Clickfix attack on Azure Static webapp

Question

Clickfix attack on Azure Static webapp

Tushar Gopalka 0

Hi Sir/Mam,

We have deployed a nextjs application in Azure Static webapp. We started noticing a clickfix campaign attack on 18th July, 2026 where a fake captcha pop up is being injected on our website. We checked on our local build and found no issues. Hence, we redeployment and the issue was mitigated temporarily (for 2-4 hours). However, the campaign attack was auto injected through unknown means in out Azure static webapp. The attack is very similar to this reference: https://www.bleepingcomputer.com/forums/t/817363/sophisticated-clickfix-fake-captcha-campaign-full-ioc-writeup-help-identifyin/

For short term solution, we have whitelisted the URLs known to us that was being injected and thus prevented the pop up (2nd level payload) that was causing this but haven't yet been able to trace the root cause.

Any help and recommendations would be highly valuable!

Best,

Tushar

0 comments

1 answer

Your answer

Answer 1

Hello Tushar Gopalka,

Welcome to the Microsoft Q&A and thank you for posting your questions here.

I understand that you are having Clickfix attack on Azure Static webapp.

This can not resolved by simply redeploying or blocking the malicious URLs. The repeat appearance after 2 to 4 hours means the injection source is still active. You first need to check whether the malicious content is entering through the CI/CD pipeline, deployment token, repository workflow, dependency/build process, third-party runtime script, or client/browser network path. By experience, is either a compromised Azure Static Web Apps deployment path or a runtime JavaScript injection. Azure Static Web Apps deployments are controlled by the build/deployment workflow, deployment token, application configuration, and deployed artifact, so these must be validated first. You have to reset deployment tokens, and Static Web Apps configuration headers such as CSP should be applied through staticwebapp.config.json. - https://learn.microsoft.com/en-us/azure/static-web-apps/build-configuration, https://learn.microsoft.com/en-us/azure/static-web-apps/deployment-token-management, and https://learn.microsoft.com/en-us/azure/static-web-apps/configuration gives you more insights.

What you can do as best practice to resolve is to:

Reset the Azure Static Web Apps deployment token immediately.
Rotate the matching GitHub or Azure DevOps deployment secret.
Review and lock down the Static Web Apps workflow file.
Rebuild from a known-good commit before the first observed compromise.
Compare local build output, CI artifact, Azure-served content, and browser-rendered DOM.
Remove malicious dependencies, build scripts, or third-party scripts if found.
Add a strict Content Security Policy through staticwebapp.config.json.
Review Azure Activity Log and Static Web Apps diagnostics for deployment or configuration changes.
Escalate to Microsoft Support only if the live Azure-hosted content changes without any matching deployment after token rotation and pipeline lockdown.

After the deployment token is reset, the workflow is hardened, the artifact source is validated, and CSP is enforced, the ClickFix injection should stop unless the issue is platform-side or caused outside the application delivery path. If it still returns without a deployment event, contact Azure Support or Product Group via your Azure Portal or contact Priority Customer Support for investigation on backend Static Web Apps platform telemetry.

Use the below are more resource links for more reading and implementation steps as above:

Azure Static Web Apps diagnostics overview - https://learn.microsoft.com/en-us/azure/static-web-apps/diagnostics-overview
Activity Log in Azure Monitor - https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log
ClickFix social engineering technique - https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/
GitHub Actions secure use reference - https://docs.github.com/en/actions/reference/security/secure-use

I hope this is helpful. Please! Do not hesitate to let me know if you have any other questions, steps or clarifications.

Please do not close the thread by upvoting and accepting the answer if any part of it is helpful.

Tushar Gopalka 0 Reputation points

2026-07-26T17:43:56.5633333+00:00

Thanks for your response. The issue is not related to a new deployment. The malware injection happened almost 2 weeks after last deployment was made on Azure. The above steps are helpful and we have taken the necessary steps. However, a more detailed diagnostic of how a malware can be injected two weeks post deployment is required and we have already performed checks on your suggested sources of injection thoroughly - haven't found any cracks or vulnerabilities in those points

Hence, we would need more personalized help here, thank you in advance.
Sina Salam 30,816 Reputation points Volunteer Moderator

2026-07-26T19:44:16.46+00:00

Thank you for clarification, do the escalation via your Azure Portal or https://learn.microsoft.com/en-us/azure/azure-portal/supportability/priority-community-support as it stated in the content.

cheers.