Loading story…
The TA585 threat group has orchestrated a sophisticated cybercrime operation leveraging the MonsterV2 Malware-as-a-Service (MaaS) platform and advanced social engineering techniques, notably the ClickFix method. TA585 distinguishes itself by controlling the entire attack chain, from infrastructure hosting to phishing campaign execution and malware deployment, without relying on external brokers. Their primary payload, MonsterV2, is a subscription-based, multi-functional malware capable of data theft and system takeover, and is distributed through highly targeted phishing campaigns. The group employs advanced filtering and anti-bot systems to ensure only genuine victims are targeted, and has also been observed distributing other infostealers such as Lumma Stealer and Rhadamanthys.
ClickFix attacks, which have rapidly become one of the most prevalent social engineering threats in 2025, exploit user trust by convincing victims to copy and paste malicious commands into their own systems, bypassing traditional security awareness training. These attacks are often disguised as verification steps, CAPTCHA checks, or even social media tutorials, and have been observed spreading through trusted platforms, including GitHub. A new variant, FileFix, further refines this approach by leveraging Windows File Explorer for stealthier execution. Security researchers have noted a dramatic increase in ClickFix-style attacks, with detections rising over 500% in six months and HTML/FakeCaptcha (ClickFix) ranking among the top malware detections in early 2025.
Get the infrastructure and lures behind it.
8 events from the most recent confirmed update back to the earliest known activity.
TA585 also reportedly used fake GitHub issue notifications that appeared to be security warnings and tagged users to draw attention. The notifications redirected targets to attacker-controlled ClickFix pages as part of the infection chain.
In 2025, TA585 was described as operating an end-to-end campaign using ClickFix lures on compromised sites and phishing pages to trick victims into running PowerShell commands. Those commands downloaded follow-on scripts designed to bypass defenses and install MonsterV2.
ClickFix kits became commercialized on dark web forums, lowering the barrier to entry for attackers. This commercialization helped broaden use of the technique across a wider range of threat actors.
By late 2025, FileFix had been observed in campaigns delivering malware including Interlock RAT and the StealC infostealer. This showed the newer copy-paste technique was already being operationalized for real malware delivery.
Multiple notable campaigns used ClickFix-style social engineering in 2025, including PhantomCaptcha linked to Star Blizzard and TikTok-themed scams distributing Aura Stealer. These operations relied on fake verification or troubleshooting prompts to trick users into pasting malicious commands.
ClickFix campaigns expanded rapidly in 2025, with reported growth of more than 500% over six months. The technique was used against organizations in sectors including technology, finance, government, and energy, and was adopted by both cybercriminal and nation-state actors.
FileFix, an evolution of ClickFix that abuses the Windows File Explorer address bar to execute malicious code, was first revealed. The technique was described as stealthier than standard ClickFix because it can avoid some normal security prompts and alerts.
MonsterV2, a subscription-based malware-as-a-service platform with data theft and remote takeover capabilities, was first advertised in underground forums. It later became a primary payload associated with TA585 ClickFix campaigns.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybercriminals are leveraging social engineering techniques known as ClickFix and its new variant, FileFix, to trick users into executing malicious commands on their Windows systems. The ClickFix method involves compromised websites displaying fake CAPTCHA-style pages that prompt users to "verify you are human." When users interact with these pages, malicious content is injected into their clipboard, and they are instructed to paste and run this content via the Windows Run dialog, leading to the installation of remote access tools such as NetSupport RAT. The SmartApeSG campaign is one example actively using this approach, with infection chains triggered under specific conditions on compromised sites. The FileFix variation, recently observed in the wild, shifts the attack vector by instructing users to paste malicious commands into the Windows File Explorer address bar instead of the Run dialog. This subtle change exploits user familiarity with File Explorer, making the attack less suspicious and increasing the likelihood of success. Both techniques rely on phishing emails or fake service pages to lure victims, and the end goal is typically the deployment of remote access malware. Security teams should be aware of these evolving tactics and educate users about the risks of following unsolicited instructions involving system dialogs or file paths.
Jun 29, 2026
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims. ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Jul 1, 2026
Cybersecurity researchers have identified a new threat actor, TA585, which has been actively delivering the MonsterV2 malware through a series of sophisticated phishing campaigns. TA585 distinguishes itself by managing its entire attack chain, from infrastructure setup and email delivery to malware installation, without relying on third-party distribution services or initial access brokers. The group has been observed using U.S. Internal Revenue Service (IRS) themed phishing lures to entice victims into clicking malicious links. These links often direct users to PDFs that further redirect to web pages employing the ClickFix social engineering tactic, which prompts users to execute malicious commands via the Windows Run dialog or PowerShell terminal. The initial PowerShell command triggers a secondary script that ultimately deploys MonsterV2 on the victim's system. In later campaigns, TA585 shifted tactics to use malicious JavaScript injections on legitimate websites, presenting fake CAPTCHA overlays to initiate the infection process. This approach also leverages ClickFix to deliver the malware payload. MonsterV2, also known as Aurotun Stealer, is a remote access trojan (RAT), stealer, and loader, first advertised on criminal forums in February 2025. The malware is notable for its high price and limited user base, with TA585 being one of the few actors deploying it. MonsterV2 is designed to avoid infecting systems located in Commonwealth of Independent States (CIS) countries, demonstrating a level of geographic targeting. Prior to adopting MonsterV2, TA585 campaigns distributed other malware such as Lumma Stealer, indicating a shift in their preferred payloads. The group’s use of web injection and filtering checks adds complexity to their attack chains, making detection and mitigation more challenging. Researchers have highlighted TA585’s innovation in the constantly evolving cybercrime landscape, noting their deviation from the typical "gig economy" model of cybercrime by maintaining end-to-end control over their operations. The campaigns have evolved over time, with new delivery techniques and social engineering tactics being introduced to increase infection rates. The technical sophistication of TA585’s infrastructure and delivery methods underscores the growing threat posed by self-sufficient cybercriminal groups. Security teams are advised to monitor for indicators of compromise related to MonsterV2 and to educate users about phishing tactics involving IRS-themed lures and fake CAPTCHA overlays. The emergence of TA585 and its operational model signals a trend toward more autonomous and innovative threat actors in the cybercrime ecosystem. Ongoing research and intelligence sharing are critical to tracking the evolution of TA585 and mitigating the risks associated with MonsterV2 and similar malware families.
Jun 29, 2026