ClickFix
ClickFix is a social-engineering-driven malware delivery technique and associated infection chain in which victims are shown fake verification prompts, commonly impersonating Cloudflare CAPTCHA or "Checking if you are human" pages, and are tricked into manually executing attacker-supplied commands. The technique is primarily documented against Windows users via WIN+R, PowerShell, or malicious MSI/EXE execution, but multiple reports also describe macOS-focused variants using Terminal/bash commands and infostealer delivery. ClickFix has been observed on compromised legitimate websites, phishing domains, typosquatted job and travel sites, GitHub- and Adobe-themed lures, malicious ads, and poisoned CMS content including large-scale Ghost CMS and WordPress compromises.
Across the provided reporting, ClickFix is used as an initial access or malware delivery mechanism rather than a single payload family. Documented downstream payloads and tooling include CastleLoader, Python-based RATs, Lumma Stealer, Vidar, Impure Stealer, VodkaStealer, PySoxy, PureRAT, RedLine, ACRStealer/Efimer-like stealers, Electron-based data stealers, and macOS infostealers. Observed execution chains frequently abuse LOLBins and native tools such as powershell.exe, cmd.exe, finger.exe, curl.exe, tar.exe, rundll32.exe, wscript.exe, explorer.exe, and python.exe/pythonw.exe; some campaigns use Donut-based in-memory loaders, DLL sideloading, portable Python runtimes, Deno-based implants, or blockchain-hosted JavaScript/configuration via EtherHiding on BNB Smart Chain or Polygon.
Behavior described in the content includes clipboard hijacking or scripted copy-to-clipboard of malicious commands, staged payload retrieval from attacker infrastructure, in-memory execution, host fingerprinting, persistence via scheduled tasks and Registry Run keys, PowerShell-based relaunch logic, WebSocket or HTTPS C2, modular task execution, interactive shell access, proxying via PySoxy, screenshot capture, credential and cookie theft, browser and wallet theft, Keychain theft on macOS, and anti-analysis or cloaking logic to evade researchers and bots. Some campaigns used fake Cloudflare verification overlays localized into many languages, geofencing, Telegram-backed telemetry, and cloaking/traffic-distribution systems such as Adspect.
The content links ClickFix activity to multiple intrusion sets and operators, but attribution is campaign-specific and often unconfirmed. Reported associations include Booking.com-themed phishing, compromised hotel ecosystems, a Deno-based platform operated by an actor using the alias "Smokest," possible resemblance to UNC1069 tradecraft, and use by ransomware operators such as Interlock for initial access. Large-scale website poisoning campaigns exploiting Ghost CMS CVE-2026-26980 and widespread WordPress compromises were specifically reported as delivering ClickFix lures. Reported infrastructure and indicators vary by campaign and include domains such as dakatawebstick[.]com, strapness[.]com, overlateise[.]com, solimayticontexta[.]com, sabrineme[.]com, clo4shara[.]xyz, get-1o8.pages[.]dev, zipsage.pages[.]dev, hedgeweeks[.]online, and IPs including 94.26.90[.]100, 185.205.211[.]217, 206.206.103[.]106, 206.206.103[.]120, 167.99.158[.]97, 94.154.35[.]115, 109.107.161[.]194, and 217.138.194.181.
High-confidence infection vectors in the content include fake CAPTCHA/human-verification pages, compromised CMS articles with injected JavaScript loaders, malicious browser extension updates, phishing pages impersonating LinkedIn, Indeed, Booking.com, Zoom/Google Meet, Adobe activation guides, and GitHub-themed macOS lures. Targeting spans enterprise and consumer users globally, with affected sectors including higher education, AI, software, blockchain, cybersecurity, fintech, media, SaaS, hospitality, and cryptocurrency/Web3.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers used the Ghost CMS vulnerability to tamper with website articles by appending malicious JavaScript loaders to the bottom of pages. These loaders were designed to support ClickFix attacks — a growing social engineering tactic that tricks users into manually executing malware on their systems. | A critical Ghost CMS vulnerability identified as CVE-2026-26980 has been exploited in a widespread cyber campaign that compromised more than 700 websites... The Ghost CMS vulnerability is an SQL injection flaw affecting Ghost’s Content API.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"Interlock ransomware... heavily relies on ClickFix for initial access."
"...a new ClickFix variant we have dubbed 'CrashFix' that intentionally crashes the browser then baits users into running malicious commands..."
First tracked in early 2026, the operation uses a technique called ClickFix to manipulate victims into running malicious commands on their own machines — making them the unwitting delivery mechanism for the attack.
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 techniqueThe poisoned articles looked completely normal, with the malicious code silently embedded at the bottom of each page, waiting to activate when a reader scrolled through.
Execution
6 techniquesThe visual overlay instructs the victim to copy and execute a specialized command sequence inside PowerShell.
Shown above: ClickFix instructions pasted into a run Window.
The attackers used the Ghost CMS vulnerability to tamper with website articles by appending malicious JavaScript loaders to the bottom of pages.
Security researchers say the attacks leveraged weaknesses in the Ghost content management system to inject malicious JavaScript code aimed at facilitating ClickFix malware attacks.
Clicking this interface element instantly downloaded a compressed folder containing a malicious executable file.
"...inject a ClickFix implant impersonating a Cloudflare human verification challenge (CAPTCHA)..." and "...sets up the click event handler to copy the malicious command to the clipboard..."
Stealth
3 techniquesWhen the user pastes the code, the terminal decodes and executes the malware instantly.
Credential Access
1 techniqueDiscovery
3 techniquesScore Category Operation Count ... Discovery Checks external IP address 1
Collection
2 techniquesStage three presented a convincing fake Cloudflare verification page, tricking users into pressing WIN+R, pasting a command, and hitting Enter.
Meanwhile, the background script quietly replaces the user’s native clipboard contents with a base64-encoded payload string.
Command and Control
6 techniquesMITRE ATT&CK™ Matrix - Windows ... Command and Control Standard Application Layer Protocol
"Invoke-WebRequest" to retrieve payloads; "...fetch a script..."; "...download a shellcode blob..."
“Microsoft alerts on DNS-based ClickFix variant delivering malware via nslookup”
Threat actors store data (for example C2 configuration) or code on a public blockchain... they can access it through a legitimate API endpoint... SharkStealer and ArechClient2... pull their C2 configuration from a smart contract... ZigCryptoStealer... uses smart contracts to receive their C2 configuration.
"...multi-stage malware chain..."; "...Donut loader is used twice in sequence..."
For example, a macOS variant downloads binary data from remote servers before deleting its temporary files.
IOCs tracked for this family
98 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
53 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A social-engineering driven multi-stage infection chain that uses fake CAPTCHA/job-platform lures, LOLBins, the Finger protocol, portable Python runtimes, and in-memory shellcode execution to deploy CastleLoader and a Python-based RAT.
A social-engineering infection method/campaign theme that tricks users into executing a malicious file, initiating the compromise chain.
ClickFix was delivered through poisoned Ghost CMS pages using a fake Cloudflare verification lure that tricked users into executing a malicious command, leading to staged payload delivery.
ClickFix is described as a social engineering malware delivery tactic in which malicious JavaScript loaders injected into compromised Ghost CMS pages trick users into manually executing malware. In this campaign, the injected code acted as a two-stage loader that fetched additional payloads at runtime from attacker-controlled infrastructure.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.