#clickfix
-
ClickFix Attack Abuses Siemens Software Center Flaw to Drop a Remote Access Trojan
Siemens has patched a DLL sideloading flaw in Siemens Software Center that attackers already exploited, using the legitimately signed program as a carrier for malicious code.
-
ROMULUS Platform Turns ClickFix Into a Malware Delivery Pipeline
Forescout has detailed ROMULUS, a malware delivery service that uses ClickFix lures on fake landing pages to make victims run malicious commands themselves.
-
CERT-UA: 100+ Hacked Sites Push LunexStealer via Fake Cloudflare Check
Ukraine's CERT-UA has found over a hundred compromised websites that, under the guise of a "prove you're human" check, coax visitors into running a malicious command themselves.
-
A documentation placeholder domain now serves ClickFix attacks
The third-party.com domain, used for years as a generic placeholder in developer docs and code samples, now shows a fake Cloudflare check that nudges Windows users into running malicious PowerShell.
-
Meta's highly privileged AI assistant Muse hit by a serious 0-day
Muse, Meta's new AI agent with sweeping permissions, turns out to be vulnerable: one way to fully hijack it is a simple ClickFix attack.
-
ChainScript: a new RAT hides its C2 lookup in a Polygon smart contract
Attackers are using ClickFix-style lures to deliver a previously undocumented remote access trojan called ChainScript, which finds its command servers through a smart contract on the Polygon blockchain.
-
Brevo supply-chain attack: a stolen Cloudflare key infected customer sites
Attackers stole a Cloudflare API key and used an edge worker to inject ClickFix scripts into Brevo's sites and into widgets embedded on customer pages. Up to 100,000 sites may have been affected.
-
ClickFix: How a Fake CAPTCHA Tricks Victims into Infecting Their Own Computers
ClickFix attacks have gone from an exotic rarity to a mass phenomenon: PC and Mac users are being tricked into running malicious commands themselves. Even pro-Kremlin hacking groups have taken up the technique.
-
5,400 hacked sites serve up ClickFix payloads from the BNB blockchain
A large cybercriminal campaign is using thousands of compromised small-business sites to deliver malicious code hidden inside smart contracts on the BNB Smart Chain test network.
-
Criminals Don't Want Elegant Attacks — They Want Repeatable Ones
An analytical breakdown from The Hacker News explains why cybercrime has turned into a generics manufacturing business: attackers don't invent, they replicate what others have already built.
-
Microsoft Links More Than 30 Domains to the Infrastructure of the MacSync macOS Stealer
Microsoft Defender experts traced the path of the MacSync macOS stealer from payload download to data theft, correlating recurring network and behavioral markers across constantly shifting infrastructure.
-
ClickFix for macOS: an infostealer quietly skims a slice of your crypto
Researchers at Huntress have uncovered a Go-based piece of malware that steals passwords, Apple Keychain data and hijacks cryptocurrency transactions through fake instructions in Terminal — but drains only a portion of the wallet rather than the whole thing.
-
DOUBLECUP: a ClickFix service that hides malware in the browser's image cache
DOUBLECUP, a new Russian-language loader-as-a-service, conceals malicious code in PNG images cached by the victim's browser and delivers CountLoader and a new DeviceManager trojan.
-
Steam forums used to infect gamers with a cryptominer disguised as game “fixes”
Scammers reply to players' complaints in Steam discussions and offer a PowerShell command to run that quietly installs the XMRig miner.
-
Russian APT Groups Adopt the ClickFix Technique
The ClickFix social-engineering trick, previously used mostly by financially motivated cybercriminals, is now being deployed by elite hacking groups linked to Russia.