Loading story…
Microsoft reported that social-engineering lures are increasingly being used to trick users into launching malware themselves, with the ClickFix technique emerging as a major delivery method across phishing, malvertising, and compromised websites. In ClickFix attacks, victims are shown fake CAPTCHA, verification, or repair prompts that copy malicious commands to the clipboard and persuade them to run them, often leading to fileless execution through LOLBins, obfuscated PowerShell, and follow-on payloads such as Lumma Stealer, DarkGate, Latrodectus, ScreenConnect, and AMOS. Microsoft said the technique has hit thousands of enterprise and consumer devices daily and is now supported by a growing underground market of ClickFix builder kits sold on criminal forums.
Fresh activity shows the tactic continuing to evolve. A SmartApeSG campaign observed on compromised web traffic redirected victims to a fake human-verification flow that fetched an HTA downloader from deltaode[.]com, retrieved a ZIP archive, and abused DLL side-loading to launch an unidentified RAT that later communicated with 89.124.79[.]98 over TCP 443. Separately, Microsoft linked the CaptiveCrunch campaign to Storm-2945, a sub-cluster of Russia-linked Midnight Blizzard, which has manipulated DNS and HTTP traffic on hospitality and other captive-portal networks to redirect travelers to phishing pages and fake browser or OS updates delivering CornFlake and ChocoShell for credential theft and espionage, including theft of browser credentials, Microsoft 365 tokens, and Wi-Fi credentials.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
On July 23, ReliaQuest reported that part of the CaptiveCrunch activity used doppelganger domains to abuse the Microsoft Entra ID device code authentication flow. Microsoft’s reporting cited this as part of the broader Storm-2945 campaign.
Microsoft observed Storm-2945 conducting the CaptiveCrunch campaign since early May 2026. The actor manipulated DNS and HTTP traffic on hospitality and other captive-portal-served networks worldwide to redirect travelers to attacker-controlled infrastructure for phishing and malware delivery.
Microsoft said the Lampion ClickFix campaign was still active as of June 2025 and had expanded beyond Portugal. Later targeting included organizations in Switzerland, Luxembourg, France, Hungary, and Mexico across government, education, transportation, and financial services sectors.
Microsoft observed a June 2025 phishing campaign impersonating the US Social Security Administration. It used a compromised Brazilian domain and a Google Ads redirect chain to deliver ScreenConnect through a spoofed SSA-themed ClickFix page.
Microsoft reported that a ClickFix campaign active since late May 2025 targeted macOS users with Spectrum-themed lures. The campaign delivered Atomic macOS Stealer (AMOS).
In May 2025, Microsoft identified a ClickFix campaign delivering Lampion-themed infection stages against Portuguese organizations in government, finance, and transportation. The phishing emails carried ZIP files with HTML that redirected victims to a fake Portuguese tax authority site.
In April 2025, Microsoft observed a malvertising campaign redirecting users from free or pirated movie streaming sites to ClickFix pages. The activity delivered Lumma Stealer and used intermediate HTA scripts renamed with media extensions such as .mp3 and .mp4.
Microsoft observed Storm-0426 launch a phishing campaign in March 2025 targeting users in Germany. The emails used payment and invoice lures and redirected victims through compromised sites and the Prometheus TDS to install MintsLoader.
In early March 2025, Microsoft observed Storm-0249 move from email-based delivery to compromising legitimate websites, likely through WordPress vulnerabilities. The actor then used ClickFix pages to deliver Latrodectus or other initial-access malware.
In May 2024, Microsoft observed a Storm-1607 campaign sending tens of thousands of payment- and invoice-themed phishing emails to organizations in the United States and Canada. The activity attempted to deliver DarkGate via ClickFix-style lures.
Microsoft first observed ClickFix use between March and June 2024 in Storm-1607 email campaigns. These phishing emails used HTML attachments to try to install the DarkGate loader.
Microsoft reported that an underground market for ClickFix builders had been active on hacker forums since late 2024. Subscriptions were advertised at roughly $200 to $1,500 per month.
Since early 2024, Microsoft said it has helped multiple customers address ClickFix campaigns delivering payloads such as Lumma Stealer. The company also observed the technique targeting thousands of devices globally each day over the following year.
A Malware-Traffic-Analysis.net report documented a SmartApeSG ClickFix infection chain in which injected traffic on a compromised website led victims to run clipboard-pasted commands from a fake CAPTCHA or human verification page. The commands fetched an HTA downloader from deltaode[.]com, which retrieved a ZIP archive used for DLL side-loading of an unidentified RAT that later communicated with 89.124.79[.]98 over TCP 443.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalware-traffic-analysis.net
Open sourcemicrosoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026
Security agencies and researchers warned that **ClickFix** social-engineering attacks are spreading through fake verification and brand-impersonation pages that mimic services such as **Google reCAPTCHA** and **Cloudflare**, then trick users into opening `Win+R` or Terminal and pasting clipboard-loaded commands. Recent campaigns have used poisoned websites, fake search results, and spoofed update pages to push victims into launching malicious PowerShell, `mshta`, WebDAV, or shell-based payloads, turning trusted brands and verification flows into an initial access vector without directly compromising the impersonated organizations. The activity has delivered a wide range of malware, including **ACR Stealer**, **HijackLoader**, **StealC**, **Remus**, **Amatera Stealer**, **CastleLoader**, **NetSupport**, Rust-based stealers, and a DPRK-linked macOS backdoor tied to **Contagious Interview**. Microsoft said ACR Stealer campaigns targeting enterprise users stole browser credentials, cookies, tokens, and business files, used scheduled tasks and process injection for persistence and evasion, and in some cases relied on **EtherHiding** to resolve command-and-control infrastructure from Ethereum smart contracts; the macOS campaign similarly used clipboard-driven execution, LaunchAgent persistence, and follow-on payloads that targeted browser data, developer and cloud keys, and cryptocurrency wallets. Defenders were urged to block command execution from untrusted prompts, hunt for published indicators of compromise, and educate users that legitimate verification pages do **not** require running commands locally.
Jul 31, 2026