identified at least two buyer groups:

– **UNC5774**: A financially motivated group that uses the access to deploy additional malware
– **UNC4108**: A group with unknown motives that installs remote access tools like NetSupport RAT

## Additional Payloads and Capabilities

Once CORNFLAKE.V3 is installed, it can deliver various secondary threats, including:

– Tools for stealing network credentials
– Additional backdoors like WINDYTWIST.SEA
– Software for reconnaissance and lateral movement within corporate networks

## USB-Based Cryptocurrency Mining Campaign

Separately, Mandiant discovered an ongoing campaign since September 2024 that uses infected USB drives to spread cryptocurrency mining software. When victims plug in these drives and click on what appears to be a normal shortcut file, they unknowingly install a complex chain of malware that ultimately deploys XMRig mining software to generate cryptocurrency for the attackers.

## Protection Recommendations

Security experts recommend several defensive measures:

– **Disable Windows Run dialog** where organizationally feasible
– **Conduct regular security training** to help employees recognize social engineering tactics
– **Implement robust monitoring systems** to detect suspicious PowerShell execution
– **Exercise caution with USB drives** from unknown sources
– **Maintain updated security software** and network monitoring tools

This campaign highlights how cybercriminals continue to evolve their tactics, combining technical sophistication with psychological manipulation to compromise systems and generate profits through various criminal enterprises.