ClickFix Social Engineering Drives Multi-Platform Malware Delivery

Security researchers reported multiple active campaigns using ClickFix social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by CERT Polska (cert.pl), victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a PowerShell command via Win+R; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to enterprise-wide compromise, including deployment of secondary malware such as Latrodectus and Supper for data theft, lateral movement, and potential ransomware staging.

A separate ClickFix operation targeted macOS developers by cloning the Homebrew site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from raw.homabrews.org instead of raw.githubusercontent.com, leading to Cuckoo Stealer deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at 5.255.123.244. ClickFix was also observed as the initial execution mechanism for the resurfaced Matanbuchus 3.0 MaaS loader, which uses deceptive copy/paste prompts and silent MSI execution (via msiexec) to deliver a new payload, AstarionRAT, enabling capabilities including credential theft and SOCKS5 proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.