38 articles

#ClickFix

All CosmicBytez Labs articles tagged #ClickFix, across news, security advisories, how-to guides, and projects.

NewsOct 12, 2026
Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption
A new Windows loader uses the Tox P2P network for encrypted C2, ClickFix delivery, and shortcut-hijack persistence, Varonis researchers found.
NewsSep 26, 2026
Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials
Ontinue details a four-stage Lunex Stealer chain abusing a vulnerable AMD driver to blind EDR, then steal browser and crypto-wallet data.
NewsSep 21, 2026
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
A new Node.js RAT called ChainScript spreads via ClickFix lures impersonating Spotify, Zoom, and Teams, resolving C2 through a Polygon smart contract.
NewsSep 21, 2026
Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Surge & Browser Hijacks
This week: a maximum-severity Cisco ISE bypass, an AI agent chaining bugs into OpenAI, a Cloudflare-key ClickFix worm, and bank browser hijacks.
NewsSep 18, 2026
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
A stolen Cloudflare API key let attackers hijack Brevo's site and embedded scripts for hours, hitting 100,000+ sites with ClickFix malware.
NewsSep 14, 2026
Hackers Hijack HBO Max Reddit Account to Push ClickFix Malware Ads
Attackers took over HBO Max's verified Reddit account, running 108 malicious ads over 48 hours that used ClickFix lures to infect Windows...
NewsSep 12, 2026
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
Huntress details how attackers weaponize Claude Artifacts, shared AI chat links, and ClickFix lures to spread infostealers.
NewsSep 5, 2026
5,400+ Hacked Sites Serve ClickFix Payloads Stored on the Blockchain
Attackers stash ClickFix malware stagers in BNB Smart Chain smart contracts, giving compromised WordPress and PrestaShop sites takedown-resistant C2.
NewsAug 31, 2026
Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels
A new ClickFix variant tricks victims into running PowerShell in Windows Terminal, sideloading a DLL that opens a persistent reverse-tunnel backdoor.
NewsAug 30, 2026
TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor
A new ClickFix variant, TerminalFix, tricks victims into running PowerShell via fake Cloudflare CAPTCHAs to install a stealthy reverse-tunnel implant.
NewsAug 25, 2026
24 npm Packages Abuse unpkg CDN to Host Fake Cloudflare CAPTCHA Phishing Pages
Attackers published 24 npm packages using the unpkg CDN as malware hosting infrastructure, serving ClickFix CAPTCHA lures to steal credentials.
NewsAug 25, 2026
WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords
Two new malware loaders — WordlistLoader and SynkLoader — deliver ransomware-enabling payloads and steal Windows credentials via phishing.
NewsAug 24, 2026
WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials
Two new malware loaders target ransomware access brokering: WordlistLoader drops Amatera Stealer via ClickFix, SynkLoader harvests Windows credentials.
NewsAug 24, 2026
WordlistLoader and SynkLoader: Two New Windows Malware Loaders Analysed
Security researchers expose WordlistLoader deploying Amatera stealer via ClickFix and SynkLoader delivering a 7-module RAT through Microsoft Teams phishing.
NewsAug 1, 2026
ESET Threat Report: Malicious AI Skills and Adaptable Malware on the Rise
ESET's mid-2026 threat report reveals attackers adapting established techniques to AI platforms — deploying malicious AI skills, AI-assisted malware,...
NewsJul 31, 2026
ESET H1 2026: Malicious AI Skills Surge to 3,000+ as ClickFix and Quishing Break Records
ESET's H1 2026 threat report reveals 3,000+ malicious AI skills in open repositories, a 108% ClickFix surge, record quishing activity, and the first...
NewsJul 27, 2026
Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More
This week's top threats: OpenAI's models escape a sealed test environment, a CVSS 9.3 Check Point flaw goes actively exploited, AI coding assistants...
NewsJul 25, 2026
Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers
Threat actors are hijacking Steam discussion threads to pose as helpful community members, tricking frustrated gamers into running malicious PowerShell...
NewsJul 19, 2026
New ClickLock macOS Malware Traps Users Into Revealing Login Password
Group-IB researchers uncovered ClickLock, a macOS infostealer that runs a 210ms kill loop for up to 83 hours to coerce victims into entering their...
NewsJul 19, 2026
UAC-0145 Uses ClickFix CAPTCHAs to Deliver Malware to Ukrainian Devices
Russian state-sponsored threat actor UAC-0145 is deploying ClickFix-style fake CAPTCHA prompts to trick Ukrainian targets into self-installing...
NewsJul 17, 2026
ClickLock: New macOS Infostealer Kills Apps Every 210ms to Force Password Entry
Group-IB researchers discovered ClickLock, a new macOS infostealer distributed via ClickFix lures that terminates all visible system processes in a loop...
NewsJul 16, 2026
ClickLock: New macOS Stealer Kills Every App Until You Type Your Password
Group-IB researchers discovered ClickLock, a macOS infostealer that uses ClickFix social engineering to install a kill loop firing pkill every 210ms —...
NewsJul 8, 2026
SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users
A new banking fraud campaign tracked as REF6045 is deploying SCMBANKER malware through fake CAPTCHA ClickFix lures to steal credentials from customers of...
NewsletterJun 17, 2026
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
NewsJun 16, 2026
'Lorem Ipsum' Malware Pivots to ClickFix Delivery via WordPress
New analysis reveals the 'Lorem Ipsum' malware campaign has adopted ClickFix social engineering as its primary delivery mechanism, leveraging compromised...
NewsApr 4, 2026
Axios npm Hack Used Fake Teams Error Fix to Hijack
The Axios HTTP client post-mortem reveals North Korean threat actors used a ClickFix-style fake Microsoft Teams error message to socially engineer a...
NewsMar 30, 2026
DeepLoad Malware Uses ClickFix and WMI Persistence to Steal
Researchers have identified DeepLoad, a previously undocumented malware loader that combines ClickFix social engineering with WMI-based persistence to...
NewsMar 28, 2026
Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs
A newly observed ClickFix campaign impersonates Cloudflare's CAPTCHA verification pages to deliver the Python-based Infiniti Stealer to macOS users via a...
NewsMar 28, 2026
New Infinity Stealer Malware Grabs macOS Data via ClickFix
A new info-stealing malware named Infinity Stealer is targeting macOS systems with a Python payload packaged as an executable using the open-source Nuitka...
NewsMar 17, 2026
LeakNet Ransomware Weaponizes ClickFix and Deno Runtime for Stealthy Corporate Attacks
The LeakNet ransomware gang is using ClickFix social engineering for initial access and a Deno-based malware loader to execute fileless payloads from...
NewsMar 8, 2026
Termite Ransomware Operator Velvet Tempest Chains ClickFix
Microsoft-tracked threat actor Velvet Tempest is deploying Termite ransomware via a ClickFix social-engineering chain that loads DonutLoader and installs...
HOWTOFeb 23, 2026
How to Detect and Block ClickFix Attacks
Learn how to detect and prevent ClickFix social engineering attacks using EDR rules, network monitoring, YARA signatures, and endpoint hardening. Covers...
NewsletterFeb 23, 2026
Late February Roundup: New Guides, Checklists & Threat
New IT offboarding checklist, endpoint security baseline, BGP monitoring guide, ClickFix detection guide, plus AI-powered attacks on FortiGate devices, a...
NewsFeb 15, 2026
ClickFix Attacks Evolve to Abuse DNS nslookup for Payload Delivery
Microsoft discloses a new ClickFix variant that uses DNS nslookup commands to retrieve and execute malicious PowerShell payloads, marking the first known...
NewsFeb 14, 2026
Claude AI Artifacts Abused to Distribute macOS Infostealer
Threat actors are abusing publicly shared Claude AI artifacts and Google Ads to deliver the MacSync infostealer to macOS users through ClickFix social...
NewsFeb 13, 2026
ClickFix Campaign Targets European Hotels with Fake
A sophisticated phishing campaign dubbed PHALT#BLYX is targeting European hospitality organizations with fake Booking.com cancellation emails that display...
NewsFeb 11, 2026
North Korea Deploys AI-Generated Video and ClickFix
North Korean threat actors are running sophisticated campaigns using AI-generated deepfake videos and the ClickFix social engineering technique to target...
NewsFeb 8, 2026
North Korean Hackers Use Fake Zoom Meeting to Target Crypto
UNC1069, a North Korean APT group, deployed a sophisticated ClickFix scam using a fake Zoom meeting to target a cryptocurrency executive in a social...

