Threat Intel Content Update: 4/29/25

Malicious Copy and Paste Threats

Threat Profiles

• The addition of a new Sub-Technique, Malicious Copy and Paste (T1204.004), in the recently released v17 of ATT&CK gives us an opportunity to shine the spotlight back on a series of Campaigns that we've previously flagged for our users.
• This Profile contains the four Campaigns related to “ClickFix” or "FakeCaptcha" and similar activity that we've added to our knowledge base since last July, where actors socially engineer targets into copying & executing commands onto their systems, usually leading to the installation of malware.
• These are currently the only threat objects linked to this new Sub-Technique in the knowledge base.

• Fortinet FortiDLP, FortiGate, FortiEDR

• MITRE ATT&CK Mitigations