Loading story…
A ClickFix campaign used compromised WordPress sites and fake Cloudflare verification pages to trick users into running a clipboard-delivered PowerShell command, leading to installation of the legitimate Deno JavaScript runtime as a malicious execution layer. Sophos said the intrusion chain relied on MSI-based staging, including use of winget.exe to install deno.exe, then fetched obfuscated remote JavaScript that handled reconnaissance, persistence, and command-and-control. Investigators observed more than 500 compromised WordPress sites serving similar injected JavaScript, indicating a broad website-compromise or traffic-manipulation operation.
The malware chain ultimately delivered a Python-based infostealer executed via pythonw.exe, capable of stealing system details, browser and extension data, cryptocurrency wallet information, and keystrokes. Researchers said the attackers stored downloaded content in a registry key disguised as a Microsoft Edge update after shifting staging to a TryCloudflare URL, while related Sophos case studies showed the same broader tradecraft of abusing Deno as a Bring Your Own Runtime to execute in-memory JavaScript, maintain persistence through Run keys and scheduled tasks, and evade detection through less-monitored runtimes and MSI/VBS/PowerShell loaders.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
Sophos Counter Threat Unit published its analysis of the June 2026 ClickFix campaign that abused Deno to deliver a Python infostealer and maintain follow-on activity.
Sophos published research detailing four early-2026 intrusion cases in which attackers abused the Deno runtime for in-memory JavaScript execution and post-compromise activity.
On June 23, 2026, the remote JavaScript used in the ClickFix campaign changed to define a new staging URL hosted on TryCloudflare. The updated script downloaded content from the TryCloudflare-hosted address and stored it in a registry key disguised as a Microsoft Edge update.
On June 3 and June 4, 2026, compromised WordPress sites served Cloudflare-themed ClickFix lures that prompted users to run a clipboard-delivered PowerShell command in Windows Terminal. Sophos observed more than 500 compromised WordPress sites hosting similar malicious JavaScript injections.
The June 2026 intrusion chain delivered a Python payload named install.pyc via pythonw.exe from 162.33.177.16. Sophos identified it as an infostealer that collected system, browser, extension, cryptocurrency wallet, and keystroke data.
In the June 2026 campaign, the clipboard-delivered PowerShell command launched an MSI-based staging chain that dropped november85.cmd and Griffin20.ps1, used winget.exe to install Deno, and executed remote JavaScript from attacker-controlled infrastructure. Deno then orchestrated follow-on PowerShell execution, reconnaissance, persistence, and command-and-control.
Sophos reported that the domain columbnezhjdq.com, used in the ClickFix campaign's injected WordPress JavaScript, was registered on June 1, 2026.
Sophos MDR investigated four intrusion cases in early 2026 where a threat activity cluster abused the legitimate Deno runtime as a Bring Your Own Runtime layer to execute malicious JavaScript in memory. Across the cases, attackers used malicious MSI packages, script loaders, LOLBins, and Deno-based payload execution.
The May 2025 v2.3 release of Deno introduced trusted, code-signed distributions, which Sophos said reduced the likelihood of security controls flagging the binary in later abuse cases.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcesophos.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported continued evolution and operationalization of **ClickFix**-style social engineering, where victims are tricked into manually executing attacker-supplied commands via the Windows Run dialog. Huntress described a new variant dubbed **CrashFix**, attributed to **KongTuke**, which uses a **malicious browser extension** to display a fake “browser stopped abnormally” security warning and a bogus “scan” flow; the extension silently places a **PowerShell** command on the clipboard, disguised as a legitimate repair action, and instructs the user to paste-and-run it, leading to code execution. Rapid7 Labs separately documented a large-scale campaign in which an unidentified actor compromises legitimate **WordPress** sites to inject a ClickFix implant that impersonates a **Cloudflare human verification (CAPTCHA)** challenge. The operation has affected **250+** infected sites across **12+ countries** and delivers a **multi-stage, mostly in-memory** malware chain (obfuscated JavaScript → PowerShell stagers → in-memory loaders/shellcode) aimed at stealing **credentials and digital wallets** from Windows systems, enabling downstream financial theft and potential follow-on intrusion using harvested credentials.
Jun 29, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Threat actors are scaling **ClickFix**-style “self-infection” attacks that abuse compromised legitimate websites to trick users into manually executing malicious PowerShell via the Windows Run dialog or a terminal. Reporting describes the **KongTuke** campaign evolving its tradecraft by retrieving next-stage instructions from **DNS TXT records** rather than over HTTP, reducing visibility for controls focused on web traffic and blending activity into normal DNS resolution. The objective is follow-on malware deployment and persistence, including installation of remote-access tooling such as the **Interlock RAT**. Separately, researchers described a large **watering-hole** operation dubbed **IClickFix** that poisoned **3,800+ WordPress sites** with a fake *Cloudflare Turnstile CAPTCHA* prompt that instructs visitors to copy/paste and run a “fix” command. Once executed, the staged PowerShell pulls commodity payloads including **NetSupport RAT**, **Emmenhtal Loader**, and **XFiles Stealer**, and uses tracking/targeting logic (e.g., an `ic-tracker-js` HTML tag) to manage victim flow. In contrast, a different WordPress compromise technique called **“directory shadowing”** was reported as an SEO-spam operation that creates physical folders matching WordPress permalinks and serves gambling content selectively to crawlers (via User-Agent checks), which is not part of the ClickFix execution chain.
Sep 3, 2026