Hackers Exploit Microsoft SharePoint in ClickFix Phishing Attack: A Deep Dive into the Havoc Post-Exploitation Framework

Cybercriminals have continuously adapted their tactics to evade detection and infect more users. Recently, a new wave of phishing attacks has emerged, leveraging a well-known Microsoft SharePoint vulnerability to distribute the Havoc post-exploitation framework. The campaign, tracked by FortiGuard Labs, has been making waves as cybersecurity researchers uncover its sophisticated methodology. Dubbed the ClickFix phishing attack, this latest scam takes phishing to a new level, exploiting fake error messages and user intervention to distribute malware.

In this article, we’ll explore the mechanics of the ClickFix phishing attack, its link to Microsoft SharePoint, the use of Havoc framework, and how users can protect themselves from these growing threats.

The ClickFix Phishing Attack: How It Works

Phishing attacks have always relied on human error, social engineering, and the exploitation of trust. The ClickFix phishing attack continues this trend, but with some innovative twists. In this campaign, cybercriminals use Microsoft SharePoint—a widely-used document management and collaboration platform—as a vector for infecting victims with malware.

The attack chain begins with a phishing email that looks legitimate, often carrying an attachment labeled as a “restricted notice” in HTML format. Once the recipient opens the attachment, it triggers a fake error message, with text such as “Failed to connect to OneDrive – update the DNS cache manually.” This message, which mimics a real issue that a user might encounter, encourages them to take further action.

The attacker goes further by embedding a button labeled “How to fix” within the error page. Clicking this button copies a PowerShell command to the Windows clipboard. The victim is then instructed to paste the command into their PowerShell terminal, unknowingly executing a script that allows the hackers to deploy the Havoc framework—a powerful tool for post-exploitation purposes.

Microsoft SharePoint as a Gateway to Malicious Activity

While SharePoint is a widely-used and legitimate platform for enterprise collaboration, its popularity has made it an attractive target for cybercriminals. Attackers can use SharePoint to exploit vulnerabilities in the system, spreading malware, distributing phishing attacks, or gathering sensitive data.

In the case of the ClickFix phishing attack, SharePoint is used as a delivery mechanism, where the phishing email often includes a link to a SharePoint-hosted HTML page. The message within the HTML page mimics a real-life error message from Microsoft OneDrive, leading victims into a false sense of urgency to resolve a non-existent issue. The attackers exploit trust by making the attack appear as though it’s coming from a familiar, trusted source (in this case, Microsoft-related services).

What makes this attack particularly insidious is how it uses human error and user interaction to further its goals. Most users would not suspect that clicking a “How to fix” button within what appears to be a legitimate error message would lead to the execution of malicious commands.

The Role of the Havoc Post-Exploitation Framework

Once the victim executes the PowerShell script, the Havoc post-exploitation framework is deployed onto their system. Havoc is a sophisticated post-exploitation tool often used by hackers to maintain persistence, escalate privileges, and gather sensitive information from infected systems. Unlike traditional malware, Havoc is designed to blend in with the environment and make detection difficult.

The Havoc framework allows attackers to perform various malicious activities, including:

• Data exfiltration: Stealing sensitive documents, credentials, or other files from the victim’s system.

• Command and control: Enabling remote attackers to control the infected system, issue commands, and perform other malicious actions.

• Privilege escalation: Elevating access privileges to gain deeper control over the infected system.

• Persistence: Maintaining a foothold on the victim’s system for future attacks.

Havoc’s ability to blend seamlessly into the system and its wide array of tools make it a dangerous framework for cybercriminals. Once deployed, Havoc is used to exfiltrate data, maintain remote access, and enable further exploitation within the infected network.

Understanding the ClickFix Phishing Attack Chain

To fully comprehend the impact of the ClickFix phishing attack, let’s break down the typical sequence of actions that lead to an infection:

1. Phishing Email: The victim receives an email claiming that they need to take action regarding a restricted notice. This email contains an HTML attachment that the victim is tricked into opening.

2. Fake Error Message: Once the attachment is opened, a fake error page is displayed, claiming that the victim’s OneDrive connection has failed and prompting them to fix it by updating their DNS cache manually.

3. Copying PowerShell Command: The victim is presented with a “How to fix” button. Clicking this button copies a PowerShell command to the clipboard, instructing the victim to paste it into the PowerShell terminal.

4. Execution of Malicious Script: When the victim pastes and runs the copied command, they unknowingly execute a script that deploys the Havoc framework on their system.

5. Post-Exploitation: The attacker now has access to the victim’s system, where they can carry out further activities such as data theft, lateral movement, and establishing long-term persistence.

Protecting Yourself from ClickFix Phishing Attacks

Given the sophistication of these types of phishing attacks, it’s essential for users to stay vigilant. Below are a few best practices to help protect against ClickFix phishing and similar threats:

1. Don’t Open Suspicious Attachments: Be cautious when opening attachments, even if they seem legitimate. Avoid opening HTML files or links from unknown or untrusted sources.

2. Verify the Source: Always double-check the authenticity of emails or notifications, especially when they contain suspicious content, even if they appear to come from familiar services like Microsoft.

3. Educate and Train Employees: Organizations should ensure that their employees are trained on how to spot phishing attempts and understand the dangers of clicking on unverified links or opening questionable attachments.

4. Use Anti-Malware Solutions: Ensure that your systems are equipped with reliable anti-malware software capable of detecting and blocking malicious PowerShell scripts and post-exploitation tools like Havoc.

5. Regular System Monitoring: Set up intrusion detection and preventive monitoring solutions to detect any suspicious activity on the system, particularly in relation to unexpected system modifications or the running of untrusted scripts.

6. Apply Software Updates: Always keep your software up-to-date to patch any security vulnerabilities in platforms like Microsoft SharePoint, OneDrive, and Windows systems.

Conclusion

The ClickFix phishing attack is a prime example of how cybercriminals are continuously evolving their techniques to target users and distribute malware. By exploiting Microsoft SharePoint and other trusted platforms, hackers are able to manipulate victims into performing actions that ultimately lead to data theft and system compromise.

The Havoc post-exploitation framework is particularly dangerous because it gives hackers control over the victim’s system, allowing them to execute a wide range of malicious activities. However, with the right security measures in place and by being vigilant against phishing attempts, users can protect themselves from falling victim to this and similar cyberattacks.

As always, staying informed about the latest threats and practicing safe browsing habits are key to safeguarding both personal and organizational data.