Loading story…
A new wave of social engineering attacks, known as ClickFix and its variant JackFix, is leveraging highly convincing fake Windows Update screens to trick users into executing malicious commands on their systems. Attackers lure victims—often through malvertising or fake adult websites—onto pages that mimic legitimate Windows update prompts, instructing them to open the Windows Run dialog and paste a command copied to their clipboard. This command initiates a multi-stage infection chain, typically resulting in the deployment of infostealer malware such as Lumma or Rhadamanthys. The campaigns employ advanced evasion techniques, including the use of mshta.exe, obfuscated scripts, and steganography to hide malicious payloads within PNG images, all executed in-memory to avoid detection by endpoint security solutions.
The JackFix variant intensifies the psychological manipulation by combining anxiety-inducing phishing lures with full-screen browser hijacks, making the fake update appear urgent and legitimate. Reports indicate a significant increase in JackFix-related incidents, with hundreds of submissions to VirusTotal, particularly in the US and Europe. Technical analysis reveals that these attacks are evolving to bypass existing ClickFix mitigations, using new delivery chains and contextually relevant lures. The campaigns are believed to be operated by Russian-speaking threat actors, as evidenced by developer comments found in some attack infrastructure. Organizations are advised to educate users about these sophisticated lures and implement technical controls to block the execution of suspicious commands and scripts.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
Researchers found Russian-language comments in the lure code and other overlaps suggesting the operators were likely Russian-speaking cybercriminals. Reports also noted infrastructure overlap with other stealer-delivery campaigns and broad activity concentrated in the US and Europe.
Researchers documented a new ClickFix variant dubbed JackFix that used fake pornography sites, malvertising, and fake Windows blue-screen or update prompts to increase psychological pressure on victims. The variant was designed to bypass existing ClickFix mitigations and improve infection success.
Technical analysis revealed that the new campaign concealed malware inside PNG image pixel data and used mshta and obfuscated PowerShell to decrypt and load a .NET loader. Final payloads included infostealers such as LummaC2 and Rhadamanthys, with code injection into trusted processes like explorer.exe.
By November 2025, researchers identified a new ClickFix campaign that used convincing full-screen fake Windows Update pages to trick users into pasting and running malicious commands through the Windows Run dialog. The campaign targeted Windows users and corporate employees and relied heavily on user interaction.
Huntress reported that ClickFix-related incidents increased by 313% over the previous six months, indicating significant growth in the technique's use during 2025. The increase provided context for the later emergence of more advanced lures and delivery methods.
As of 2025-11-19, fake Windows Update sites used in the campaign were still online, although the malware payloads were no longer being hosted there. This showed that parts of the campaign infrastructure remained available even after some content had been removed.
In May 2025, NCC Group reported a ClickFix-style attack in which victims were tricked via a fake CAPTCHA into executing malicious commands that led to LummaC2 infection. This established an earlier related variant before the later fake Windows Update wave.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
csoonline.com
Open sourcehelpnetsecurity.com
Open sourcedarkreading.com
Open sourcemalwarebytes.com
Open sourcethehackernews.com
Open sourcecsoonline.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have significantly upgraded the ClickFix malware delivery technique, incorporating sophisticated social engineering tactics inspired by online retail sites. Recent campaigns feature embedded tutorial videos, countdown timers, and dynamic counters such as "users verified in the last hour" to create a sense of urgency and legitimacy, closely mimicking trusted services like Cloudflare's bot checks. The malicious pages automatically detect the visitor's operating system and provide tailored instructions, even copying the necessary malicious code to the user's clipboard via JavaScript, making the infection process seamless and convincing for victims. ClickFix lures are distributed through multiple channels, including email, instant messaging, social networks, in-app phishing, and especially malvertising on platforms like Google Search, YouTube, and Steam. The primary objective is to trick users into pasting and executing malicious code, which typically results in the deployment of information-stealing malware. According to Push Security and the 2025 Microsoft Digital Defense report, ClickFix has become the most prevalent initial access method, accounting for nearly half of observed attacks in the past year. The evolution of these attacks, with multi-OS support and enhanced deception techniques, underscores the growing sophistication and reach of social engineering threats in the current threat landscape.
Jul 1, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Threat actors have adopted a sophisticated attack chain known as ClickFix, which leverages deceptive social engineering lures and advanced steganography to deliver malware. The campaign begins with convincing fake human verification screens or Windows Update notifications that prompt users to open the Windows Run dialog and execute a command copied to their clipboard. This command initiates a multi-stage infection process, ultimately leading to the download and execution of malicious payloads concealed within PNG image files. The attackers use a custom steganographic algorithm to encode shellcode directly into the pixel data of these images, reconstructing and decrypting the payload entirely in memory to evade detection. Security researchers have observed the ClickFix technique evolving, with newer lures mimicking legitimate Microsoft update processes in full-screen mode to increase credibility. The infection chain often results in the deployment of information-stealing malware, and in some cases, ransomware such as Qilin. The campaign highlights the growing sophistication of social engineering tactics and the use of steganography to bypass traditional security controls, posing a significant threat to organizations and individuals alike.
Jun 29, 2026