Loading story…
Security researchers and Italy’s national cyber agency warned of active ClickFix and TerminalFix malware campaigns that trick users into manually launching malicious Windows commands from fake CAPTCHA or verification pages. The activity relies on compromised legitimate websites, including WordPress sites, where obfuscated JavaScript redirects visitors to prompts telling them to open Run, Windows Terminal, or PowerShell and paste attacker-supplied commands. Those commands abuse trusted Windows utilities such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, msiexec.exe, curl.exe, WMI, WebDAV, and scheduled tasks to download follow-on payloads, establish persistence, and contact attacker infrastructure.
Researchers said the operators are using EtherHiding to conceal parts of their delivery chain inside smart contracts on public blockchains, including BNB Smart Chain and Polygon, which are queried through RPC gateways to retrieve configuration or malicious instructions. WatchGuard linked one cluster to the ErrTraffic malware-as-a-service operation and reported delivery of payloads including Vidar, Okobot, ClipBanker variants, BabaDedaLoader, Node.js backdoors, OnionDrop-related malware, and LegionLoader-linked samples. The campaign is aimed at credential theft, browser and cookie harvesting, cryptocurrency-wallet theft, defense evasion, lateral movement, and staging for broader compromise, prompting defenders to tighten command-line controls, increase PowerShell and endpoint monitoring, isolate affected hosts, and reset exposed accounts.
Pull IOCs and campaign context straight into your stack.
3 events from the most recent confirmed update back to the earliest known activity.
WatchGuard linked the ErrTraffic activity to a malware-as-a-service operation advertised by a forum user known as LenAI. The operation was observed distributing multiple payload families including Vidar, Okobot, LegionLoader-linked malware, OnionDrop-related payloads, Node.js backdoors, and BabaDedaLoader.
WatchGuard analysts identified an active malware delivery campaign tracked as ErrTraffic that uses compromised WordPress sites and ClickFix-style fake verification prompts to trick users into running malicious Windows commands. The campaign retrieves smart-contract-based configuration from the Polygon blockchain via RPC services, allowing operators to rotate infrastructure without updating every compromised site.
Microsoft Threat Intelligence identified a malware campaign that evolves the ClickFix and TerminalFix social-engineering techniques by storing malicious instructions in smart contracts on the BNB Smart Chain and retrieving them through blockchain RPC gateways. The campaign uses compromised legitimate websites, fake CAPTCHA or verification pages, and user-executed Windows commands to deliver follow-on malware.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 52 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourceacn.gov.it
Open sourcecertego.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Researchers reported that the long-running **ClearFake/EtherHiding** campaign is using compromised legitimate websites, fake **Google reCAPTCHA** pages, and **ClickFix** social-engineering lures to deliver malware through **BNB Smart Chain testnet** smart contracts rather than conventional staging servers. Analysis from Trend Micro and Censys found the attackers embedded obfuscated JavaScript and `ethers.js` on hacked sites, performed browser and OS checks, and retrieved victim-specific payload logic from on-chain contracts tied to a single deployer wallet. The infrastructure included contracts for anti-analysis dispatching, separate Windows and macOS delivery, and victim tracking, making traditional takedowns and URL blocking far less effective. The campaign delivered **SectopRAT** and **ACRStealer** to steal passwords, cookies, browser sessions, credit card data, and cryptocurrency wallet information, while macOS infections also used dynamic resolver techniques through external web services to locate command-and-control endpoints and collect host data. A related stealer campaign described by Gurucul used software-search redirection, fake MEGA Transfer pages, a Go-based loader, and an **Ethereum dead-drop resolver** to obtain command-and-control infrastructure, underscoring a broader shift toward blockchain-backed malware delivery and resilient C2. Defenders were advised to monitor for unexpected `ethers.js` usage, fake CAPTCHA assets, clipboard-driven execution prompts, and access to BSC testnet JSON-RPC services, while training users to avoid fraudulent CAPTCHA and ClickFix prompts.
Jun 29, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026