Huntress details how ClickFix and stolen cookies enable rapid BEC attacks

Huntress researchers published a detailed analysis showing how attackers chain ClickFix scams with stolen session cookies to execute business email compromise within 24 hours. The report illustrates how a seemingly harmless search for an AI assistant can lead to full account takeover without triggering authentication prompts.

Principal Product Researcher Truman Kain described a scenario involving a fictional finance employee who searched for ChatGPT and clicked a sponsored result. The link directed the user to a malicious custom GPT that claimed a service issue existed. This initial interaction sets the stage for the subsequent technical exploitation of the victim's workstation.

The Attack Chain

The malicious AI interface instructed the user to press Command+Space, open Terminal, and paste a specific command. This technique is known as ClickFix, where social engineering tricks victims into executing scripts that compromise their own systems. The user followed these instructions, unaware that the command would allow the attacker to retrieve session data.

Once the script executed, the attacker retrieved the Microsoft session cookie from the compromised machine. The attacker specifically targeted the cookie that keeps the user logged in to Outlook. By injecting this cookie into a new browser session, the attacker gained immediate access to the inbox.

This method bypassed both password requirements and multi-factor authentication because the session was already authenticated. The attacker walked straight into the inbox looking just like the user. No additional credentials were needed to view emails or send messages from the compromised account.

Impact on Business Operations

With full inbox access, the attacker searched for pending invoices awaiting approval. The attacker created an inbox rule named with two dots to hide notifications and archive messages containing the specific invoice number. This stealthy manipulation prevented the victim from seeing the incoming fraud attempt.

The attacker then replied to Treasury as the victim, requesting payment to a new routing number. After sending the fraudulent request, the attacker deleted the sent message and emptied the trash folder to remove evidence. The entire sequence occurred within 24 hours, leaving the victim unaware of the breach until financial discrepancies emerged.

The report notes that this attack required minimal technical expertise or financial investment from the threat actor. The speed of the compromise highlights the risk of chaining low-effort social engineering with technical exploits. The fictional victim was a finance employee at a company called Speedway Laundry.

What should you do?

Security teams should monitor endpoints for shell commands running curl with Base64-encoded IP addresses, as this matches the ClickFix pattern described. Identity teams should look for unusual inbox rule creation, especially rules with obscure names or those that archive specific message types. Users should be trained to recognize ClickFix attempts and avoid pasting terminal commands from unverified sources.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe

• Monitor endpoint logs for shell scripts that execute curl commands with encoded IP addresses, which may indicate ClickFix activity.
• Review Microsoft 365 audit logs for the creation of new inbox rules, particularly those with minimal names or unusual filtering criteria.
• Train employees to identify social engineering attempts that request terminal commands or browser extensions from AI interfaces.
• Verify payment requests through secondary communication channels to prevent business email compromise fraud.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How do attackers bypass MFA in this scenario?

Attackers steal active session cookies from the victim's browser, allowing them to access the account without entering passwords or MFA codes.

What is the ClickFix technique?

ClickFix is a social engineering method where attackers trick users into pasting malicious commands into their system terminal to gain access.

How long does this attack take to execute?

The entire attack chain, from initial access to financial fraud, can unfold within 24 hours