Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

Threat actors often prioritize repeatable attacks over sophisticated ones. A common technique used last year was ClickFix, which involves tricking visitors into pasting a command into their terminal. This method typically starts with a webpage that appears to require the user to prove they are not a robot, while secretly placing a command on their clipboard. The user is then guided through opening a terminal and pasting the command, allowing the attacker to gain access. According to Microsoft's observations, ClickFix was the most common initial access method used last year. This technique relies on social engineering rather than complex exploits.