Threat behavior
Trojan:PowerShell/ClickFixObfus.B is a type of malware that tricks people by showing fake error messages or pop-up alerts. These messages pretend something is wrong with your device and then tell you to copy, paste, and/or launch a command to “fix” the issue. However, that command downloads malware onto your device.
Trojan:PowerShell/ClickFixObfus.B is dangerous because of how cleverly it spreads. Threat actors use a mix of tricks to get it onto your device, often without you noticing. Here’s how they do it:
- Phishing: You might receive an email that looks like it’s from a well-known company. These emails may may contain fake urgent messages with links that lead to fake websites, which then secretly install Lumma on your device.
- Malvertising: When you search for things like “Notepad++ download” or “Chrome update,” you might see ads that look real but are actually fake. Clicking them takes you to a copycat website that installs Lumma instead of the real software.
- Infected websites: Threat actors break into real websites and add hidden code. When you visit these sites, the code runs in the background and tries to infect your device—sometimes by tricking you into clicking something or downloading a file.
- Trojanized applications: If you download pirated versions of apps or games, they might come bundled with Lumma. These fake installers look normal but secretly install the malware after you launch them.
- Fake tools and CAPTCHA scams: Threat actors upload fake tools to public sites like GitHub. Some even create fake CAPTCHA pages, commonly observed in the ClickFix ecosystem, that tell you to copy and paste a command into your device. That command installs Lumma silently in the background.
- Delivered by other malware: Lumma doesn’t come alone. Other malware, like DanaBot, can install Lumma as a second-stage infection.
Prevention
