Loading story…
Security researchers reported multiple active campaigns using ClickFix social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by CERT Polska (cert.pl), victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a PowerShell command via Win+R; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to enterprise-wide compromise, including deployment of secondary malware such as Latrodectus and Supper for data theft, lateral movement, and potential ransomware staging.
A separate ClickFix operation targeted macOS developers by cloning the Homebrew site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from raw.homabrews.org instead of raw.githubusercontent.com, leading to Cuckoo Stealer deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at 5.255.123.244. ClickFix was also observed as the initial execution mechanism for the resurfaced Matanbuchus 3.0 MaaS loader, which uses deceptive copy/paste prompts and silent MSI execution (via msiexec) to deliver a new payload, AstarionRAT, enabling capabilities including credential theft and SOCKS5 proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
ReliaQuest said ClickFix was the leading malware delivery technique observed in cyberattacks it analyzed during March 2026. The firm reported the social-engineering method commonly delivered NetSupport RAT and Deepload, and was also used against macOS users to deliver Atomic Stealer (AMOS).
Following initial access in the Polish organization case, attackers deployed secondary payloads including Latrodectus and Supper to support data exfiltration, lateral movement, and possible ransomware activity. The chain used DLL side-loading with igfxSDK.exe and a malicious wtsapi32.dll, along with anti-analysis techniques.
CERT Polska identified suspicious traffic from a compromised host at a large Polish organization and traced it to a ClickFix lure that caused a user to run malicious PowerShell from the Windows Run dialog. The resulting infection chain downloaded a dropper and rapidly established a foothold.
Attackers used typosquatted Homebrew-themed sites to trick macOS developers into pasting a malicious Terminal command, leading to Cuckoo Stealer infection. The malware validated stolen passwords, established LaunchAgent persistence, and stole data from browsers, Keychain, wallets, and messaging apps.
The revived Matanbuchus 3.0 campaign used ClickFix social engineering to trick users into running malicious commands, then leveraged msiexec, DLL side-loading, and in-memory execution to deliver AstarionRAT. Huntress reported operators could move laterally in about 40 minutes and target domain controllers.
Matanbuchus, a malware-as-a-service loader, reappeared in February 2026 with a rewritten v3.0 release and subscription pricing reportedly reaching $15,000 per month. The new activity marked the loader's return after roughly a year of inactivity.
A key typosquatted domain, homabrews.org, was registered and later used to mimic the official Homebrew workflow in a ClickFix campaign targeting macOS developers. The fake install flow swapped the expected download host to attacker-controlled infrastructure.
Infrastructure later linked to the macOS ClickFix campaign used certificates dating back to July 2025, indicating attacker preparation and staging months before public reporting. Analysts tied multiple related typosquat domains to shared infrastructure at 5.255.123.244.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **ClickFix** campaigns that compromise endpoints by tricking users into manually executing attacker-provided commands rather than exploiting a software vulnerability. CERT Polska documented an incident response at a large Polish organization where a **fake CAPTCHA** prompt led a user to run a malicious snippet via *Win+R*, resulting in malware execution and suspected **DLL side-loading** from `%APPDATA%\Intel` (legitimate `igfxSDK.exe`/`version.dll` alongside a suspicious `wtsapi32.dll`). Investigators also identified additional suspicious DLLs in the user’s local AppData and recovered an execution trail consistent with a one-liner that fetched remote content and piped it into PowerShell (e.g., `cmd /c curl ... | powershell`). Separately, threat hunting research described a macOS-focused ClickFix operation using **typosquatted Homebrew** lookalike sites to present a “copy/paste” install command that runs in Terminal. The first-stage script repeatedly prompted for a password and validated it using `dscl authonly` to harvest working credentials before deploying a second-stage infostealer dubbed **Cuckoo Stealer**, which was reported to establish **LaunchAgent** persistence, remove quarantine attributes, and communicate over encrypted HTTPS C2 while targeting browser credentials/session tokens, Keychain data, notes/messaging artifacts, VPN/FTP configs, and cryptocurrency wallets. Both reports highlight ClickFix as an increasingly common, opportunistic initial access technique that scales by abusing trusted user workflows on Windows and macOS.
Jun 29, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
A **ClickFix**-style malware campaign has been observed using **fake CAPTCHA** pages on compromised websites to trick users into **manually executing** malicious commands, enabling initial access while evading controls that focus on downloaded files. In the reported activity, victims are prompted to copy a **PowerShell** command and run it themselves; the script then downloads additional stages from attacker infrastructure (including `91.92.240.219`), verifies user interaction by checking clipboard activity, and proceeds through a multi-stage infection chain. The payload is an **information stealer** targeting data from **25+ web browsers**, cryptocurrency wallets (e.g., *MetaMask*), and enterprise VPN configurations, with checks for virtualized environments and security tooling prior to exfiltration. Separately reported threat activity in the same time window includes **UnsolicitedBooker** targeting Central Asian telecoms with phishing-delivered backdoors (**LuciDoor** and **MarsSnake**) and **APT28** running *Operation MacroMaze*, which uses weaponized Office documents and `INCLUDEPICTURE` fields pointing to `webhook[.]site` URLs as a tracking mechanism and to support follow-on macro-based payload delivery. A video-style weekly briefing also mentions an evolution of ClickFix where an initial command uses `nslookup` and parses the response for execution, but it is a multi-topic roundup rather than a primary source on the fake-CAPTCHA infostealer campaign; a malware newsletter roundup is likewise a link collection and does not add specific, corroborating details about the ClickFix CAPTCHA infostealer operation.
Jun 29, 2026