From ClickFix to BPFDoor: Key Cyber Threat Trends and Analysis for 2025

As technology rapidly advances, cyber attacks are growing increasingly sophisticated and precise, deeply infiltrating our daily lives. In 2025, hacking attacks that utilize social engineering and exploit the latest vulnerabilities are being consistently detected, and real-world cases of damage are spreading rapidly. 

In this article, we look at major cyber threat trends and real cases from the first half of 2025.

Technological Advancement and the Acceleration of Cyber Threats

These days, we are seeing new technologies and services spread to many users within days, or even hours, of their release. This pace of change in the digital era is unprecedented. In fact, the time it takes for major online services to reach one million users has dramatically shortened in just a few years. For example, while Facebook took 10 months and Twitter took 2 years to reach one million users, ChatGPT recently set a record by reaching that number in just 5 days after launch. In just over 10 years, the speed at which new technologies and services become part of daily life has accelerated dramatically.

The rapid spread of new technology is bringing new risks before we have time to prepare or respond. In the past, it usually took about two years for new ransomware that appeared overseas to become widespread in Korea. However, recently, threats discovered overseas—such as abuse of generative AI, new security vulnerabilities, and new malware distribution methods—are being used in Korea within just a few months or even days. The accelerated adoption of new technology is allowing cyber threats to reach our lives in an even shorter time. Now, cyber attacks appear in new ways every year, and the number of incidents keeps reaching new records. Recent statistics show that cyber threats and attacks are more than just an IT management issue—they are becoming a key risk that directly affects our everyday life.

Cyber Threat Trends

Cyber attack statistics from the Korean private sector in the second half of 2024 show the following notable features.

 

Figure 1. Cyber threat statistics for the second half of 2024 (Source: KISA)

• Server Hacking: 
  Server hacking accounted for about 56% of all incidents, making it the largest category. In particular, company websites, databases, and servers are often targeted.
• Malware Infection: 
  Malware infection accounted for about 12% of all hacking attacks, and among types of malware incidents, ransomware was the most common at 85%. These ransomware attacks are targeting all parts of society, including businesses, hospitals, and public institutions.

In the first half of 2025, hacking attacks have become more frequent. In recent cases involving the financial sector and online bookstores, ransomware infections caused services to be delayed for several days, and many customers were directly affected. In addition, attack methods are becoming more sophisticated, making it harder to detect and defend against them. This reality shows that cyber attacks are more than just an IT problem—they cause real crises and chaos throughout society. So, let's take a look at some real attack cases from the first half of the year and how they were handled.

Recent Hacking Cases and Methods of Response

Cyber attacks are becoming more varied, using methods such as tricking users, abusing normal features, and creating fake websites. Attackers cleverly use a mix of social engineering and security vulnerabilities to trick victims into taking action, and cases affected by this continue to be reported in Korea. Here are the main attack cases and how they were handled in the first half of 2025.

1. ClickFix

ClickFix is a new way of spreading malware using social engineering, first reported in mid-2024. Here is how the attack works.

 

Figure 2. ClickFix attack screen

1. Baiting: The threat actor lures users to a website through email or messages.
2. Prompting users to copy a malicious script: A website displays a message pretending to solve a security issue and prompts the user to click a button, which copies a malicious command to the user's clipboard. For example, messages like 'Click here and run the copied code to solve the problem' are used.
3. Execution of malicious script and further infection: The user follows the instructions and directly enters and runs the malicious command, which leads to further malware infection.

The threat actor tricks the user into clicking by showing a screen that looks like a CAPTCHA button. The threat actor takes advantage of a JavaScript feature that allows clipboard access only when the button is clicked. When the user clicks the button, a malicious command is automatically copied to their PC's clipboard. 

After that, the threat actor tricks the user into running a command from the clipboard. If the user does this, the malware will be activated. A key feature of ClickFix is that it carries out attacks through normal user actions as seen above.

As mentioned earlier, ClickFix was first discovered in mid-2024. In just six months, by early 2025, actual cases had already been reported in Korea. At first, infection mainly occurred through websites, but in recent cases found in Korea, it has changed to a more sophisticated spear phishing method.

• Attacks using email attachments
  This attack method takes advantage of a weakness in security products like email security solutions, where malware in a text file is seen as just plain text. An email is sent with a text file containing malicious commands and a PDF manual that looks like a real guide. The user is then tricked into copying and running the malware themselves by following the instructions.
• Attacks using websites
  A fake website is made to look like a real job board with regular job postings or job descriptions. When a user clicks a post, a pop-up appears and tricks them into copying and running malware.

The ClickFix type attacks use social engineering to get users to act. To prevent these attacks, it is important to understand how they work in advance and provide security education.

2. Attacks disguised as legitimate software (fake software download page)

The second example of recent cyber threats is an attack method disguised as legitimate software. The threat actor creates a fake website disguised as a legitimate software download page to trick users into downloading malware.

The process of an attack disguised as legitimate software is as follows.

1. Creating a fake page: After making a fake software download page, the threat actor posts it as a Google ad so it appears in search results.
2. Top placement in search engines: By taking advantage of search engine optimization, the threat actor makes the fake page appear at the top of search results.
3. Malware infection: If the user downloads and runs the software, they get infected with malware.

