ClickFix

highmalware

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

Manifold Security researcher Ax Sharma has reported that the domain third-party[.]com, frequently used as a generic documentation placeholder across software projects, is being exploited by threat actors. The domain serves a ClickFix social engineering lure specifically to Windows browser users, while displaying a harmless decoy to other visitors. The domain's widespread use in approximately 1,700+ repositories has increased the likelihood of encounter by developers and researchers. No software patch is available for the domain itself; mitigation focuses on user awareness of ClickFix tactics.

The Hacker News4 days ago1 min read

highMalware

Brevo Supply-Chain Attack Compromises Customer Sites via Stolen Cloudflare API Key

Brevo confirmed a supply-chain attack in which threat actors stole a Cloudflare API key to inject malicious ClickFix scripts into Brevo's websites and JavaScript files embedded on customer sites. The scripts are designed to mimic legitimate UI interactions and distribute malware to visitors of compromised customer sites. The incident highlights the risks of compromised CDN and DNS credentials in supply-chain attacks.

BleepingComputer12 days ago1 min read

highMalware

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

Cyber threat actors compromised the official HBO Max Reddit account and used it to promote malicious advertisements. These ads leveraged ClickFix social engineering tactics to trick users into executing commands that installed information-stealing malware on both Windows and macOS systems. The incident highlights the growing risk of threat actors targeting high-profile social media accounts to distribute malware through trusted brand channels.

BleepingComputer15 days ago1 min read

highThreat Intelligence

ClickFix Campaigns Abuse Legitimate Services to Establish Persistent Access

Recent ClickFix campaigns demonstrate a shift in social engineering tactics, abusing legitimate services to trick users into executing malicious actions and gain persistent access to organizational networks.

Dark reading18 days ago1 min read

highMalware

Over 5,400 Compromised Websites Deliver ClickFix Payloads via BNB Smart Chain Smart Contracts

Security researchers have identified a large-scale operation in which over 5,400 compromised small-business websites are serving malicious ClickFix payloads. The payloads are stored in smart contracts on the BNB Smart Chain (BSC), with the hacked sites acting as delivery vectors that redirect visitors to these decentralized contracts. The campaign leverages search engine optimization (SEO) poisoning and compromised content management systems to maximize reach. No specific software vulnerability has been cited as the initial entry point; rather, the operation appears to rely on widespread website compromises and social engineering tactics.

BleepingComputer24 days ago2 min read

highCyber Attacks

Dark Reading Reports 'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks

According to Dark Reading, a ClickFix-style campaign identified as 'TerminalFix' is weaponizing PowerShell to target enterprise organizations. The attack chain features multiple stages and includes the establishment of reverse tunnels into victim networks, potentially enabling unauthorized access, data exfiltration, and lateral movement. The report notes the campaign is active but does not specify exact victim counts, targeted industries, or detailed technical implementation of the reverse tunnel mechanism.

Dark reading29 days ago1 min read

highPhishing

24 npm Packages Exploit unpkg Mirrors to Host Fake Cloudflare CAPTCHA Phishing Pages

Researchers have detailed a campaign involving 24 malicious npm packages that do not contain traditional malware but instead host a single HTML page. When loaded, this page redirects users to fake Cloudflare CAPTCHA interfaces hosted via unpkg mirrors. The attack leverages ClickFix-style techniques to trick users into executing commands, potentially leading to credential theft or malware installation. The threat actors are using the npm registry as free phishing infrastructure rather than targeting developers who install the packages.

The Hacker Newsabout 1 month ago2 min read

highMalware

WordlistLoader Disguises Malware as Ordinary Text in ClickFix Campaigns

Threat actors have adopted a ClickFix-style campaign tactic using a tool identified as WordlistLoader to deliver the Amatera infostealer. The malware disguises its payload as ordinary text, evading initial detection and relying on social engineering to execute on target systems.

Dark readingabout 1 month ago1 min read

ClickFix

Quick answers

Related Articles

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

Brevo Supply-Chain Attack Compromises Customer Sites via Stolen Cloudflare API Key

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

ClickFix Campaigns Abuse Legitimate Services to Establish Persistent Access

Over 5,400 Compromised Websites Deliver ClickFix Payloads via BNB Smart Chain Smart Contracts

Dark Reading Reports 'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks

24 npm Packages Exploit unpkg Mirrors to Host Fake Cloudflare CAPTCHA Phishing Pages

WordlistLoader Disguises Malware as Ordinary Text in ClickFix Campaigns