According to the observed flow and the information provided for this bulletin, the victim receives an email from an external address belonging to the Gmail domain<\/strong>, using the subject:<\/p>\n\n \u201cpayment receipt\u201d<\/strong><\/p>\n\n The message contains as an attachment a protected PDF document<\/strong>, designed to appear as legitimate documentation related to the SAT.<\/p>\n\n The PDF protection, the tax-related theme, and the institutional appearance of the document seek to increase the credibility of the message and generate enough trust for the victim to continue with the instructions presented.<\/p>\n\n When interacting with the content or with the mechanism included in the document, the victim is led to the next stage of the attack, where a social engineering chain known as ClickFix<\/strong> begins.<\/p>\n\n Unlike traditional attacks that directly exploit a technical vulnerability in the operating system, ClickFix uses the user themselves to execute the malicious instructions<\/strong>.<\/p>\n\n ClickFix<\/strong> is a social engineering technique by which attackers manipulate users into manually executing malicious commands on their own system.<\/p>\n\n Publicly documented ClickFix campaigns have been used to distribute malware such as Lumma Stealer, Latrodectus, NetSupport RAT, and DarkGate<\/strong>, demonstrating that this technique primarily works as a delivery and initial execution mechanism; the final payload may vary depending on the attacker.<\/p>\n\n It all starts with an email like this “Payment receipt”, supposedly from the SAT.<\/p>\n\n When the user downloads and opens the attached PDF file, it forces the user to click the “Unlock” button<\/p>\n\n When the user clicks, they are sent to the Government of Tlaquepaque page and there a vulnerability is automatically exploited. This vulnerability sends the user back to another page compromised by the attacker. This page is not from the government, but it is a Mexican site. On that page, another “program” is executed; what you see in the image is the program’s code. This program functions as a police officer; before moving to the second step, it performs a check.<\/p>\n\n First, it analyzes whether the victim is a program such as an antivirus or programs that exist on the internet that can detect this type of threat. – Then it validates whether the victim uses Windows; if the victim does not use Windows, it shows this screen. This indicates that this attack only works for Windows users. If it is macOS, for example, it shows this screen and the attack ends.<\/p>\n\n If the victim’s computer is Windows, it detects the victim’s IP address and sends it to the attackers; if the IP is from Mexico, it sends the message: “\ud83e\udde8*WINDOWS REAL* \ud83e\udde8 \u2014 Premium target”. It also sends the computer’s time zone to the attacker. According to the message and the code of the message it sends, we can determine that the attacker uses Telegram or WhatsApp to receive these messages. to arbitrary locations of the host system using the privileges of the user or process that executed docker cp.<\/p>\n\n Users and administrators should perform the following actions:<\/p>\n\n <\/p>\n","protected":false},"featured_media":0,"template":"","class_list":["post-11968","publicacion","type-publicacion","status-publish","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t![\"\"](\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/08\/image.jpg\")
<\/figure>\n\n![\"\"](\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/08\/image-1.jpg\")
<\/figure>\n\n![\"\"](\"https:\/\/beaconlab.us\/wp-content\/uploads\/2026\/08\/image-2.jpg\")
<\/figure>\n\nSolution<\/h2>\n\n
\n
Additional information:<\/h2>\n\n
\n