ClickFix Social-Engineering Lures Deliver Multi-Stage Windows Malware via Browser Extensions and Compromised WordPress Sites
Malware Intelligence · 2 sources · Updated 4mo ago · First seen Mar 10, 2026
Threat researchers reported continued evolution and operationalization of ClickFix-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed CrashFix, attributed to KongTuke, which uses a malicious browser extension to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a PowerShell command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution.
Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate WordPress sites to inject a ClickFix implant that impersonates a Cloudflare human verification (CAPTCHA) challenge. The operation has affected 250+ infected sites across 12+ countries and delivers a multi-stage, mostly in-memory malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing credentials and digital wallets from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
