ClickFix Archives • Daily CyberSecurity

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate Spirals ransomware double extortion attack chain from IIS web shell to network encryption

Spirals ransomware double extortion attack chain from IIS web shell to network encryption

macOS ClickFix Campaign Hides Its Lure Behind a Fingerprinting Gate

Do Son August 12, 2026

At a glance Malware family Atomic Stealer (AMOS) and MacSync infostealers Threat actor Unnamed operator running a...

Fake AI Tools Malware Targets Developers Through GitHub Fake AI tools malware in a GitHub infostealer campaign targeting developers

Fake AI Tools Malware Targets Developers Through GitHub

Do Son August 11, 2026

At a glance Malware family MaaS infostealer delivered via SmartLoader (NodeJS strain among final payloads) Threat actor...

DOUBLECUP ClickFix Loader-as-a-Service infection chain deploying CountLoader and DeviceManager RAT

DOUBLECUP: New ClickFix Loader Drops CountLoader and DeviceManager RAT

Do Son August 11, 2026

At a Glance Attribute Detail Malware family DOUBLECUP (Loader-as-a-Service); payloads CountLoader 4.5p and DeviceManager RAT Threat actor...

Interlock Ransomware Abuses Volatility3 for Credential Theft Interlock ransomware attack chain abusing Volatility3 memory forensics tool for credential theft

Interlock ransomware attack chain abusing Volatility3 memory forensics tool for credential theft

Interlock Ransomware Abuses Volatility3 for Credential Theft

Do Son August 10, 2026

At a Glance Attribute Detail Malware family Interlock ransomware (double extortion) Threat actor Interlock, tracked by Sophos...

CaptiveCrunch malware campaign diagram showing hotel Wi-Fi captive portal hijack by Storm-2945

CaptiveCrunch Malware Campaign Hijacks Hotel Wi-Fi Worldwide

Do Son August 6, 2026

At a glance Actor or group Storm-2945, assessed as an operational sub-cluster of Midnight Blizzard Activity type...

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader malware infection chain delivering NeedleStealer crypto wallet spoofer and NetSupport RAT

CastleLoader Malware Now Delivers NeedleStealer Wallet and Browser Spoofers

Do Son August 3, 2026

At a glance Malware family CastleLoader (loader); payloads include CastleStealer, NetSupport RAT, Lobshot, and NeedleStealer Threat actor...

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine BlueNoroff phishing kit fake Zoom meeting page used in a DPRK ClickFix attack targeting crypto wallets

BlueNoroff phishing kit fake Zoom meeting page used in a DPRK ClickFix attack targeting crypto wallets

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine

Do Son July 30, 2026

At a glance Field Detail Actor / group BlueNoroff (TA444), a subgroup of North Korea’s Lazarus Group...

Insikt Group Finds Four New Golden Chickens Malware Families Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Golden Chickens malware chain showing ChonkyChicken malware and TinyEgg delivered through ClickFix fake verification pages

Insikt Group Finds Four New Golden Chickens Malware Families

Do Son July 28, 2026

At a glance Actor or group TAG-195, also tracked as Golden Chickens and Venom Spider; deployment observed...

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

ClickFake Interview campaign delivering PylangGhost RAT and GolangGhost RAT to crypto professionals

Fake Job Interviews Deliver PylangGhost and GolangGhost RATs to Crypto Workers

Do Son July 28, 2026

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via...

TAG-150 Attack Chain Deploys DenoRAT Malware hack

TAG-150 Attack Chain Deploys DenoRAT Malware

Do Son July 24, 2026

A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an...

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

ACR Stealer Spreads Through ClickFix Lures in Two Attack Chains

Do Son July 24, 2026

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor...

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Starland RAT Campaign by Russian-Speaking Actor UAT-11795 Targets Crypto Users in the US and Europe

Do Son July 22, 2026

At a glance Actor / group UAT-11795 (suspected Russian-speaking, financially motivated) Activity type Credential and cryptocurrency theft...

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ malware infection chain from a ClickFix attack through VIDAR to modular payload delivery

TELEPUZ Malware Spreads Through ClickFix and VIDAR Attacks

Do Son July 21, 2026

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a...

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer macOS malware fake Cloudflare ClickFix Terminal prompt stealing passwords

ClickLock Stealer Locks macOS Screens Until Victims Hand Over Their Password

Do Son July 21, 2026

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or...

Mexican Banking Fraud: REF6045 Operation Exposed Diagram of the REF6045 operation executing Mexican banking fraud using SCMBANKER.

Mexican Banking Fraud: REF6045 Operation Exposed

Do Son July 14, 2026

On June 18, 2026, security analysts detected a host downloading suspicious PowerShell scripts from an open directory....

Hackers Abused Claude.ai Shared Chat in a ClickFix Malvertising Campaign ACR Stealer infection chain starting with a ClickFix lure to steal browser credentials

Hackers Abused Claude.ai Shared Chat in a ClickFix Malvertising Campaign

Do Son June 24, 2026

At a Glance Platform abused claude.ai shared chat feature (Anthropic) and GitLab Pages Data exposed Browser credentials,...

macOS ClickFix AppleScript stealer diagram showing the Meow macOS stealer infection chain

macOS ClickFix AppleScript Stealer Hijacks Crypto Wallets

Do Son June 23, 2026

At a Glance Malware Family: Meow macOS stealer (AppleScript-based infostealer and RAT) Threat Actor: Suspected Russian-speaking attacker...

ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites Spirals ransomware double extortion attack chain from IIS web shell to network encryption

ErrTraffic Malware Spreads ClickFix Lures via Hacked WordPress Sites

Do Son June 22, 2026

At a glance Malware family ErrTraffic (ClickFix distribution framework / TDS, sold as MaaS) Threat actor Sold...

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT malware SnappyClient, HijackLoader, Malware-as-a-Service

SilabRAT Malware: The $5,000-a-Month Crypto-Hunting RAT Hiding Behind HijackLoader

Do Son June 17, 2026

A new commercial remote access trojan called SilabRAT is making waves on the cybercrime underground. Also known...

DriveSurge Threat Cluster Exploits Thousands of Websites Globally DriveSurge threat cluster Traffic Distribution System

DriveSurge Threat Cluster Exploits Thousands of Websites Globally

Do Son June 4, 2026

A sophisticated digital campaign is currently compromising thousands of web ecosystems across the internet. Specifically, defensive intelligence...

Global Ghost CMS Poisoning Campaign Exploits Enterprise Blogs

Do Son May 27, 2026

Security researchers have discovered a massive cyber assault infecting hundreds of web servers worldwide. Specifically, a newly...

New “ClickFix” Campaign Bypasses Gatekeeper to Hijack macOS Devices macOS ClickFix Campaign Terminal Infostealer

New “ClickFix” Campaign Bypasses Gatekeeper to Hijack macOS Devices

Do Son May 9, 2026

For years, macOS users have relied on community forums, Medium articles, and tech blogs to solve everyday...