ClickFix to BEC: the inbox rule gets the headline, the paste deserves it

I’ve lost count of how many BEC cases started with someone telling me “I didn’t click anything.” Okay sure - but what about pasting something?

This week, Huntress published a walkthrough of an attack chain that ends in business email compromise (BEC). The specific post is From Overhyped to OH $#!T, and its “star” is Doris Stewart, a made up finance employee at Speedway Laundry. Doris googles ChatGPT for help with an email, clicks a sponsored result, and lands in a custom GPT built by an attacker. The GPT claims there’s a service issue and sends her to a fake verification page, which tells her to press Command+Space, paste a command into Terminal, and hit Enter. That’s ClickFix. The attacker then grabs her Microsoft 365 session cookie, drops it into a fresh browser, and is sitting in her inbox - no password, no MFA prompt. From there they find an invoice awaiting approval, create an inbox rule named “..” (you know, one of the classics) that archives anything containing the invoice number, replies as Doris with a new routing number, deletes the sent message, and empties the trash.

Doris isn’t real, but ClickFix very much is. Microsoft’s 2026 Digital Defense Report, published earlier this month, counted ClickFix-style commands executed on more than 1.1 million unique devices between February and early May. Last year’s edition had already named ClickFix the most common initial access method in its Defender Experts notifications, at 47%. ESET’s H1 2026 Threat Report has its ClickFix detections more than doubling, with lures spreading into AI-themed help pages - which is pretty much the custom GPT Huntress described.

There were two specific details from the Huntress write-up I wanted to highlight, as they should be familiar to investigators:

• The inbox rule is named “..” - two characters that DFIR responders have seen all too many variations of in real BEC cases.
• The attacker’s last move is housekeeping: delete the sent reply, then empty the trash, so Doris never sees the message that redirected the payment.

For the first detail - however the attacker got in, the chain still ends with an inbox rule, and an inbox rule is a configuration change that gets logged. Exchange mailbox auditing records an UpdateInboxRules action whenever a rule is added, removed, or changed, and Microsoft’s own session cookie theft alert guidance tells you to hunt New-InboxRule, UpdateInboxRules, and Set-InboxRule events with MoveToFolder, Archive, or MarkAsRead actions. This part of the attack is textbook BEC.

The second detail is creative, but also familiar. Deleting the sent item and emptying Deleted Items hides the evidence from Doris. It doesn’t hide it from an analyst. Emptying Deleted Items is a soft delete - per Microsoft, those items move to the Recoverable Items folder, where they sit for 14 days by default (configurable up to 30). And with single item recovery (on by default in Exchange Online) or a hold in place, even items purged from there land in a hidden Purges subfolder that an admin can still pull back through eDiscovery. The audit log tracks every step of the cleanup, too: the Send, a MoveToDeletedItems when the reply leaves Sent Items, a SoftDelete when the trash is emptied, and a HardDelete if anything gets purged from Recoverable Items. On top of that, MailItemsAccessed records which messages the intruder accessed, along with a SessionId, client IP, and client info string. Why am I spending so much time writing this out? Because the attacker’s cleanup is mostly a gift to an analyst’s timeline.

The juicy ClickFix stuff is mostly outlined within Huntress’ endpoint hunt: a Mac shell running curl with the attacker’s IP Base64-encoded inside it is always going to be worth flagging. Microsoft’s macOS ClickFix guidance says almost the same thing - alert on Terminal sessions spawning curl, base64, gunzip, or osascript, especially right after web browsing. The same Microsoft post notes that Apple added a “Possible malware, Paste blocked” warning in macOS 26.4, which also tells you how seriously the platform owners are taking this.

My one critique of the Doris framing isn’t with the hunt advice (awesome post) - it’s with where the story puts the danger. Huntress saves the “OH $#!T” framing for the chain that ends in the inbox rule and the BEC, but I’d argue the paste is the moment we should all be focusing on. Catch it there, and the M365 half of the story can be stopped before it starts (as long as you revoke their sessions too). That’s why ClickFix deserves more attention than it gets. It’s now one of the most common methods the industry is seeing and has moved past the “Windows Run box” into Terminal on macOS, a platform a lot of us still treat as low-risk. It also skips everything we’ve trained users and email filters to catch. There’s no attachment, no link in an email, nothing for a gateway to flag - just a person typing a command they were told to type. If your detections start at the mailbox, you could be missing half the attack. Watch the shell.

Someone like Doris may never see that inbox rule named “..”. Your audit log will, but your EDR can catch the paste first.

ZB