Profile assembled from related reporting. Attribution: reported.

ClickFix

highVulnerability

ClickFix Attackers Exploit Siemens Software Center DLL Sideloading Flaw

Siemens has remediated a high-severity DLL sideloading vulnerability in Siemens Software Center that was exploited by ClickFix threat actors to deploy a Remote Access Trojan. The flaw, tracked as CVE-2026-110936 with a CVSS v4 score of 8.4, allowed execution of malicious code with application privileges. Patches have been released; users are advised to update to the latest version.

The Hacker Newsabout 8 hours ago1 min read

highCyber Attacks

Hackers Abuse Google Ads and Bing Redirects to Deliver Claude ClickFix Attacks

Threat actors have been observed abusing legitimate Bing search-result redirects as click URLs within Google search ads. When users click these ads, they are directed to fake Claude installer pages. These pages employ ClickFix social engineering tactics to trick victims into running malicious PowerShell commands, which can lead to credential theft, data exfiltration, or ransomware installation. The campaign targets users searching for Claude AI software, leveraging the trust associated with legitimate search-result redirects to bypass initial skepticism.

BleepingComputer11 days ago1 min read

highmalware

Malicious Custom GPTs Used as RAT Delivery Lure in ClickFix-Style Campaign

Security researchers report a campaign in which threat actors create and promote malicious Custom GPTs on the OpenAI platform, using legitimate Google domains as lures. The social engineering approach mimics ClickFix tactics, persuading users to execute commands that deploy remote access trojans (RATs) or other malware. No specific CVE or zero-day vulnerability has been identified; the attack relies on user interaction and trust in legitimate AI services.

Dark reading20 days ago1 min read

Sponsored ChatGPT Variants Used in ClickFix Attacks to Deploy Remote Access Trojans

highMalware

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

Manifold Security researcher Ax Sharma has reported that the domain third-party[.]com, frequently used as a generic documentation placeholder across software projects, is being exploited by threat actors. The domain serves a ClickFix social engineering lure specifically to Windows browser users, while displaying a harmless decoy to other visitors. The domain's widespread use in approximately 1,700+ repositories has increased the likelihood of encounter by developers and researchers. No software patch is available for the domain itself; mitigation focuses on user awareness of ClickFix tactics.

The Hacker News25 days ago1 min read

highMalware

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

Cyber threat actors compromised the official HBO Max Reddit account and used it to promote malicious advertisements. These ads leveraged ClickFix social engineering tactics to trick users into executing commands that installed information-stealing malware on both Windows and macOS systems. The incident highlights the growing risk of threat actors targeting high-profile social media accounts to distribute malware through trusted brand channels.

BleepingComputerabout 1 month ago1 min read

highThreat Intelligence

ClickFix Campaigns Abuse Legitimate Services to Establish Persistent Access

Recent ClickFix campaigns demonstrate a shift in social engineering tactics, abusing legitimate services to trick users into executing malicious actions and gain persistent access to organizational networks.

Dark readingabout 1 month ago1 min read

highMalware

Over 5,400 Compromised Websites Deliver ClickFix Payloads via BNB Smart Chain Smart Contracts

Security researchers have identified a large-scale operation in which over 5,400 compromised small-business websites are serving malicious ClickFix payloads. The payloads are stored in smart contracts on the BNB Smart Chain (BSC), with the hacked sites acting as delivery vectors that redirect visitors to these decentralized contracts. The campaign leverages search engine optimization (SEO) poisoning and compromised content management systems to maximize reach. No specific software vulnerability has been cited as the initial entry point; rather, the operation appears to rely on widespread website compromises and social engineering tactics.

BleepingComputerabout 1 month ago2 min read

highCyber Attacks

Dark Reading Reports 'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks

According to Dark Reading, a ClickFix-style campaign identified as 'TerminalFix' is weaponizing PowerShell to target enterprise organizations. The attack chain features multiple stages and includes the establishment of reverse tunnels into victim networks, potentially enabling unauthorized access, data exfiltration, and lateral movement. The report notes the campaign is active but does not specify exact victim counts, targeted industries, or detailed technical implementation of the reverse tunnel mechanism.

Dark readingabout 2 months ago1 min read

highPhishing

24 npm Packages Exploit unpkg Mirrors to Host Fake Cloudflare CAPTCHA Phishing Pages

Researchers have detailed a campaign involving 24 malicious npm packages that do not contain traditional malware but instead host a single HTML page. When loaded, this page redirects users to fake Cloudflare CAPTCHA interfaces hosted via unpkg mirrors. The attack leverages ClickFix-style techniques to trick users into executing commands, potentially leading to credential theft or malware installation. The threat actors are using the npm registry as free phishing infrastructure rather than targeting developers who install the packages.

The Hacker Newsabout 2 months ago2 min read

ClickFix

Quick answers

Related Articles

ClickFix Attackers Exploit Siemens Software Center DLL Sideloading Flaw

Hackers Abuse Google Ads and Bing Redirects to Deliver Claude ClickFix Attacks

Malicious Custom GPTs Used as RAT Delivery Lure in ClickFix-Style Campaign

Sponsored ChatGPT Variants Used in ClickFix Attacks to Deploy Remote Access Trojans

Placeholder Domain third-party[.]com Observed Serving ClickFix Lure to Windows Browsers

HBO Max Reddit Account Compromised to Distribute ClickFix Malware Campaign

ClickFix Campaigns Abuse Legitimate Services to Establish Persistent Access

Over 5,400 Compromised Websites Deliver ClickFix Payloads via BNB Smart Chain Smart Contracts

Dark Reading Reports 'TerminalFix' Campaign Weaponizes PowerShell for Enterprise Attacks

24 npm Packages Exploit unpkg Mirrors to Host Fake Cloudflare CAPTCHA Phishing Pages