ClickFix Evolves: API-Delivered Payloads and AMSI Bypass

Colleagues, I want to highlight a cybersecurity trend.

ClickFix no longer looks like simple social engineering. Threat actors are now delivering commands via API servers and masking payloads in new ways.

A particularly concerning scenario uses the Downloads folder: only the “orchestrator” reaches the clipboard, while the malicious code is launched from a downloaded file. This helps bypass AMSI and complicates analysis.

For defense, I would first focus on process chains: explorer.exe or WindowsTerminal.exe -> powershell.exe/cmd.exe/msiexec.exe. EDR, script execution restrictions, and user awareness also matter.

Why it matters: the attack changes form, but still relies on human trust and weak command execution controls.

Have you already strengthened monitoring for such chains?

#cybersecurity #ClickFix #EDR #ThreatIntel