Inside AvisLoader: A Windows Malware Loader Built to Resist Disruption

Lunex Stealer Abuses AMD Driver to Disable Security Monitoring and Steal Browser Credentials

ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure

Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Surge & Browser Hijacks

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Hackers Hijack HBO Max Reddit Account to Push ClickFix Malware Ads

How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface

5,400+ Hacked Sites Serve ClickFix Payloads Stored on the Blockchain

Microsoft Warns of TerminalFix Attacks Deploying Reverse Tunnels

TerminalFix ClickFix Variant Deploys Reverse-Tunnel Backdoor

24 npm Packages Abuse unpkg CDN to Host Fake Cloudflare CAPTCHA Phishing Pages

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

WordlistLoader & SynkLoader: New Malware Families Delivering Infostealers and Phishing Windows Credentials

WordlistLoader and SynkLoader: Two New Windows Malware Loaders Analysed

ESET Threat Report: Malicious AI Skills and Adaptable Malware on the Rise

ESET H1 2026: Malicious AI Skills Surge to 3,000+ as ClickFix and Quishing Break Records

Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and More

Steam Forum ClickFix Attacks Infect Gamers with XMRig Cryptominers

New ClickLock macOS Malware Traps Users Into Revealing Login Password

UAC-0145 Uses ClickFix CAPTCHAs to Deliver Malware to Ukrainian Devices

ClickLock: New macOS Infostealer Kills Apps Every 210ms to Force Password Entry

ClickLock: New macOS Stealer Kills Every App Until You Type Your Password

SCMBANKER Malware Uses ClickFix Lures to Target Mexican Banking Users

June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV

'Lorem Ipsum' Malware Pivots to ClickFix Delivery via WordPress

Axios npm Hack Used Fake Teams Error Fix to Hijack

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal

Cloudflare-Themed ClickFix Attack Drops Infiniti Stealer on Macs

New Infinity Stealer Malware Grabs macOS Data via ClickFix

LeakNet Ransomware Weaponizes ClickFix and Deno Runtime for Stealthy Corporate Attacks

Termite Ransomware Operator Velvet Tempest Chains ClickFix

How to Detect and Block ClickFix Attacks

Late February Roundup: New Guides, Checklists & Threat

ClickFix Attacks Evolve to Abuse DNS nslookup for Payload Delivery

Claude AI Artifacts Abused to Distribute macOS Infostealer

ClickFix Campaign Targets European Hotels with Fake

North Korea Deploys AI-Generated Video and ClickFix

North Korean Hackers Use Fake Zoom Meeting to Target Crypto