Huntress Analysis: ClickFix and Cookie Theft Enable Rapid BEC via Fake AI Results

Huntress published research detailing a chain of attacks that combines ClickFix scams, stolen session cookies, and fake AI search results to execute business email compromise. The report shows how a single user action can lead to full account takeover within hours.

What happened

The threat actor targets users searching for AI assistants like ChatGPT by placing sponsored links that lead to malicious custom GPTs. According to Huntress, these pages appear legitimate and mimic trusted platforms to lower user suspicion.

The malicious GPT claims a service issue exists and directs the victim to a fake verification page. The page instructs the user to open Terminal and paste a specific command using a keyboard shortcut.

This instruction is a ClickFix attack. When the user executes the command, a script runs on the Mac to retrieve browser cookies. The script specifically targets the Microsoft 365 session cookie.

The attacker takes this cookie and injects it into their own browser using a free extension. This action logs them into the victim's Outlook account without requiring a password or multi-factor authentication code.

Once inside the inbox, the attacker locates pending invoices or financial requests. They create a hidden inbox rule named with dots to archive related messages, ensuring the victim does not see the activity.

The attacker then replies to the finance team as the victim, requesting a change in payment routing. After sending the fraudulent request, they delete the sent message and empty the trash to cover their tracks.

Why it matters

This attack chain exploits trust in popular AI tools and standard troubleshooting habits. By bypassing MFA through session theft, attackers avoid the usual friction points of account compromise.

Huntress notes that the entire process, from initial click to financial fraud, can unfold in approximately 24 hours. The speed and stealth make detection difficult for users who rely on email for critical communications.

The combination of social engineering via AI search results and technical exploitation via ClickFix creates a high-impact threat. It highlights how endpoint actions can directly compromise cloud identity security.

What to watch

• Monitor for shell commands on Mac endpoints that include Base64-encoded data or external IP addresses.
• Look for unusual inbox rules, especially those with obscure names or that archive specific message types.
• Check for login sessions from unexpected geographies or devices in Microsoft 365 sign-in logs.
• Alert users to verify the URL of AI platforms and be wary of instructions to run terminal commands.

Who needs to act first

Teams should prioritize reviewing endpoint security controls on Mac devices, as these systems are the initial entry point. It is crucial to verify that command-line execution policies are strict and that users cannot run arbitrary scripts without elevated privileges. Organizations must also assess their ability to detect anomalous session activity. Since the attack bypasses traditional authentication, monitoring for impossible travel or concurrent sessions becomes essential. Users should be guided to recognize the signs of ClickFix scams, such as unsolicited requests to paste code into Terminal.

Background: IP addresses

An IP address is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. This guide answers ten common questions about IPv4 and IPv6 mechanics, subnetting, NAT, and security implications to clarify how these identifiers function in modern infrastructure.

Read the full guide: IP Address Mechanics: 10 Questions Network Engineers Actually Ask

What to do and how to stay safe: Huntress

• Enforce strict policies against pasting unknown commands into Terminal or command prompts on company devices.
• Configure Microsoft 365 to alert on the creation of new inbox rules, especially those that move or delete messages.
• Review sign-in logs for sessions that lack multi-factor authentication or originate from unfamiliar locations.
• Educate staff to verify the legitimacy of AI search results and avoid clicking sponsored links for critical tools.

Step-by-step guide: Business Email Compromise Prevention Checklist for Secure Operations

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How do attackers bypass multi-factor authentication in this scenario?

They steal the session cookie from the victim's browser after the user executes a malicious terminal command.

What is the first step in this attack chain?

The user clicks a fake sponsored search result for an AI platform and lands on a malicious custom GPT.

What evidence indicates a ClickFix attack occurred?

A Mac shell command running curl output with Base64-encoded attacker IP addresses appears in endpoint logs.