Loading story…
Opera has added Paste Protect to block ClickFix attacks that trick users into copying and running malicious commands from fake browser errors, CAPTCHA prompts, system warnings, or other social-engineering lures. Enabled by default in the latest browser release, the feature analyzes copied content with platform-specific rules for Windows, macOS, and Linux, cancels suspicious clipboard actions, warns the user, and delays any manual override. The move comes as ClickFix has grown from a fringe crimeware tactic into a widely used intrusion method and was formalized in MITRE ATT&CK as T1204.004 for malicious copy-and-paste user execution.
Recent analyses show ClickFix being used to deliver malware and evade detection through trusted tools and compromised websites. One observed chain pushed victims to paste a PowerShell command that downloaded a decoy PDF and Twinkle.exe, which unpacked a trojanized AeroAdmin instance and ultimately deployed Vidar Stealer to harvest browser credentials, messaging data, FTP and cloud secrets, cryptocurrency wallet data, and other files before deleting artifacts. Other campaigns used watering-hole compromises to inject obfuscated JavaScript that profiled visitors and launched mshta-based payloads from attacker-controlled domains, while lab research demonstrated how Windows nslookup and DNS responses can carry ClickFix payloads in ways that leave limited DNS telemetry and complicate defender visibility.
Pull IOCs and campaign context straight into your stack.
8 events from the most recent confirmed update back to the earliest known activity.
uBlock Origin added protections against ClickFix social-engineering attacks to its built-in badware filter list, including rules to block suspicious request patterns and malicious domains. The protections were also made available in uBlock Origin Lite for Chromium-based browsers.
Opera introduced a browser feature called Paste Protect to block suspicious scripts or commands before they are copied to the clipboard. The feature is enabled by default in the latest Opera release and warns users when ClickFix-style malicious copy operations are detected.
A lab simulation showed how Windows nslookup and spoofed DNS responses could be abused to deliver PowerShell payloads in a ClickFix-style attack chain. The writeup highlighted CNAME responses as especially useful for exposing payloads in Sysmon Event ID 22 logs and noted telemetry gaps compared with Resolve-DnsName.
Blue Cyber Threat Intelligence analyzed a ClickFix infection chain in which victims were tricked into pasting a PowerShell command that downloaded a PDF and a packed executable named Twinkle.exe. The chain ultimately launched a trojanized AeroAdmin tool that injected and ran Vidar Stealer for credential and data theft.
A recent campaign described in one analysis used compromised legitimate websites to inject obfuscated JavaScript that delivered ClickFix-style payloads. The code loaded attacker-controlled content, collected system telemetry, and attempted to launch mshta-based second-stage payloads from 1000lifelessons[.]shop and channelnewsasia[.]icu.
A referenced analysis states that ClickFix emerged in late 2024 as a malicious copy-and-paste user-execution technique. It was initially used mainly by lower-tier Crime-as-a-Service actors before broader adoption.
A 2025-04-08 analysis described a fake CAPTCHA social-engineering chain that told users to paste a command into the Windows Run dialog, using mshta.exe to fetch a remotely hosted file with an .ogg extension. The file was analyzed as a disguised MP3 containing hidden malicious JavaScript in ID3 metadata, which decoded into PowerShell stages that downloaded and executed an additional payload with signs of in-memory execution and AMSI evasion.
On 2025-03-18, MITRE ATT&CK added the technique as T1204.004, User Execution: Malicious Copy and Paste. This formalized ClickFix as a tracked adversary technique.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 23 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcexakep.ru
Open sourcecyberveille.ch
Open sourceblogs.opera.com
Open sourcemedium.com
Open sourcebluecyber.hashnode.dev
Open sourcemedium.com
Open sourcesarviyamalwareanalyst.medium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are expanding **ClickFix**-style social engineering beyond simple “copy/paste this command” lures, including a campaign that abuses **Pastebin comments** to push victims toward executing attacker-supplied **JavaScript** in their browser to hijack cryptocurrency swap flows. The Pastebin comments promote a fake “Swapzone.io arbitrage exploit” and route users through a `rawtext[.]host` link to a Google Doc (“Swapzone.io – ChangeNOW Profit Method”) that instructs users to run JavaScript which can modify the swap process in-session and redirect funds to attacker-controlled wallets; the reporting notes this may be an early example of ClickFix being used to directly alter webpage functionality for theft. Separately, Objective-See documented ClickFix as a rapidly growing infection technique on **macOS and Windows** that relies on persuading users to paste attacker-controlled commands into a terminal, enabling execution without exploiting software vulnerabilities and potentially bypassing macOS protections such as **Gatekeeper** and **Notarization**. The post describes a practical macOS-focused mitigation that intervenes at “paste time” to disrupt many ClickFix attempts, implemented in *BlockBlock*, while also outlining limitations and potential bypasses—reinforcing that ClickFix is primarily a user-manipulation problem that defenders should address with both technical controls and user-execution friction.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Security agencies and researchers warned that **ClickFix** social-engineering attacks are spreading through fake verification and brand-impersonation pages that mimic services such as **Google reCAPTCHA** and **Cloudflare**, then trick users into opening `Win+R` or Terminal and pasting clipboard-loaded commands. Recent campaigns have used poisoned websites, fake search results, and spoofed update pages to push victims into launching malicious PowerShell, `mshta`, WebDAV, or shell-based payloads, turning trusted brands and verification flows into an initial access vector without directly compromising the impersonated organizations. The activity has delivered a wide range of malware, including **ACR Stealer**, **HijackLoader**, **StealC**, **Remus**, **Amatera Stealer**, **CastleLoader**, **NetSupport**, Rust-based stealers, and a DPRK-linked macOS backdoor tied to **Contagious Interview**. Microsoft said ACR Stealer campaigns targeting enterprise users stole browser credentials, cookies, tokens, and business files, used scheduled tasks and process injection for persistence and evasion, and in some cases relied on **EtherHiding** to resolve command-and-control infrastructure from Ethereum smart contracts; the macOS campaign similarly used clipboard-driven execution, LaunchAgent persistence, and follow-on payloads that targeted browser data, developer and cloud keys, and cryptocurrency wallets. Defenders were urged to block command execution from untrusted prompts, hunt for published indicators of compromise, and educate users that legitimate verification pages do **not** require running commands locally.
Jul 31, 2026