ClickFix Archives • Daily CyberSecurity

Amatera Password Stealer Abuses Service Workers and Smart Contracts Amatera password stealer campaign attack chain diagram and Amatera password stealer workflow

Amatera password stealer campaign attack chain diagram and Amatera password stealer workflow

Amatera Password Stealer Abuses Service Workers and Smart Contracts

Do Son September 2, 2026

At a Glance Category Details Malware Family Amatera (rebrand of ACR Stealer / AcridRain) Threat Actor Unattributed...

macOS ClickFix Malware Exploits Polygon C2 macOS ClickFix malware campaign infection flow and macOS ClickFix malware execution diagram

macOS ClickFix Malware Exploits Polygon C2

Do Son August 28, 2026

At a glance Factor Details Malware Family AMOS (Atomic macOS Stealer), Light Stealer, and XMRig miner Threat...

Cruciferra Malware Loader Uses ClickFix Lures to Kill EDR

Do Son August 27, 2026

At a glance Malware family Cruciferra malware loader (delivers Remus stealer) Threat actor Cruciferra and LenAI (ErrTraffic)...

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader malware delivering Amatera Stealer via a ClearFake fake CAPTCHA ClickFix prompt

WordlistLoader Delivers Amatera Stealer Through ClearFake Campaigns

Do Son August 24, 2026

At a glance Malware family WordlistLoader (loader); Amatera Stealer / ACR Stealer (payload) Threat actor Amatera sold...

StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet StopAndProtect malware ClickFix fake CAPTCHA prompt on hacked WordPress sites

StopAndProtect malware ClickFix fake CAPTCHA prompt on hacked WordPress sites

StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet

Do Son August 24, 2026

At a glance Actor / group Unnamed operator behind “StopAndProtect” (internal project names “0a_botnet” and “fake-captcha”) Activity...

C2Looper: Rust Backdoor Uses GitHub for C2 Control C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper Rust backdoor diagram showing GitHub command-and-control and ClickFix ransomware infection chain

C2Looper: Rust Backdoor Uses GitHub for C2 Control

Do Son August 24, 2026

At a glance Malware family C2Looper (Rust-based backdoor) Threat actor Suspected ransomware-related actor or initial access broker...

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate

Do Son August 12, 2026

At a glance Malware family Atomic Stealer (AMOS) and MacSync infostealers Threat actor Unnamed operator running a...

Fake AI Tools Malware Targets Developers Through GitHub Fake AI tools malware in a GitHub infostealer campaign targeting developers

Fake AI Tools Malware Targets Developers Through GitHub

Do Son August 11, 2026

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor...

DOUBLECUP ClickFix Loader-as-a-Service infection chain deploying CountLoader and DeviceManager RAT

DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT

Do Son August 11, 2026

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor...

Interlock Ransomware Abuses Volatility3 for Credential Theft Interlock ransomware attack chain abusing Volatility3 memory forensics tool for credential theft

Interlock ransomware attack chain abusing Volatility3 memory forensics tool for credential theft

Interlock Ransomware Abuses Volatility3 for Credential Theft

Do Son August 10, 2026

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos...

CaptiveCrunch malware campaign diagram showing hotel Wi-Fi captive portal hijack by Storm-2945

CaptiveCrunch Malware Campaign Hijacks Hotel Wi-Fi Worldwide

Do Son August 6, 2026

At a glance Actor or group Storm-2945, assessed as an operational sub-cluster of Midnight Blizzard Activity type...

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor...

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine BlueNoroff phishing kit fake Zoom meeting page used in a DPRK ClickFix attack targeting crypto wallets

BlueNoroff phishing kit fake Zoom meeting page used in a DPRK ClickFix attack targeting crypto wallets

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine

Do Son July 30, 2026

At a glance Field Detail Actor / group BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group...

Insikt Group Finds Four New Golden Chickens Malware Families Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Insikt Group Finds Four New Golden Chickens Malware Families

Do Son July 28, 2026

At a glance Actor or group TAG-195, also tracked as Golden Chickens and Venom Spider; deployment observed...

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Do Son July 28, 2026

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via...

TAG-150 Attack Chain Deploys DenoRAT Malware Head Mare TrueConf attack PhantomCore backdoor diagram

TAG-150 Attack Chain Deploys DenoRAT Malware

Do Son July 24, 2026

A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an...

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor...

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe

Do Son July 22, 2026

At a glance Actor / group UAT-11795 (suspected Russian-speaking, financially motivated) Activity type Credential and cryptocurrency theft...

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks

Do Son July 21, 2026

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a...

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or...

Mexican Banking Fraud: REF6045 Operation Exposed Diagram of the REF6045 operation executing Mexican banking fraud using SCMBANKER.

Mexican Banking Fraud: REF6045 Operation Exposed

Do Son July 14, 2026

On June 18, 2026, security analysts detected a host downloading suspicious PowerShell scripts from an open directory....

Hackers Abused Claude.ai Shared Chat in a ClickFix Malvertising Campaign ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

Hackers Abused Claude.ai Shared Chat in a ClickFix Malvertising Campaign

Do Son June 24, 2026

At a Glance Platform abused claude.ai shared chat feature (Anthropic) and GitLab Pages Data exposed Browser credentials,...

Critical Alert 7 Active Exploits Detected Today