Do Son Sophos CTU reveals how the ClickFix tactic led to a Qilin ransomware attack via NetSupport RAT and StealC V2 using stolen VPN credentials.
ClickFix
GrayBravo MaaS uses CastleRAT to target logistics/hospitality. The RAT hides its C2 by using Steam Community profiles as Dead Drop Resolvers, bypassing network monitoring.
Darktrace exposed TAG-150, a new MaaS operator compromising 469+ US devices in months. The group uses ClickFix to trick victims into running malicious PowerShell that deploys the CastleLoader/CastleRAT backdoor.
A 42-day Akira ransomware attack started with one ClickFix CAPTCHA that deployed SectopRAT. The attackers went undetected despite EDRs, stealing 1 TB and deleting cloud storage backups.
eSentire exposed the Amatera Stealer campaign using ClickFix social engineering to deliver multi-stage PowerShell. The malware patches AMSI in memory and deploys NetSupport RAT for remote access.
Sekoia exposed a campaign exploiting compromised Booking.com/Expedia accounts to deliver PureRAT malware via a ClickFix lure. Attackers use authentic reservation details to steal guest credentials.
BitSight uncovered a Lampion banking Trojan campaign using ClickFix lures and a 700MB bloatware DLL to evade AV. The VBScript loader establishes persistence via the Windows Startup folder.
NetSupport RAT Campaign Abuses ClickFix to Infect Hosts; 3 Threat Clusters Use RMM for Covert Access
NetSupport RAT Campaign Abuses ClickFix to Infect Hosts; 3 Threat Clusters Use RMM for Covert Access
eSentire exposed a surge in NetSupport RAT campaigns using the ClickFix social engineering tactic. Three threat clusters leverage a PowerShell loader to bypass AV and gain full remote access via the RMM tool.
SentinelLABS exposed PhantomCaptcha, a ClickFix campaign targeting Ukraine NGOs. It uses a fake Cloudflare CAPTCHA to deploy a multi-stage PowerShell WebSocket RAT and a parallel Android spyware attack.
Google exposed Russia's COLDRIVER APT deploying a new "ROBOT" malware family (NOROBOT, YESROBOT) just 5 days after its LOSTKEYS tool was disclosed. The multi-stage malware uses a ClickFix lure.
Proofpoint exposed TA585, a self-reliant group that uses ClickFix phishing and private C2 infrastructure (CoreSecThree) to deploy MonsterV2 RAT (available for up to $2,000/month) with Hidden VNC capabilities.
Expel uncovered a phishing attack using Cache Smuggling to deliver malware. The technique uses a fake Fortinet lure and PowerShell to execute a payload staged in the browser's cache, bypassing network detection.
Researchers from Palo Alto Networks Unit 42 have discovered a new phishing trend where attackers trick victims...
Russia-linked APT COLDRIVER is using a new multi-stage malware campaign (BAITSWITCH/SIMPLEFIX) with a ClickFix lure to target journalists and activists for espionage.
GitLab Threat Intelligence reveals a new North Korean malware campaign using "ClickFix" social engineering to target new industries like crypto and retail.
A new report reveals HijackLoader, a Malware-as-a-Service loader. It uses advanced evasion and anti-analysis techniques to deliver stealers and other payloads.
A new botnet, NightshadeC2, is using a technique called "UAC Prompt Bombing" to bypass sandboxes and Windows Defender by relentlessly looping UAC prompts.
A new report reveals that the Lazarus Group is actively monitoring CTI platforms to evade detection and sustain a ClickFix phishing campaign against the cryptocurrency sector.
A new report from Huntress reveals a hybrid ClickFix attack that abuses the Windows search protocol and malicious LNK files to deliver MetaStealer malware.
eSentire exposes Interlock, a new ransomware group using multi-stage payloads and the ClickFix social engineering technique to deploy ransomware and backdoors via compromised websites.
Interlock RAT Gets PHP Makeover: New Variant Uses Steganography & ClickFix for Stealthy Infiltration
Interlock RAT Gets PHP Makeover: New Variant Uses Steganography & ClickFix for Stealthy Infiltration
The DFIR Report uncovers a new PHP-coded Interlock RAT variant, using compromised websites and ClickFix social engineering to deploy stealthy malware for recon and persistence.
Cybereason exposes a deceptive malware campaign using compromised WordPress sites and the "ClickFix" technique to deliver weaponized NetSupport Manager RAT clients for remote access.