The infamous Lazarus APT has evolved its attack methodology by incorporating the increasingly popular ClickFix to distribute malware and steal sensitive information data from targeted organizations.
See also: Lazarus hackers deploy three RATs on compromised systems
This threat actor, linked to North Korea and tracked internally as APT-Q-1 by security researchers, has demonstrated remarkable adaptability by incorporating deceptive user interface manipulation into its traditional espionage operations.
The ClickFix technique represents an advanced social engineering approach, where attackers present victims with fabricated technical problems and then guide them through seemingly legitimate “fixes” that actually execute malicious code.
The Lazarus APT has weaponized this method through the established infrastructure of fake recruitment campaigns, creating a multi-layered attack vector that combines job opportunity bait with technical deception.
CN-SEC analysts identified this campaign through the discovery of a malicious batch script that downloads disguised NVIDIA software packages, which then deploy the group's BeaverTail feature
The attack chain begins when victims are lured to fraudulent interview websites that prompt them to prepare their interview environment, ultimately claiming that camera configuration issues require immediate resolution.
The technical sophistication of this operation extends beyond simple social engineering. Victims are presented with what appears to be a legitimate NVIDIA driver update command, but the underlying payload is transformed into a malicious execution sequence.
See also: ClickFix: COLDRIVER hackers distribute LOSTKEYS malware
The main infection vector uses a PowerShell that downloads and extracts a malicious ZIP file from compromised infrastructure.
Recent analyses reveal that the group has expanded its operations to target both Windows and macOS platforms, demonstrating cross-platform capabilities through customized payloads for different operating system architectures.
The Windows variant focuses on enterprise environments through Node.js-, while the macOS versions use shell scripts designed for Apple Silicon and Intel processors.
The main malware package, distributed as “nvidiaRelease[.]zip” (MD5: f9e18687a38e968811b93351e9fca089), contains multiple components designed for cross-platform compatibility and persistent access.
The original ClickFix-1.bat executes a sequence of commands that deploys run[.]vbs, which performs system recognition to determine the Windows build number. For Windows 11 systems (build 22000 or higher), the script additionally executes drvUpdate[.]exe, a sophisticated backdoor capable of command execution and file manipulation.
This binary establishes communication with command and control servers at 103.231.75.101:8888, implementing functions that include information collection , remote command execution, and file transfer capabilities.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
See also: Lazarus hackers breached six organizations in South Korea
The malware achieves persistence through registry modification, adding an entry to the Windows registry startup key that ensures execution across system reboots.
