17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360
CTM360 says ClickFix, now the top enterprise initial-access method, hides lure hosts on Polygon and delivers info-stealers.
CTM360’s report traces more than 17,000 URLs, about 3,000 still active, that serve fake Cloudflare checks and use ClickFix to place commands on the clipboard for the user to paste and run. Microsoft attributed 47% of 2025 initial-access cases handled by Defender Experts to ClickFix, ahead of conventional phishing, while ESET measured a 517% rise into early 2025 and a further 108% into the first half of 2026. MITRE records the behavior as T1204.004. Compromised pages, including a WordPress site, resolve lure hostnames through a Polygon smart contract, later use Telegram and Steam to locate command-and-control, and gate an information stealer on a per-machine fingerprint so sandboxes often receive different content.
- More than 17,000 lure URLs were tracked, and about 3,000 were still active.
- Microsoft tied 47% of 2025 Defender Experts initial-access cases to ClickFix.
- Polygon smart contracts rotate lure hosts without changing compromised websites.
- Telegram and Steam pages are used to resolve command-and-control addresses.
- Payloads are selected from a machine fingerprint, making sandbox verdicts unreliable.
From the original article
7 min read at thehackernews.com
ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense. Read
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.