17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware Traps: Report by CTM360

ClickFix has become the most common way attackers get into enterprise networks, and it does it without an exploit, an attachment, or a file on disk. Our new global threat report traces the technique from a novelty in late 2023 to a subscription product with on-chain infrastructure and a state-sponsored user base, and explains why blocking malicious domains is no longer a useful defense.

Read the full report here: https://www.ctm360.com/reports/clickfix-beyond

A particular kind of security problem no patch will close. ClickFix is one of them.

The attack begins with a page that presents a problem the user believes is theirs to solve. A human verification check that will not complete. A browser that cannot render the page. A document that will not open. A Mac that is running low on storage. The page offers a remedy in the form of instructions, quietly writes the "fix" to the clipboard, and asks the user to open a system interface they already trust, paste, and press Enter.

That is the whole technique. There is no vulnerability for a scanner to find, usually no attachment for an email gateway to detonate, and no download for a browser's reputation check to score. The command is pasted by an authenticated interactive user into a native, signed, universally present binary, which is precisely the profile of legitimate administrative work.

It is now the leading initial-access technique in enterprise intrusion telemetry. Microsoft attributed 47% of the initial-access cases handled by its Defender Experts team in 2025 to ClickFix, ahead of conventional phishing. ESET measured a 517% rise into the first half of 2025, and a further 108% between the second half of 2025 and the first half of 2026. MITRE gave the behavior its own sub-technique, T1204.004, User Execution: Malicious Copy and Paste in March 2025, listing Windows, macOS and Linux as affected platforms.

Our report consolidates two independent bodies of primary analysis with open-source research: a campaign-level analysis covering more than 17,000 infected URLs serving fake Cloudflare verification pages, around 3,000 of them still actively serving the lure at the time of writing and a host-level analysis of a single compromised WordPress site examined entirely from the responses it returns to an ordinary visitor. Read together, they cover the full path from the injected page to an information stealer running inside a signed Microsoft process.

Three findings matter most for defenders.

The infrastructure is built to survive takedown

The injected script on a compromised website contains no attacker domain at all.

Instead, when a visitor loads the page, their own browser makes a free, read-only call to a smart contract on the Polygon blockchain. The contract returns an encoded string that decodes to the current lure hostname. No wallet, no transaction, and no cost. The technique is known as EtherHiding.

During a single day of analysis, that contract returned three different lure hosts in sequence and not one of the compromised websites was modified. The operator edits one on-chain value and every infected site follows within seconds. No registrar to complain to, no hosting provider to notify, and the RPC providers used to read the value are legitimate shared services that real applications depend on.

The same architectural idea appears again further down the chain, where Telegram channel descriptions and a Steam profile page resolve the malware's command-and-control address. Two independent resolution mechanisms at two different stages is a design decision, not an accident: the kit is built so that no single takedown breaks it.

The practical consequence is uncomfortable but clear. Blocking lure domains is close to worthless as a control. They rotate faster than any blocklist can be published.

Targeting is server-side, per-visitor, and deliberately hostile to analysis

The lure page reports the visitor's operating system and version back to the operator, which replies with a configuration naming which platforms to attack and which landing page to serve for each.

In the sample we analyzed, Windows was switched on. macOS and Linux landing pages were built and held in reserve. Mobile was suppressed entirely, and a cookie suppressed the overlay for repeat visitors for 90 days.

That configuration is worth dwelling on, because it undercuts a common assumption. The widespread belief that ClickFix is a Windows problem is a description of current configuration, not of capability, and it can be changed with a single server-side flag. The macOS branch was fully populated and functional; macOS lures are a mature parallel product line with their own pretexts, including a disk-space "maintenance" pretext styled as an Apple support article. The Linux slot existed and was empty.

Running underneath all of this is a traffic distribution system that polls the operator roughly every 1.5 seconds and can silently mark a session "verified" without ever showing the malicious instruction. Researchers, sandboxes and crawlers get a clean page. Intended targets get the lure.

The payload is gated on machine identity

The third finding is the one that should change how teams interpret their tooling.

In the dropper recovered from the live host, a hardware and account fingerprint machine GUID, volume serial, computer name, BIOS manufacturer, system model, GPU and username is base64-encoded directly into the download path. The command-and-control server therefore sees the victim's identity before it serves anything, and can return a payload chosen per machine, or nothing at all.

A sandbox is not merely detected and evaded here. It is served machine-specific content that is not the payload a real victim receives. Detonation-based verdicts on this chain are structurally unreliable, and the absence of a payload in a sandbox is not evidence that a site is clean.

Controls that depend on recognising attacker infrastructure will decay within hours. Controls that constrain what an interactive user is permitted to execute hold their value across every variant we have seen, and the ones that have not been named yet.

Read the full report here: https://www.ctm360.com/reports/clickfix-beyond

What the two samples say together

The two analyses were conducted independently, on different hosts, using different methods. One stops at the dropper because the payload was fingerprint-gated. The other follows the chain to the end: through three Telegram dead-drop resolvers and two layers of AES decryption, to Vidar Stealer executing inside a legitimately signed Microsoft binary by DLL side-loading.

They recovered the same traffic-distribution API shape, which points to a shared kit rather than convergent design. An open-source research closes the loop: Sekoia's June 2026 analysis of the ErrTraffic framework identifies the exact Polygon contract we observed as belonging to an operator cluster that distributes Vidar exclusively. The payload one sample could not retrieve is the payload the cluster operating that contract is documented to deliver.

We hold that correlation at moderate confidence; the framework is sold to multiple affiliates at around $380 a month, and cluster boundaries shift.

Why WordPress keeps appearing

WordPress is not incidental to any of this. It is the substrate the delivery business is built on: real domains, valid certificates, genuine inbound traffic, and in most cases, nobody monitoring. Reputation cannot be bought that cheaply anywhere else.

The report includes a finding that matters for anyone cleaning up an infected site. On the host we examined, the loader was not injected into a page, a post, or a theme file. It was appended by PHP to every dynamic response the server produced byte-identical across HTML, RSS and JSON alike which points to a must-use plugin that loads on every request and never appears in the plugin list. Alongside it sat roughly two dozen backdoor administrator accounts, created by script.

Deleting the visible script, removing the spam pages and deleting the one obviously rogue account is the most common response, and it fixes none of it.

What actually works

The report organises remediation around four chokepoints that every campaign passes through on every platform: a page must be able to write to the clipboard; a user must be able to open an interpreter; that interpreter must reach the internet; and something must persist, collect and exfiltrate.

Two controls are badly underused relative to their value. Blocking clipboard-write by default in managed browsers closes the entire class at the staging step, the page can still display instructions, but a user asked to retype an obfuscated one-liner by hand will usually stop. Forcing script interpreters and fetch utilities through an authenticated proxy breaks every staged chain in the report at the first hop, on Windows, macOS and Linux alike, without depending on a single indicator.

For users, one rule carries most of the value, and it does not decay when the artwork changes:

No legitimate website, verification check, error message, video call or software update will ever ask you to copy something and paste it into the Run box, PowerShell, Terminal, a command prompt or the File Explorer address bar.

If a page asks you to do that, the page is the attack.

The full report covers the technique's evolution from 2023 to 2026, the variant family including FileFix and CrashFix, a taxonomy of observed lure templates across Windows and macOS, the WordPress delivery layer, both sample analyses in full, a Mitre ATT&CK mapping, indicators grouped by expected lifetime, and platform-by-platform remediation for Windows, macOS, and Linux.

Read the full CTM360 report here: https://www.ctm360.com/reports/clickfix-beyond

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.