The Interlock ransomware gang has adopted ClickFix attacks, a social engineering tactic, to breach corporate networks and deploy file-encrypting malware. ClickFix involves deceiving victims into executing malicious PowerShell commands under the guise of fixing errors or verifying their systems, leading to malware installation. The use of ClickFix by Interlock marks a growing trend among threat actors employing this method. Launched in late September 2024, Interlock targets FreeBSD servers and Windows systems. It does not operate as a ransomware-as-a-service model but maintains a dark web data leak portal to pressure victims into paying ransoms ranging from hundreds of thousands to millions of dollars. Previously, Interlock used fake browser and VPN client updates for network breaches. As of January 2025, researchers noted Interlock’s utilization of ClickFix attacks. Interlock hosted fake CAPTCHA prompts on URLs mimicking Microsoft and Advanced IP Scanner portals, instructing users to execute commands to verify themselves and download promoted tools. Only the site impersonating Advanced IP Scanner led to a malicious installer. The ‘Fix it’ button copies a dangerous PowerShell command to the victim’s clipboard, which, when executed, downloads a 36MB PyInstaller payload. Concurrently, the legitimate AdvanceIPScanner site opens to reduce suspicion. The payload installs genuine software and executes an embedded PowerShell script in a hidden window, registering a Run key for persistence and exfiltrating system info like OS version and user privileges. Researchers observed the command and control (C2) server delivering various payloads, including LummaStealer, BerserkStealer, keyloggers, and Interlock RAT, a simple trojan for file exfiltration and shell command execution. Interlock operators use stolen credentials for lateral movement via RDP, with tools like PuTTY, AnyDesk, and LogMeIn aiding attacks. Before ransomware execution, stolen files are uploaded to attacker-controlled Azure Blobs. The Windows variant of Interlock runs daily at 08:00 PM as a redundancy measure, without causing multiple encryption layers. The ransom note has evolved, emphasizing legal aspects of data breaches. ClickFix attacks are increasingly used by various threat actors, including other ransomware gangs and the North Korean Lazarus group, which targets cryptocurrency job seekers.