Loading story…
A recent study by threat intelligence firm Lab539 revealed a significant overlap between infrastructure used for ClickFix attacks and adversary-in-the-middle (AiTM) operations. Researchers identified that 76% of the IP addresses associated with ClickFix, a technique that tricks users into running malicious code via browser-pasted scripts, are also used in AiTM attacks, which impersonate legitimate user logins to compromise networks. This crossover highlights the shared resources and tactics among cybercriminals, complicating efforts to block malicious activity based solely on infrastructure indicators.
The findings underscore the dominance of AiTM attacks, often delivered through phishing campaigns, malvertising, and supply chain compromises such as malicious npm packages. The research suggests that defenders can improve blocking strategies by recognizing the interconnected nature of attacker infrastructure, enabling more effective disruption of both ClickFix and AiTM campaigns. Enhanced monitoring of overlapping IP addresses and attack vectors is recommended to mitigate the evolving threat landscape.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
An analysis of ClickFix infrastructure was published, highlighting unexpected characteristics intended to improve defenders' blocking strategies. No earlier discrete events are described in the provided references.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple reports highlighted **ClickFix**, a social-engineering technique that uses fake verification or update prompts to coerce users into manually executing attacker-supplied commands, as a recurring initial access method in recent malware activity. In the **OCRFix** botnet campaign, victims were lured to a typosquatted site impersonating *Tesseract OCR* (`tesseract-ocr[.]com` lookalike) via SEO poisoning and reported **LLM poisoning** (chatbot recommendations pointing users to the malicious site). The site presented a fake CAPTCHA that copied an obfuscated PowerShell command to the clipboard and instructed the user to paste it into PowerShell; this led to retrieval of a malicious MSI (`98166e51.msi`) from `opsecdefcloud[.]com`, after which victims were redirected to the legitimate GitHub project to reduce suspicion. The loader then queried a **BNB TestNet** smart contract to obtain C2 details, using **EtherHiding** (blockchain-hosted instructions) to make takedown and disruption more difficult. A separate investigation described a **Chrome extension supply-chain compromise** of *QuickLens – Search Screen with Google Lens* (7,000+ users), where attackers acquired the extension and shipped an update embedding malicious scripts and elevated permissions to enable credential/crypto theft and staged payload delivery; the campaign also incorporated a **ClickFix** flow that masqueraded as a legitimate browser update to trick users into executing malicious code. Other items in the set covered different topics: an AiTM phishing-kit attribution case study (focused on reverse-proxy phishing infrastructure rather than ClickFix), research on **Funnull/Fangneng CDN** as cybercrime-enabling infrastructure and related supply-chain activity, and Zscaler reporting on **Dust Specter APT** targeting Iraqi government officials with password-protected RAR delivery and custom malware modules—none of which were primarily about ClickFix.
Jun 29, 2026
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims. ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Jul 1, 2026
Attackers are increasingly using **ClickFix** fake CAPTCHA and verification lures on compromised websites to trick users into manually executing malicious commands, turning social engineering into a scalable initial-access method. **LeakNet** adopted the technique to reduce reliance on stolen credentials and initial access brokers, using hacked sites to deliver a staged **Deno**-based in-memory loader before following a repeatable post-exploitation sequence that can end in ransomware deployment. Separately, the **ZPHP** campaign used similar fake Cloudflare Turnstile-style prompts against U.S. **SLTT** organizations to deliver **Remcos RAT**, with hidden JavaScript on compromised sites selectively replacing page content with attacker-controlled instructions for Windows users. The reporting indicates a broader shift in which ClickFix is no longer tied to a single actor or payload, but is being reused across financially motivated and malware-delivery operations because it is cheap, effective, and difficult for users to recognize as malicious. One additional roundup reference points to **Termite ransomware** and **CastleRAT** activity linked to ClickFix, reinforcing that the technique is spreading across campaigns, but it does not provide enough detail to treat that activity as the same incident as **LeakNet** or **ZPHP**. This is **not fluff**: the material contains concrete threat intelligence on active intrusion methods, victim targeting, malware delivery chains, and operational tradecraft relevant to enterprise defense.
Jun 29, 2026