Fake Cloudflare CAPTCHA ClickFix lures hide malware in PNG images
Huntress says pasted PowerShell rebuilt full executables from PNG pixel data, then added persistence and lateral movement.
Stories per day · 30 days
16 RSS
Relatedsocial-engineering11romulus10infostealer9dll-sideloading8macos7malvertising7powershell7chrome6safe-browsing6siemens6claude5forescout5gemini5legionloader5phishing5chatgpt4dll-side-loading4cloudflare3
161 stories, newest first · one card per story
Stories tagged #clickfix
Huntress: ClickFix chains now persist, move laterally, and steal credentials
Recent lures use malvertising, typosquats, and compromised sites, then show fake verification text while payloads run.
Phexia malware tricks Mac users into running Terminal commands
Phexia steals passwords and browser data from infected macOS machines via ClickFix tricks.
1
Dark Reading offers nine habits for current workplace cyber risks
A reader poll put phishing at 39.1% and shadow AI at 38.2% as the top awareness challenges.
Fake Cloudflare checks push ClickFix commands to Windows and Mac users
Commands pointed to api-com.cfd and cf-id.com, but neither yielded a payload, so the malware remains unknown.
1
ESET details Amatera infostealer spread, capabilities, and MaaS model
Sold from $199 a month, it led ESET’s Latin America infostealer detections in the first half of 2026.
1
Fake Cloudflare checks on hacked sites push ClickFix commands
SANS could not retrieve the Windows or macOS payload after test fetches returned HTTP 403 or failed to resolve.
2
Stolen K-12 staff logins used to phish other school districts
MS-ISAC notified 808 of 6,116 K-12 members that staff credentials were on underground markets and expects hopping to continue.
Unnamed ClickFix campaign uses fake Cloudflare checks on Windows and macOS
The researcher could not retrieve either payload: Windows returned 403 and the macOS malware domain did not resolve.
1
Huntress ranks RMM abuse and mailbox attacks atop SMB threats
Huntress says RMM abuse was 45% of Q1 2026 endpoint incidents and mailbox manipulation 24.6% of 2026 ITDR signals.
1
Malwarebytes warns of ClickFix lures amid PHP, Brotli and certificate issues
The piece says attackers exploited two unnamed PHP flaws and that browsers have blocked eight bad certificates.
Google Ads push fake Claude downloads on claude.ai that install stealers
macOS ClickFix commands fetch Atomic macOS Stealer; a Windows Artifact runs a packed .NET payload with remote access.
1
Fake Claude downloads on claude.ai and Google Ads push stealers
Mac users who paste the ClickFix command get Atomic macOS Stealer; a separate Windows lure delivers an encrypted .NET payload.
ICMacOS Mac malware sold for $699 a week with remote commands
Version 2 adds a WebSocket shell and LaunchAgent persistence while still stealing developer and wallet secrets.
Storm-1865 used ClickFix and Booking.com lures against hotels
Fake CAPTCHA pages pushed mshta commands that installed stealers and RATs; Booking.com says its own systems were not breached.
1
TRUST#GRAFT uses logged-in WordPress admins to install a PHP backdoor
The chain uploads wm.zip as Web Media Optimizer and copies itself to mu-plugins so deleting the visible plugin leaves it loaded.
Exaforce says GitHub token theft and vishing drain data in minutes
A dormant OAuth token pulled 472 of 638 repositories; ClickFix and help-desk vishing followed the same pattern.
1
Siemens Software Center DLL side-loading flaw exploited before 4.0.9.8
Attackers shipped signed Software Center 3.5.8.7 with malicious DLLs; every build before 4.0.9.8 is affected.
2
Siemens Software Center DLL flaw exploited in ClickFix attacks
CVE-2026-110936, fixed in 4.0.9.8, was used to side-load malware beside an unmodified signed executable in the Romulus campaign.
3
Chrome uses Gemini to warn on scam sites and ClickFix commands
Enhanced Protection now scores pages with a server-side Gemini model and warns before copied ClickFix commands run.
Chrome warns on ClickFix clipboard commands and plain HTTP
Server-side Gemini scam checks and ClickFix clipboard warnings are Enhanced Protection features; HTTP prompts are now default for everyone.
Chrome Enhanced Protection uses Gemini to catch update and antivirus scams
Scam scoring moved to a server-side model for every Enhanced Protection user, with separate suspicious-site warnings and ClickFix command checks.
ClickFix leads detections as fake AI-tool installs deliver malware
Push says four in five intercepted ClickFix pages in 2026 were reached from search engines, not email.
Chrome uses server-side Gemini to flag fake antivirus scams
Enhanced Protection adds scam scoring, separate suspicious warnings, and clipboard checks for ClickFix commands.