ThreatFox: IClickFix IOCs

Hunt Hypothesis

This hypothesis targets the IClickFix exploit, which leverages browser-based clickjacking to execute arbitrary code and establish a foothold in user environments. Proactively hunting for these IOCs in Azure Sentinel is critical to identify compromised endpoints that may have been silently infected through malicious web interactions before lateral movement or data exfiltration occurs.

IOC Summary

Malware Family: IClickFix Total IOCs: 16 IOC Types: domain

Type	Value	Threat Type	First Seen	Confidence
domain	fingerprint-veri.info	payload_delivery	2026-09-03	100%
domain	gold.albaikmenuonline.com	payload_delivery	2026-09-03	100%
domain	linkinmasgocf.com	payload_delivery	2026-09-03	75%
domain	ualbiotech.com	payload_delivery	2026-09-03	50%
domain	vandanashivamovie.com	payload_delivery	2026-09-03	50%
domain	david.advancecreative.co.uk	payload_delivery	2026-09-03	50%
domain	anwrealestate.co.uk	payload_delivery	2026-09-03	50%
domain	portaleducoas.org	payload_delivery	2026-09-03	50%
domain	bmrentcars.com	payload_delivery	2026-09-03	50%
domain	elkon.gr	payload_delivery	2026-09-03	50%
domain	bhagwatibiscuits.com	payload_delivery	2026-09-03	50%
domain	bishopelectricalllc.com	payload_delivery	2026-09-03	50%
domain	katadata.co.id	payload_delivery	2026-09-03	50%
domain	prospectmanager.co.uk	payload_delivery	2026-09-03	50%
domain	applekidsschool.com	payload_delivery	2026-09-03	50%
domain	atlantasbestconcrete.com	payload_delivery	2026-09-03	50%

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - IClickFix
let malicious_domains = dynamic(["fingerprint-veri.info", "gold.albaikmenuonline.com", "linkinmasgocf.com", "ualbiotech.com", "vandanashivamovie.com", "david.advancecreative.co.uk", "anwrealestate.co.uk", "portaleducoas.org", "bmrentcars.com", "elkon.gr", "bhagwatibiscuits.com", "bishopelectricalllc.com", "katadata.co.id", "prospectmanager.co.uk", "applekidsschool.com", "atlantasbestconcrete.com"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

Required Data Sources

Sentinel Table	Notes
DnsEvents	Ensure this data connector is enabled

References

• ThreatFox — IClickFix

False Positive Guidance

• Legitimate Browser Extension Management via GPO or MDM

  • Scenario: Administrators deploy or update Chrome/Firefox extensions (e.g., LastPass, 1Password, or internal SSO helpers) using Group Policy Objects (GPOs) or MDM tools like Intune. The IClickFix IOCs often include specific file paths or registry keys related to extension installation directories (e.g., C:\Program Files\Google\Chrome\Application\... or HKCU\Software\Google\Chrome\Extensions). A standard enterprise deployment script or GPO refresh may write to these locations, triggering the IOC match.
  • Filter/Exclusion: Exclude processes originating from known administrative tools such as gpupdate.exe, gpedit.msc, intunemgmt.exe, or mdmclient.exe. Additionally, filter out events where the parent process is a service host (svchost.exe) associated with the Client Side Deployment service or MDM agent.

• Scheduled Task for Browser Cache/Profile Cleanup

  • Scenario: Many enterprises use scheduled tasks to clean up browser profiles or temporary files to save disk space. Tools like cleanmgr.exe or custom PowerShell scripts running under Task Scheduler may delete or modify files in the AppData\Local\Google\Chrome\User Data or Mozilla\Firefox\Profiles directories. If the IOC includes file deletion or modification events in these specific user profile paths, a routine cleanup job could trigger the alert.
  • Filter/Exclusion: Exclude events where the parent process is Task Scheduler (taskschd.msi or svchost.exe with the Task Scheduler service) or cleanmgr.exe. You can also filter based on the specific user context if the task runs under a dedicated service account (e.g., DOMAIN\svc-browser-cleanup) rather than