Loading malware…
ClickFix is a social-engineering malware delivery technique and mature Malware-as-a-Service ecosystem that tricks victims into manually executing attacker-supplied commands on their own systems. It commonly presents fake CAPTCHA checks, Cloudflare verification pages, browser or operating system update prompts, meeting errors, SSL warnings, or job-interview themed lures. The lure page typically uses JavaScript to place a malicious command into the victim’s clipboard, then instructs the user to paste and run it in Windows Run, Windows Terminal, or macOS Terminal. Rather than relying on software exploitation, ClickFix abuses trusted user actions and legitimate system tools to initiate compromise.
ClickFix campaigns are used to deliver a wide range of payloads, especially infostealers and remote access trojans. Frequently reported payloads include Lumma Stealer, DarkGate, XWorm, AsyncRAT, NetSupport, SectopRAT, CastleLoader-delivered RATs, and other post-exploitation implants. Observed infection chains often execute largely in memory and abuse signed or native binaries such as PowerShell, mshta, curl, rundll32, finger, tar, cmd, and other living-off-the-land tools to reduce detection. Some campaigns also use DLL sideloading, shellcode loaders, Python runtimes, Tor-routed communications, blockchain-based configuration retrieval, and API-driven backends that generate unique obfuscated commands per victim.
The ecosystem has industrialized since first emerging in 2024. Underground ClickFix kits have been sold with prebuilt lure templates, payload integration, domain rotation, malvertising support, and operator support channels. Researchers have documented multi-operator backend infrastructure, antivirus-evasion claims, and delivery workflows tailored by operating system and language. Related variants and adjacent tradecraft include CrashFix, FileFix, PromptFix, ConsentFix, and ClickFake Interview.
Delivery has been observed through compromised websites used as watering holes, poisoned WordPress and Ghost CMS sites, phishing and fake job-interview workflows, malvertising, SEO poisoning, and fake software or browser update pages. Threat actors ranging from commodity cybercriminals to state-linked groups have incorporated ClickFix into operations. Public reporting has linked ClickFix-style campaigns to APT28, MuddyWater, Kimsuky, and North Korean Contagious Interview activity, while financially motivated actors have used it to broaden initial access and malware deployment.
ClickFix targets both Windows and macOS users. On Windows, campaigns commonly lead to credential theft, session theft, persistence, reconnaissance, lateral movement, and broader post-exploitation through RAT payloads. On macOS, ClickFix-style delivery has been used to deploy infostealers that harvest validated login passwords, browser credentials, cookies, crypto-wallet data, Keychain contents, and password-manager material, sometimes using coercive forced-interaction techniques to obtain user secrets. ClickFix is best understood not as a single malware family but as a scalable operator-driven delivery framework for initial access and follow-on malware execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers used the Ghost CMS vulnerability to tamper with website articles by appending malicious JavaScript loaders to the bottom of pages. These loaders were designed to support ClickFix attacks — a growing social engineering tactic that tricks users into manually executing malware on their systems. | A critical Ghost CMS vulnerability identified as CVE-2026-26980 has been exploited in a widespread cyber campaign that compromised more than 700 websites... The Ghost CMS vulnerability is an SQL injection flaw affecting Ghost’s Content API.
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise.
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise.
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise.
Recent Contagious Interview campaigns, also referred to as ClickFake Interview, involve a social engineering technique known as ClickFix. A targeted job seeker receives an invitation to participate in a job application process... instructed to copy and paste command lines... to download and execute a supposed update... unknowingly deploying malware in the process.
Recent Contagious Interview campaigns, also referred to as ClickFake Interview, involve a social engineering technique known as ClickFix. A targeted job seeker receives an invitation to participate in a job application process... instructed to copy and paste command lines... to download and execute a supposed update... unknowingly deploying malware in the process.
"...a new ClickFix variant we have dubbed 'CrashFix' that intentionally crashes the browser then baits users into running malicious commands..."
28 distinct techniques documented for this family, organized by ATT&CK tactic.
...compromising WordPress sites to show ClickFix-style prompts to site administrators...
The script uses base64 decoding and an XOR key to execute the EtherHiding loader seamlessly.
This action pastes a hidden PowerShell command, which the malicious script secretly copied to the user’s clipboard, directly into the Windows Terminal.
The decoded payload is a daemon... and calls back to genomicsforge[.]com for an AppleScript payload (on macOS) executed via osascript.
The real action is a curl request to genomicsforge[.]com that downloads and immediately pipes a shell script to zsh.
The attackers used the Ghost CMS vulnerability to tamper with website articles by appending malicious JavaScript loaders to the bottom of pages.
Via osascript, the attacker can read files, access the macOS Keychain, capture screenshots, and automate GUI apps to export saved passwords.
Security researchers say the attacks leveraged weaknesses in the Ghost content management system to inject malicious JavaScript code aimed at facilitating ClickFix malware attacks.
The downloaded script is a gzip-compressed, Base64-encoded payload that decompresses and evals itself entirely in memory.
Stage three presented a convincing fake Cloudflare verification page, tricking users into pressing WIN+R, pasting a command, and hitting Enter.
Via osascript, the attacker can read files, access the macOS Keychain, capture screenshots, and automate GUI apps to export saved passwords.
Rather than hardcoding command-and-control infrastructure, the script dynamically retrieves its configuration from a Polygon blockchain smart contract, allowing attackers to rotate infrastructure without modifying compromised sites.
466 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
64 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Technique d’ingénierie sociale industrialisée en MaaS qui pousse la victime à exécuter une commande copiée dans le presse-papiers; la chaîne d’exécution utilise des binaires système légitimes et peut livrer des payloads en mémoire sans écriture disque.
Used as the social-engineering delivery front end for the ClickLock campaign, presenting a fake Cloudflare CAPTCHA workflow that convinces victims to paste commands into Terminal.
A social-engineering-driven MaaS ecosystem that tricks users into pasting attacker-provided commands into Windows Run or macOS Terminal, typically via fake CAPTCHA, browser update, meeting error, or IT-themed lure pages. It avoids exploiting vulnerabilities directly and instead abuses trusted system tools such as PowerShell, mshta, and curl to deliver follow-on payloads.
A social-engineering malware delivery technique that displays a fake CAPTCHA and tricks users into executing a hidden PowerShell command, which downloads and launches a multi-stage infection chain leading to a RAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.