You're listening to the Cyberwire Network, powered by N2K.

Most environments trust far more than they should, and attackers know it.

Threat Locker solves that by enforcing default deny at the point of execution.

With Threat Locker Allow listing, you stop unknown executables cold. With ring fencing, you control how trusted applications behave.

And with Threat Locker DAC, defense against configurations, you get real assurance that your environment is free of misconfigurations, and clear visibility into whether you meet compliance standards.

Threat Locker is the simplest way to enforce zero-trust principles without the operational pain.

It's powerful protection that gives CISO's real visibility, real control, and real peace of mind.

Threat Locker makes zero-trust attainable, even for small security teams.

See why thousands of organizations choose Threat Locker to minimize alert fatigue,

stop ransomware at the source, and regain control over their environments.

Schedule your demo at Threatlocker.com slash N2K today.

Hello, everyone, and welcome to the CyberWires Research Saturday.

I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities,

solving some of the hard problems and protecting ourselves in our rapidly evolving cyberspace.

Thanks for joining us.

Clickfix is a malware delivery technique. It's not sophisticated. It's very simple. And it typically involves just tricking the user to copy and pasting a malicious command.

That's Ben Fallon, security operations analyst from Huntress.

The research we're discussing today is titled Click Fix Gets Creative, Malware Buried in Images.

I noticed there was a specific campaign, a click-fix campaign, and we started seeing certain

indicators of compromise that would indicate it's the same campaign on multiple incidents.

So this happened for a few days.

I was doing my analysis and I was doing the investigation, and we observed that the ClickFix campaign started with a user being instructed to copy and paste a malicious command, and it was encoded with a hex hex encoded IP address. We did this investigation and did some Maurer analysis and we realized,

...