IUAM ClickFix Generator

IUAM ClickFix Generator is a web-based phishing kit used to operationalize the ClickFix social-engineering technique and enable lower-skill threat actors to deliver malware. Palo Alto Networks Unit 42 reported that it generates customizable phishing pages that mimic browser verification or challenge-response screens used by CDNs and cloud security providers, including Cloudflare-themed lures. The kit allows operators to customize page titles, domains, content, and prompts, and can automatically inject JavaScript to copy a malicious command to the victim’s clipboard. It detects whether the visitor is on mobile, Windows, or macOS, can instruct mobile users to switch to desktop, and can tailor the copied command to the victim operating system. Reported capabilities also include obfuscation options.

Observed campaigns used pages created by IUAM ClickFix Generator, or a variant, to target Windows and macOS users and deliver infostealer malware. Specifically, reporting states it has been used to deploy DeerStealer and Odyssey Stealer, with one campaign tied to the Odyssey malware-as-a-service ecosystem. The content indicates the kit reduces the effort required to run convincing ClickFix campaigns and reflects a broader commoditization trend similar to phishing-as-a-service. High-confidence behavior described in the reporting centers on fake verification lures, clipboard manipulation, OS-aware payload delivery, and use in phishing-driven malware distribution.