Phishing Campaign Uses ClickFix Technique and Microsoft Graph API to Deploy Havoc C2 via SharePoint Sites

A new phishing campaign has emerged that employs the ClickFix technique to execute a multi-stage attack using SharePoint sites. This method allows attackers to hide behind trusted services while deploying the Havoc Command and Control (C2) framework, which is designed to evade detection. The campaign exploits the Microsoft Graph API and utilizes tools like Microsoft Teams and Quick Assist to gain access to targeted systems. The analysis of this malware campaign highlights the increasing sophistication of cyber threats in the current digital landscape.