 

Figure 3. Fake web page disguised as a Chrome download site

A common example is malware disguised as a Google Chrome download. To make the fake page look like a real software download page, the threat actor uses the real logo and a similar design to trick users. If the Google Apps Script platform is used, the real Google domain will appear in the address bar. However, by using ‘iframe’, it is possible to display the fake Chrome website made by the threat actor, even though it is not related to the Google domain. In the end, this page pretends to be a Google Chrome download page, but it actually takes you to a website where malware is downloaded.

 

Figure 4. How to check advertiser information

It's not hard to prevent attacks like this. By clicking the icon next to the search result, you can see the advertiser information and make sure the page is legitimate. However, for businesses, checking advertiser information and making sure the site is safe every time can be very inconvenient. That's why having a download center where you can get all the software you use for work in one place is also very effective. 

3. BPFDoor

BPFDoor is a backdoor that mainly targets Linux systems. It is designed to stay hidden and re-enter systems. Its main feature is that after it gets infiltrates a system, it can remain undetected and work secretly for a long time.

BPF is a technology that was originally developed to solve the problem of inefficient network packet analysis. It helps analyze network traffic without slowing down performance. With traditional network analysis, all network packets are copied from the kernel to the user space, and then the needed packets are selected. But with BPF, filtering is done in the kernel first, so only the needed packets are sent to user space. This minimizes unnecessary data movement and allows network traffic to be analyzed quickly without slowing down performance.

The BPFDoor malware takes advantage of BPF technology and works as follows.

 

Figure 5: BPFDoor attack flow

1. BPF filter registration: When the system is infected with BPFDoor, the malware registers a BPF filter in the kernel and continuously monitors specific network packets that contain a magic number set by the threat actor.
2. Threat actor recognition for command and control: While monitoring network packets, if it finds a packet with the magic number, it recognizes the source IP address of that packet as the threat actor's command and control server.
3. Attempt at reverse connection: BPFDoor uses a reverse connection method, following the threat actor's command, to connect directly from the infected system to the threat actor's command and control server.
4. Remote command execution: If the connection is successful, it receives remote commands from the threat actor and runs them on the system.

Because BPFDoor can monitor network packets in the kernel, it doesn't need to open a specific port. It can find the pre-set magic number in any packet traveling on the network. In other words, it can quietly send and receive commands like a normal system, even without using the fixed ports that traditional firewalls or network security solutions watch for. Additionally, because it uses a reverse connection method to communicate with the threat actor's server, it can easily bypass common firewall rules that block inbound connections.

Because of these features, BPFDoor is often hard to detect. That's why Linux-specific security solutions should be used for constant monitoring and prevention.

4. Scam

Scams are a lot like the frauds people encounter in everyday life. There are many different types of scams, and they come in all shapes and sizes. In Korea, two of the most notorious scams are romance scams and investment scams.

• Romance scam: A scam that exploits emotion to take money from people.
• Investment scam: A scam that uses fake investment platforms, like fake stock exchanges, to trick people into sending money themselves.

Since these impersonation apps get victims to send money themselves, the app itself only serves to show a simple webpage. As a result, these apps are often not detected as malicious in Google or Apple's app stores. Scam apps that trick users into installing them can actually be found on the Apple App Store or Google Play Store. On the surface, they use icons that look like those of Korean companies or banks. But in reality, all of them are fake apps made for spam, so users must be careful.

 

Figure 6. Examples of scam apps listed on the Play Store.

5.Watering Hole

 

Figure 7. Watering Hole attack flow

A watering hole attack is when a threat actor infects a website that people often visit, and then uses it to spread malware to visitors' computers. This is a type of advanced persistent threat (APT) attack.

Here is how the attack works.

1. Malicious script injection: Hacks into a web server that the target uses frequently and inserts a malicious script.
2. Target verification: Checks if the user who accessed the website is the target.
3. Malicious script delivery: If the user is the target, the website delivers additional malicious scripts.
4. Information collection and theft: By exploiting security vulnerabilities, collects information from the system and sends it to an external server.
5. Chained vulnerability exploitation: Runs additional malicious scripts to download and run more malware in sequence.

To prevent damage from watering hole attacks, it is important to have proper website security measures. Users should also be aware of this type of hacking and keep their security software up to date to protect themselves.

Conclusion

The five cyber attack cases we looked at earlier all have different forms and methods of penetration. However, they all have one thing in common: they cleverly combine social engineering, which takes advantage of human psychology, with technical vulnerabilities. Attacks can happen through ordinary actions like clicking, copying, or downloading. Even a small moment of carelessness inside a company can end up paralyzing the entire system.

Recently, cyber threats have been emerging much faster than before and are being used in real attacks more quickly. New techniques that bypass existing security detection systems, like ClickFix, or methods of spreading malware disguised as legitimate software, are hard to stop with technical defenses alone. As threat actors evolve, we also need to change our security strategies.

Now, the main focus of cyber security should be on proactively predicting and preventing risks, not just protecting systems. To achieve this, it takes more than just keeping security solutions up to date. Security training for employees, checking user habits, quickly patching vulnerabilities, and improving internal processes all need to be done together. There is no such thing as perfect security against constantly evolving cyber attacks, but the most important thing is to understand threats accurately and respond proactively.

AhnLab is keeping up with these trends by providing threat intelligence through TIP services, offering real-time vulnerability notifications, and strengthening cooperation with organizations both in Korea and abroad. Going forward, AhnLab will continue to develop its technology and infrastructure so that companies and users can build a safer digital environment.