Loading story…
Attackers increasingly use deceptive links and files to trick users into revealing sensitive information or enabling tracking, often by disguising themselves as trusted entities such as government agencies, tech companies, or even acquaintances. These social engineering tactics can lead to account takeovers, impersonation, and the deployment of malware, with some attackers leveraging advanced methods like voice cloning or exploiting vulnerabilities in everyday communications. Security experts emphasize the importance of user awareness and technical defenses to mitigate these risks, highlighting real-world examples of both successful attacks and countermeasures.
Recent discussions in the cybersecurity community underscore the evolving nature of these threats, including the use of cracked software and game cheat videos on platforms like YouTube to distribute malware. Attackers exploit user trust and curiosity, embedding malicious payloads in seemingly innocuous downloads or communications. Defenders are responding with improved detection tools and educational efforts, but the ongoing arms race between attackers and security teams means vigilance remains essential for both individuals and organizations.
Get the infrastructure and lures behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are increasingly leveraging legitimate IT tools and browser features to gain unauthorized access to victims' systems and steal credentials. Recent campaigns have exploited Remote Monitoring and Management (RMM) software such as LogMeIn Resolve (GoToResolve) and PDQ Connect, tricking users into installing these trusted applications under false pretenses. Once installed, these tools provide attackers with full remote access, often bypassing traditional security controls due to their legitimate nature. Attackers distribute these installers through convincing phishing emails and fake websites that mimic popular utility download pages, using legitimate domains like Dropbox to evade detection. The attackers pre-configure the RMM tools with their own identifiers, allowing seamless control over compromised systems. In parallel, social engineering attacks are evolving to exploit browser features and cloned websites. The ClickFix attack, for example, uses fake ChatGPT Atlas browser installers distributed via cloned sites and sponsored search results to deliver password-stealing malware. Similarly, the Matrix Push C2 platform abuses browser push notifications as a fileless attack vector, tricking users into enabling notifications that deliver fake system alerts and redirect to malicious sites. These techniques rely on the inherent trust users place in familiar brands and browser features, making them highly effective at bypassing both technical and human defenses.
Jun 29, 2026
Cybercriminals are increasingly leveraging sophisticated social engineering tactics that exploit users' trust in Microsoft branding and their tendency to follow technical instructions. Microsoft has reported a significant rise in ClickFix attacks, a method where attackers trick users into executing malicious code by presenting fake error messages or technical problems that appear to require immediate user intervention. These attacks are designed to bypass traditional phishing protections, as they rely on manipulating human behavior rather than exploiting technical vulnerabilities. According to Microsoft’s latest Digital Defense Report, ClickFix was observed as the initial access method in 47% of attacks, highlighting its widespread adoption among threat actors. The report also notes a broader trend of AI abuse, extortion, and ransomware, but emphasizes the unique danger posed by ClickFix due to its adaptability and reliance on social engineering. In parallel, security researchers at Cofense have identified a new tech support scam that uses Microsoft’s logo and branding to create a convincing illusion of a browser lock, further manipulating victims into believing their systems are compromised. This scam typically begins with a phishing email offering a fake refund, luring users to click a link that leads to a CAPTCHA challenge, which both increases the attack’s credibility and helps evade automated security tools. Once the victim completes the CAPTCHA, they are confronted with pop-ups mimicking genuine Microsoft security alerts, and their browser is manipulated to appear locked, even disabling mouse control to heighten the sense of urgency and panic. The attackers then prompt the victim to call a fake support number, where further social engineering is used to steal sensitive information or gain deeper access to the victim’s system. Both attack types demonstrate a shift in cybercriminal tactics toward exploiting human psychology and trusted brands, rather than relying solely on technical exploits. Microsoft’s data-driven insights underscore the scale of the problem, with the company processing over 100 trillion signals daily and blocking millions of malware and phishing attempts. The sophistication of these attacks makes user awareness and behavioral change critical, as traditional security tools may not detect or prevent such threats. Organizations are urged to educate users about these evolving tactics, emphasizing the risks of following unsolicited technical instructions or responding to suspicious support requests. The convergence of ClickFix and tech support scams signals a broader trend in cybercrime, where attackers blend technical manipulation with psychological pressure to achieve their objectives. As these methods continue to evolve, both individuals and enterprises must remain vigilant and adapt their defenses accordingly. The use of Microsoft branding in these scams amplifies their effectiveness, making it essential for users to verify the legitimacy of any technical prompts or support communications. Security teams should update training materials and incident response protocols to address these emerging threats, ensuring rapid detection and mitigation. The ongoing rise of such social engineering attacks highlights the need for a multi-layered security approach that combines technical controls with robust user education.
Jun 29, 2026
Cybercriminals are increasingly leveraging ClickFix-style social engineering attacks to distribute information-stealing malware, with a notable surge in campaigns utilizing popular platforms such as TikTok. In these attacks, threat actors create videos or web pages that purport to offer legitimate activation guides or fixes for widely used software, including Windows, Microsoft 365, Adobe Premiere, Photoshop, CapCut Pro, and Discord Nitro. The core technique involves tricking users into copying and pasting malicious PowerShell commands or scripts into their systems, often under the guise of resolving software issues or unlocking premium features. Once executed, these commands connect to attacker-controlled infrastructure to download and run additional payloads, such as the Aura Stealer malware, which is designed to harvest browser credentials, authentication cookies, cryptocurrency wallet information, and other sensitive data. The attacks are highly effective due to their use of legitimate-looking lures, such as fake CAPTCHAs, embedded instructional videos, and professional web design, which lower user suspicion and bypass traditional security awareness training that focuses on phishing links and suspicious downloads. Security researchers have linked these tactics to both financially motivated cybercriminal groups, such as Interlock ransomware, and state-sponsored advanced persistent threats (APTs). Recent public breaches at organizations like Kettering Health, DaVita, City of St. Paul, and Texas Tech University Health Sciences Centers have been attributed to ClickFix-style techniques, though the full extent of their impact is likely underreported. The attacks are further amplified by the viral nature of social media platforms, where malicious videos can quickly reach large audiences. Technical analysis reveals that the malicious scripts often use JavaScript to automate clipboard actions, making the attack seamless for the victim. Once the initial payload is executed, additional malware may be downloaded to establish persistence or exfiltrate data. Security experts warn that user education must evolve to address these new attack vectors, emphasizing the dangers of running copied commands and the importance of verifying the source of any technical instructions. Organizations are advised to implement technical controls to block suspicious script execution and to monitor for signs of credential theft and unauthorized access. The growing prevalence of ClickFix attacks highlights the need for a multi-layered defense strategy that combines user awareness, endpoint protection, and proactive threat intelligence.
Jun 29, 2026