Copier. Coller. Pivoter.

Au cours d’une journée de travail qui semblait tout à fait ordinaire, une activité inhabituelle détectée dans l’environnement d’un promoteur immobilier de luxe a attiré l’attention de l’un de nos analystes MDR. Un acteur malveillant tentait de mettre en place une attaque par usurpation d’identité en utilisant une nouvelle variante de la technique ClickFix (MITRE T1204.004).

Un environnement calme prend soudain la parole

Nos analystes MDR établissent une base de référence pour chaque environnement qu’ils surveillent, car la « normale » varie d’une entreprise à l’autre. La société immobilière entrait dans la catégorie « généralement calme », ce qui a immédiatement permis de repérer une série soudaine de détections d’activités suspectes.

The ThreatDown EDR agent on one endpoint captured a command line that had executed through the Windows Run feature. Immediately, our MDR analyst wondered if it could be a ClickFix campaign, a social engineering attack that tricks users into copy-pasting a malicious command directly on their own machine. There’s no malicious file, no suspicious download. Just a regular user doing something they do every day.

But one detail didn’t fit. Typical ClickFix attacks rely on PowerShell, CMD, or mshta to execute HTML content. This command used rundll32. With years of experience tracking how threat actors operate, our analyst suspected the adversary had pivoted their method to evade the usual detection signatures, and moved to confirm it.

La preuve irréfutable

To confirm a ClickFix execution, our analyst needed proof that a person, not a script or a scheduled task, had run the command. The Run MRU registry key logs every command a user executes from the Windows Run dialog. If the alert’s command line was in there, the case was made.

The analyst opened a live session on the endpoint with the Active Response Shell, identified the logged-in account, mapped it to the right system profile through the ProfileList registry key, and enumerated that user’s Run MRU entries. The exact command line from the alert was there. A person had been socially engineered into pasting it and running it manually.

From there, our analyst moved straight to containment: malicious processes terminated, endpoint isolated, the attacker’s domain added to web protection, and the command pattern flagged in the anti-exploit engine. All of it inside the same window of minutes that opened with the first alert.

Our analyst then delivered a complete breakdown through the customer’s portal: how the attack unfolded, what actions had been taken, and what to do next. When the customer reviewed the findings, they confirmed everything the analyst had reconstructed, and moved on the recommendations without delay.

Attaque d'usurpation d'identité évitée

ClickFix attacks are built for one outcome: stealing credentials that can be used in identity-based attacks. The script the user ran was a downloader. Its job was to contact the attacker’s server and install an information stealer that could quietly harvest credentials from the infected machine.

With valid credentials, the threat actor would have been able to access internal systems and steal sensitive financial details, property records, and information about active negotiations, while appearing as a legitimate user. The downstream exposure, including regulatory penalties, client notification obligations, and reputational damage, would have carried a steep price.

Because of MDR, that didn’t happen.

Pour un promoteur immobilier de luxe présent aux États-Unis et en Europe, la confiance est le moteur de l'activité. Chaque transaction repose sur la discrétion, le timing et la confiance. Les clients s'attendent à ce que leurs informations financières, leurs dossiers immobiliers et leurs négociations restent confidentiels. Une seule faille pourrait déclencher une enquête des autorités de régulation, exposer des transactions sensibles et briser des relations qui ont mis des années à se construire.

---

Reconstruction

Du premier signal au transfert complet