Loading story…
Microsoft reported that ClickFix operators have shifted tactics to better evade detection while continuing to use phishing and social engineering to trick users into executing malicious actions that lead to malware delivery and follow-on compromise. Separate reporting also describes Microsoft warning of phishing campaigns designed to establish persistent backdoors on victim endpoints, indicating continued investment by multiple actors in email-led initial access and long-lived footholds.
Other items in the set are not about ClickFix and instead cover unrelated security news and commentary, including EU automotive cybersecurity compliance requirements under Euro 7, an alleged compromise of an FBI wiretap-related system, general governance commentary about limited board time spent on cyber risk, a newsletter-style link roundup, a “News March 2026” aggregation page mixing multiple unrelated stories (Cisco SD-WAN exploitation, a new stealer, Iranian camera targeting, and more), and a security podcast discussing disparate topics (trade-secret theft/zero-day brokering and information manipulation risks).
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
A separate report stated that hackers had accessed or tapped an FBI wiretap system. The item indicates a newly disclosed intrusion affecting a U.S. law enforcement surveillance-related system.
Microsoft said attackers behind ClickFix were using a new tactic to evade detection. The report marks a technical development in the ongoing activity by revealing an updated attacker method.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers report that **ClickFix** has become a major initial-access technique, relying on social engineering rather than software exploits to trick users into pasting attacker-provided commands into **Windows Run** or **macOS Terminal**. ESET said detections rose **108%** from H2 2025 to H1 2026, while RH-ISAC described a broader **517%** increase from late 2024 into the first half of 2025 and noted that Microsoft saw the method in **47%** of initial-access cases handled by Defender Experts. Attackers have expanded ClickFix beyond Windows to **macOS**, delivered it through compromised **WordPress** sites, and improved lures with fake **BSOD** screens, frozen document viewers, and service-specific error messages. The technique is now used by both cybercriminals and state-backed groups, with RH-ISAC linking adoption to **Sandworm, APT28, MuddyWater, and Kimsuky** and citing Sandworm activity against organizations in Ukraine, including at least one compromise involving **FreakyPoll** malware. Researchers also observed ClickFix delivering malware such as **ACR Stealer, OkoBot, TELEPUZ, ClickLock Stealer**, and **DriveSurge**, while newer variants including **CrashFix, FileFix, PromptFix, and ConsentFix** show continued evolution. ESET additionally identified an **"AI-fix"** variant that abuses legitimate domains tied to **Anthropic Artifact**, **OpenAI Canvas**, and **Microsoft Copilot Pages** to display fake troubleshooting content for nonexistent AI problems, underscoring how attackers are blending trusted platforms, AI branding, and increasingly industrialized delivery infrastructure.
Jul 20, 2026
Attackers are increasingly using **ClickFix** fake CAPTCHA and verification lures on compromised websites to trick users into manually executing malicious commands, turning social engineering into a scalable initial-access method. **LeakNet** adopted the technique to reduce reliance on stolen credentials and initial access brokers, using hacked sites to deliver a staged **Deno**-based in-memory loader before following a repeatable post-exploitation sequence that can end in ransomware deployment. Separately, the **ZPHP** campaign used similar fake Cloudflare Turnstile-style prompts against U.S. **SLTT** organizations to deliver **Remcos RAT**, with hidden JavaScript on compromised sites selectively replacing page content with attacker-controlled instructions for Windows users. The reporting indicates a broader shift in which ClickFix is no longer tied to a single actor or payload, but is being reused across financially motivated and malware-delivery operations because it is cheap, effective, and difficult for users to recognize as malicious. One additional roundup reference points to **Termite ransomware** and **CastleRAT** activity linked to ClickFix, reinforcing that the technique is spreading across campaigns, but it does not provide enough detail to treat that activity as the same incident as **LeakNet** or **ZPHP**. This is **not fluff**: the material contains concrete threat intelligence on active intrusion methods, victim targeting, malware delivery chains, and operational tradecraft relevant to enterprise defense.
Jun 29, 2026
Researchers reported continued expansion of **ClickFix** as an initial-access technique, with attackers using fake CAPTCHA or verification pages to trick users into executing clipboard-delivered commands on Windows systems. In one campaign, **LeakNet** shifted away from relying on initial access brokers and instead used compromised legitimate websites hosting fake Cloudflare Turnstile checks to broaden victim acquisition and reduce network-based detection. ReliaQuest linked the activity to LeakNet through overlapping infrastructure and consistent TTPs, and noted the group paired ClickFix with a stealthy, memory-resident loader built on the **Deno** JavaScript runtime to support ransomware operations. A separate ClickFix campaign analyzed by Atos used the same user-executed command pattern to map attacker-controlled network drives with `net use`, then download a trojanized but legitimately signed *WorkFlowy* application whose modified `asar` archive executed malicious code in the **Node.js** main process with the logged-in user’s privileges. Other reporting on **Hive0163** also identified ClickFix as one of several initial-access methods used in **Interlock** ransomware intrusions, although that article focused primarily on the group’s likely AI-generated **Slopoly** malware rather than a specific ClickFix incident. Reporting on **Operation Covert Access** in Argentina’s judicial sector was unrelated, describing spear-phishing with fake court documents to deliver **COVERT RAT** via a different intrusion chain.
Jun 29, 2026