Loading story…
Microsoft Threat Intelligence disclosed a new ClickFix social-engineering variant that abuses DNS lookups as a lightweight staging/signaling channel. Victims are redirected via phishing, malvertising, or compromised sites to fake prompts (e.g., bogus CAPTCHA or “fix this issue” messages) that instruct them to run a command through the Windows Run dialog (or similar execution paths). The initial command launches cmd.exe and runs nslookup against a hard-coded, attacker-controlled external DNS server rather than the system’s default resolver, reducing reliance on traditional web requests and helping activity blend into normal network traffic.
In the observed technique, the attacker-controlled DNS response is parsed and the output is filtered to extract the Name: field, which is repurposed to carry the second-stage payload; that extracted content is then executed on the endpoint. Reporting notes this approach adds a validation step (confirming an active target before delivering heavier components) and can bypass some security controls because the user effectively initiates the infection themselves. The activity is positioned as part of the broader, rapidly evolving ClickFix ecosystem, which has spawned multiple variants (e.g., CrashFix, FileFix, JackFix, ConsentFix, GlitchFix) as adversaries iterate on lures and delivery mechanics.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
After the disclosure, researcher Muhammad Hassoub published CrowdStrike CQL hunting queries and detection guidance focused on suspicious nslookup.exe execution and anomalous DNS patterns tied to the campaign. The recommendations urged defenders to expand monitoring beyond PowerShell-centric detections to catch living-off-the-land DNS abuse.
By mid-February 2026, Microsoft publicly warned that attackers were using DNS as a staging and signaling channel in ClickFix campaigns, helping the activity blend into normal network traffic and dynamically change payloads. The disclosure highlighted abuse of nslookup and the use of the DNS 'Name' field to carry executable content.
Microsoft Defender researchers observed a new ClickFix variant that instructs victims to run an nslookup command against an attacker-controlled DNS server, extracting a second-stage payload from the DNS response. The chain then downloaded a ZIP, ran malicious Python-based reconnaissance components, established persistence with a VBScript and Startup shortcut, and deployed ModeloRAT.
In 2025, law enforcement disrupted Lumma Stealer operations, though later reporting said the malware ecosystem remained resilient and continued to appear in ClickFix-style delivery chains. This event is mentioned as background to concurrent social-engineering campaigns active in 2026.
Over 2024 and 2025, ClickFix expanded beyond early techniques into several variants, including account-takeover and in-browser transaction-hijacking approaches. Reports describe a steady evolution of fake CAPTCHA, error, and troubleshooting lures used to trick users into self-infecting systems.
ClickFix social-engineering activity was first spotted around 2024, according to later reporting that places its initial discovery roughly two years before February 2026. The campaigns relied on fake prompts and user-executed commands rather than software exploitation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcedarkreading.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026
Multiple reports highlighted **ClickFix**, a social-engineering technique that uses fake verification or update prompts to coerce users into manually executing attacker-supplied commands, as a recurring initial access method in recent malware activity. In the **OCRFix** botnet campaign, victims were lured to a typosquatted site impersonating *Tesseract OCR* (`tesseract-ocr[.]com` lookalike) via SEO poisoning and reported **LLM poisoning** (chatbot recommendations pointing users to the malicious site). The site presented a fake CAPTCHA that copied an obfuscated PowerShell command to the clipboard and instructed the user to paste it into PowerShell; this led to retrieval of a malicious MSI (`98166e51.msi`) from `opsecdefcloud[.]com`, after which victims were redirected to the legitimate GitHub project to reduce suspicion. The loader then queried a **BNB TestNet** smart contract to obtain C2 details, using **EtherHiding** (blockchain-hosted instructions) to make takedown and disruption more difficult. A separate investigation described a **Chrome extension supply-chain compromise** of *QuickLens – Search Screen with Google Lens* (7,000+ users), where attackers acquired the extension and shipped an update embedding malicious scripts and elevated permissions to enable credential/crypto theft and staged payload delivery; the campaign also incorporated a **ClickFix** flow that masqueraded as a legitimate browser update to trick users into executing malicious code. Other items in the set covered different topics: an AiTM phishing-kit attribution case study (focused on reverse-proxy phishing infrastructure rather than ClickFix), research on **Funnull/Fangneng CDN** as cybercrime-enabling infrastructure and related supply-chain activity, and Zscaler reporting on **Dust Specter APT** targeting Iraqi government officials with password-protected RAR delivery and custom malware modules—none of which were primarily about ClickFix.
Jun 29, 2026