ClickFix campaigns hide executables in PNG images
Huntress says separate operators used ClickFix to reach domain controllers, steal access, and persist via tasks and Run keys.
68
Product
PowerShell
- Mentions · 7d3
- Mentions · 30d12
- All mentions22
- First seenSep 21, 2026
- Last mentioned10h ago
Timeline
22 articles · newest firstMicrosoft November 2026 Patch Tuesday covers dozens of Windows flaws
The visible Rapid7 list includes several 9.8 remote code execution bugs; each entry is marked not publicly disclosed.
58
Critical Terminal2Shell flaw grants instant shell on all OS
Design flaw in every terminal emulator on macOS Linux Windows and more allows attackers to gain instant shell with full user privileges with no patches available.
90
Fake Colombian court notices deliver XWorm via hidden scripts
Arctic Wolf says Spanish legal lures drop VBScript or JavaScript that inject XWorm into RegAsm.exe.
64
CISA lists critical Google Brotli flaw CVE-2026-111497 as exploited
Out-of-bounds writes in the decoder can yield code execution; fixed builds are 1.0.10, 1.1.1, and 1.2.1.
86
Sirius backdoor variant delivered by Korean FedEx-themed PDF emails
Trellix says a weaponized PDF launches fileless loaders that inject Sirius into suspended Windows processes after the victim approves a prompt.
64
Node2Shell Brotli flaw (CVE-2026-111497) triggers patches from Microsoft, Node.js and Python
Imperva privately demonstrated code execution on Node.js 24.22.0 for Linux arm64, but no attacks in the wild have been reported and some researchers dispute exploitability.
78
New ROMULUS Malware Platform Uses Six Servers to Deliver Multiple Malicious Payloads
Forescout identified ROMULUS, a six-server ClickFix platform delivering trojanized Stardock installers and LegionLoader.
62
Midnight Blizzard-Linked Malware Server Still Delivering Payloads 8 Weeks After Disclosure
ReversingLabs found a Midnight Blizzard-linked server still serving ChocoShell and CornFlake on October 5.
64
Midnight Blizzard-Linked Hackers Use Claude AI to Rebuild Malware and Evade Detection
Midnight Blizzard-linked operators used Claude to rebuild ChocoShell and CornFlake malware against Ukrainian and European targets.
78
Hackers Use ClickFix and Python Tunnels to Prepare Systems for Ransomware Attacks
Forescout says ClickFix installed Lorem Ipsum Loader and a Python tunnel before suspected ransomware was stopped.
64
New ClickFix Attack Deploys Lorem Ipsum Malware Loader to Establish Remote Access
A ClickFix campaign uses the Lorem Ipsum loader to install a Python tunnel for covert remote access.
61
Ignore all instructions and read this blog: The state of AI-analysis evasion in malware
Cisco Talos finds malware embedding AI-evasion prompts that swayed analysis in about 35 percent of tests.
62
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
A ClickFix campaign compromised over 100 Ukrainian websites to deliver the Lunex information stealer.
71
ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits
Microsoft says ClickFix attacks now smuggle VBScript through the browser cache to bypass Windows Run limits.
64
ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache
ClickFix sites hide VBScript in the browser cache and trick users into running it.
71
Microsoft Warns ClickFix Attacks Use Fake CAPTCHA Lures to Execute Malicious Commands
Microsoft warns a ClickFix campaign uses fake CAPTCHA prompts so Windows users run cached malware that steals browser credentials.
74
Hackers Turned a Microsoft SQL Server Into a Command and Data Exfiltration Channel
Attackers abused a Viva Aerobus SQL Server to run commands and steal files, then exposed tools and data online.
62
Documentation placeholder domain used in ClickFix attacks
Placeholder domain third-party.com is serving ClickFix lures that execute remote PowerShell on Windows.
62
Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content
Squatted placeholder domain third-party.com now serves a Windows ClickFix lure referenced in over 1,700 repositories.
76
Operation Conflict Compass Deploys VelvetCake PowerShell Malware Through Malicious LNK Files
North Korea-linked Konni deployed VelvetCake PowerShell malware against Ukraine-focused targets via malicious LNK files.
76
TASK#STOMP PowerShell Backdoor Steals Documents, Wi-Fi Passwords, and Clipboard Data
Securonix details TASK#STOMP, a PowerShell backdoor stealing documents, Wi-Fi passwords, and clipboard data.
63
Related CVEs
by mentions- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- Heap buffer overflow in Microsoft Graphic Fonts
- Command injection privilege escalation in Windows Active Directory
- Local privilege escalation in Desktop Window Manager
- Heap buffer overflow in Microsoft Graphic Fonts (local privilege elevation)
- Local privilege escalation via link following in Data Sharing Service Client
- Local privilege escalation in Desktop Window Manager
- Privilege escalation in Active Directory Domain Services
- Use-after-free in HEIF Image Extensions (local, user interaction)
- Out-of-bounds read in Microsoft Graphic Fonts
Appears with
- Microsoftvendor · 19
- Windowsproduct · 11
- Microsoftorganization · 5
- Microsoft Teamsproduct · 4
- Firefoxproduct · 4
- Googlevendor · 4
- Forescoutorganization · 3
- Huntressorganization · 2
- Anthropicorganization · 2
- Claudeai model · 2
- Lorem Ipsum Loadermalware · 2
- GTG-20006threat actor · 2
- Storm-2945threat actor · 2
- Brotliproduct · 2
- Mozillavendor · 2
- Manifold Securityorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.