Loading story…
Cybercriminals are increasingly leveraging sophisticated social engineering tactics that exploit users' trust in Microsoft branding and their tendency to follow technical instructions. Microsoft has reported a significant rise in ClickFix attacks, a method where attackers trick users into executing malicious code by presenting fake error messages or technical problems that appear to require immediate user intervention. These attacks are designed to bypass traditional phishing protections, as they rely on manipulating human behavior rather than exploiting technical vulnerabilities. According to Microsoft’s latest Digital Defense Report, ClickFix was observed as the initial access method in 47% of attacks, highlighting its widespread adoption among threat actors. The report also notes a broader trend of AI abuse, extortion, and ransomware, but emphasizes the unique danger posed by ClickFix due to its adaptability and reliance on social engineering. In parallel, security researchers at Cofense have identified a new tech support scam that uses Microsoft’s logo and branding to create a convincing illusion of a browser lock, further manipulating victims into believing their systems are compromised. This scam typically begins with a phishing email offering a fake refund, luring users to click a link that leads to a CAPTCHA challenge, which both increases the attack’s credibility and helps evade automated security tools. Once the victim completes the CAPTCHA, they are confronted with pop-ups mimicking genuine Microsoft security alerts, and their browser is manipulated to appear locked, even disabling mouse control to heighten the sense of urgency and panic. The attackers then prompt the victim to call a fake support number, where further social engineering is used to steal sensitive information or gain deeper access to the victim’s system. Both attack types demonstrate a shift in cybercriminal tactics toward exploiting human psychology and trusted brands, rather than relying solely on technical exploits. Microsoft’s data-driven insights underscore the scale of the problem, with the company processing over 100 trillion signals daily and blocking millions of malware and phishing attempts. The sophistication of these attacks makes user awareness and behavioral change critical, as traditional security tools may not detect or prevent such threats. Organizations are urged to educate users about these evolving tactics, emphasizing the risks of following unsolicited technical instructions or responding to suspicious support requests. The convergence of ClickFix and tech support scams signals a broader trend in cybercrime, where attackers blend technical manipulation with psychological pressure to achieve their objectives. As these methods continue to evolve, both individuals and enterprises must remain vigilant and adapt their defenses accordingly. The use of Microsoft branding in these scams amplifies their effectiveness, making it essential for users to verify the legitimacy of any technical prompts or support communications. Security teams should update training materials and incident response protocols to address these emerging threats, ensuring rapid detection and mitigation. The ongoing rise of such social engineering attacks highlights the need for a multi-layered security approach that combines technical controls with robust user education.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Subsequent coverage described ClickFix as an attack that effectively tricks victims into 'hacking themselves' by manually executing malicious commands. The reporting focused on how to recognize the scam pattern and avoid being manipulated into running attacker-supplied code.
Researchers reported a tech-support scam that uses Microsoft branding and a fake browser-lock screen to pressure victims into believing their system is compromised. The scam is designed to steal data by convincing users to follow attacker-controlled instructions under the guise of Microsoft support.
Microsoft publicly warned that ClickFix is being used by both cybercriminal and nation-state actors to deliver malware including ransomware, infostealers, and remote access trojans. The company emphasized that user awareness and behavior change are the primary defenses because standard anti-phishing controls are often ineffective against this tactic.
Microsoft observed a major increase in the use of the ClickFix tactic, reporting that it accounted for 47% of initial access methods seen by Microsoft Defender Experts. The technique tricks users into copying and pasting malicious commands from fake error messages or phishing lures, enabling fileless malware execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
4 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcezdnet.com
Open sourcezdnet.com
Open sourcehackread.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are increasingly leveraging ClickFix-style social engineering attacks to distribute information-stealing malware, with a notable surge in campaigns utilizing popular platforms such as TikTok. In these attacks, threat actors create videos or web pages that purport to offer legitimate activation guides or fixes for widely used software, including Windows, Microsoft 365, Adobe Premiere, Photoshop, CapCut Pro, and Discord Nitro. The core technique involves tricking users into copying and pasting malicious PowerShell commands or scripts into their systems, often under the guise of resolving software issues or unlocking premium features. Once executed, these commands connect to attacker-controlled infrastructure to download and run additional payloads, such as the Aura Stealer malware, which is designed to harvest browser credentials, authentication cookies, cryptocurrency wallet information, and other sensitive data. The attacks are highly effective due to their use of legitimate-looking lures, such as fake CAPTCHAs, embedded instructional videos, and professional web design, which lower user suspicion and bypass traditional security awareness training that focuses on phishing links and suspicious downloads. Security researchers have linked these tactics to both financially motivated cybercriminal groups, such as Interlock ransomware, and state-sponsored advanced persistent threats (APTs). Recent public breaches at organizations like Kettering Health, DaVita, City of St. Paul, and Texas Tech University Health Sciences Centers have been attributed to ClickFix-style techniques, though the full extent of their impact is likely underreported. The attacks are further amplified by the viral nature of social media platforms, where malicious videos can quickly reach large audiences. Technical analysis reveals that the malicious scripts often use JavaScript to automate clipboard actions, making the attack seamless for the victim. Once the initial payload is executed, additional malware may be downloaded to establish persistence or exfiltrate data. Security experts warn that user education must evolve to address these new attack vectors, emphasizing the dangers of running copied commands and the importance of verifying the source of any technical instructions. Organizations are advised to implement technical controls to block suspicious script execution and to monitor for signs of credential theft and unauthorized access. The growing prevalence of ClickFix attacks highlights the need for a multi-layered defense strategy that combines user awareness, endpoint protection, and proactive threat intelligence.
Jun 29, 2026
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims. ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Jul 1, 2026
Security researchers reported several **social-engineering campaigns** that abuse trusted platforms to increase credibility and bypass controls. One campaign targeted wedding planners and related vendors by hijacking trust in *Microsoft Teams*: attackers used compromised legitimate email threads and impersonated legal professionals (e.g., `czimmerman@craigzlaw[.]com`) to lure victims into clicking a fake Teams meeting link that ultimately redirected to `ussh[.]life/connect/teamsfinal/9/windows`, a site masquerading as a Teams download page. Victims were prompted to download Windows executables consistent with **information-stealer** behavior (credential/browser/session-token theft and C2 exfiltration), enabling follow-on account takeover and additional phishing. Separately, a report highlighted **DKIM replay**-style phishing in which criminals abuse legitimate notification/invoice workflows from **PayPal, Apple, and DocuSign** to generate cryptographically signed emails that pass DKIM/DMARC checks; attackers place scam content (often a fake support phone number and urgency) into user-controlled fields, send the message to themselves to obtain a “clean” vendor-signed email, then forward it to targets. Another campaign used **Bing search ads** to funnel users through a newly registered domain (`highswit[.]space`) to scam pages hosted on **Microsoft Azure Blob Storage** (consistent path pattern including `werrx01USAHTML/index.html` and a phone-number parameter), presenting fake Microsoft security warnings and directing victims to call numbers such as `1-866-520-2041` and `1-833-445-4045`; Netskope observed impact across dozens of US organizations.
Jun 29, 2026