CRPx0 ClickFix Ransomware Technical Analysis

CRPx0 is an active Ransomware-as-a-Service (RaaS) operation that utilizes 'ClickFix' lures—fake Windows/macOS updates and Google reCAPTCHA checks—to deceive users into executing malicious commands. The attack chain is multi-staged, beginning with an OS-specific clipboard hijack and transitioning through a series of obfuscated DLL loaders on Windows, or direct portable Python deployment on macOS. The final payload is a cross-platform Python ransomware that prioritizes data exfiltration for double extortion before encrypting files with AES-128 and RSA-4096.

Technically, the operation demonstrates high maturity, featuring 17 configurable evasion toggles, AMSI/ETW patching, and ntdll unhooking to blind security tooling. The group targets a wide range of sectors, with a notable focus on US-based healthcare and Turkish financial services. A significant operational risk exists as the ransomware exfiltrates credentials (KeePass, VPN profiles, private keys) before encryption, meaning a compromise requires a full credential rotation regardless of whether a ransom is paid.