Huntress: ClickFix chains now persist, move laterally, and steal credentials
Recent lures use malvertising, typosquats, and compromised sites, then show fake verification text while payloads run.
Stories per day · 30 days
4 RSS
Relatedcandiru8citizen-lab8spyware8zero-click8clickfix7discover-tech7adfection4al-jazeera4claude3cryptocurrency3ad-fraud2amazon2amos2coruna2exploit-kit2finger2help-tds2ios2
44 stories, newest first · one card per story
Stories tagged #malvertising
Coruna iOS exploit kit in malicious ads seeks crypto seed phrases
ADEX says about 50 advertiser accounts delivered version-matched chains for iOS 13.0 through 17.2.1, mainly on older devices.
2
Stolen K-12 staff logins used to phish other school districts
MS-ISAC notified 808 of 6,116 K-12 members that staff credentials were on underground markets and expects hopping to continue.
Ad platform says malware ads fingerprint iOS before payload
ADEX linked about 50 advertiser accounts by shared cloaking behavior and says that does not mean they delivered Coruna.
1
Crypto thieves infect iPhones via ads on hundreds of compromised sites
iVerify says victims only need to view an ad, including one served on Instagram.
1
Google Ads push fake Claude downloads on claude.ai that install stealers
macOS ClickFix commands fetch Atomic macOS Stealer; a Windows Artifact runs a packed .NET payload with remote access.
1
Fake Claude downloads on claude.ai and Google Ads push stealers
Mac users who paste the ClickFix command get Atomic macOS Stealer; a separate Windows lure delivers an encrypted .NET payload.
ClickFix leads detections as fake AI-tool installs deliver malware
Push says four in five intercepted ClickFix pages in 2026 were reached from search engines, not email.
ClickFix campaign uses Windows finger to install Lumma
A sponsored Google result for “amazon business” opens a fake login and CAPTCHA that launches finger.exe and NetSupport.
Amazon-themed ClickFix uses finger.exe to deliver stealers
Huntress tied the chain to at least three customers; a macOS script URL was offline during research.
Scam ads on social platforms phish users, push malware and steal money
The FTC is only starting to consider rules that would make platforms stop impersonation-scam ads before users see them.
2
Infoblox infiltrates long-running Microsoft tech-support scam
Help TDS, used since 2017, routes victims to fake alerts and remote-access installs.
1
Researchers Uncover 20,000 Malicious Cloudflare Pages Domains Used in Tech Support Scams
Infoblox found over 20,000 Cloudflare Pages domains used by Help TDS for Microsoft tech-support scams.
No click required: How the ad industry became a pipeline for mercenary spyware
Citizen Lab says Discover-Tech used ad auctions to profile devices and deliver Candiru spyware without a click.
Targeted ads delivered 0-click exploits to install mercenary malware
Citizen Lab says Discover-Tech ads delivered Candiru zero-click exploits that installed mercenary spyware.
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Citizen Lab says Candiru spyware hit at least 45 Al Jazeera devices via zero-click ads.
Hackers Use Online Ads to Infect Devices With Spyware Without a Single Click
Citizen Lab says Candiru spyware reached Al Jazeera devices through zero-click malicious online ads called AdFection.
Spyware vendors found a way to make targeted ads even worse
Citizen Lab says Discover-Tech ads delivered Candiru zero-click spyware that infected Al Jazeera devices.
Citizen Lab says governments are abusing online ads to hack people with ‘zero-click’ spyware
Citizen Lab says Candiru and Bindecy used Discover-Tech ads to deliver zero-click spyware, including against Al Jazeera.
4
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers use Google Ads and Bing redirects to deliver fake Claude installers that run ClickFix commands.
1
CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer now bypasses Chromium App-Bound Encryption and adds a remote shell on Windows.
3
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
Huntress details attackers abusing ChatGPT Custom GPTs with ClickFix lures to deliver a full-featured RAT via DLL sideloading, infecting at least 40 users.
1
Custom ChatGPTs push ClickFix attacks to deploy RAT malware
Huntress uncovered malicious custom ChatGPT 'Plus 5.6' promoted via Google ads that pushes ClickFix PowerShell payloads installing a full-featured RAT.
Malicious Custom GPT on chatgpt.com lures users into installing a RAT
Malicious ChatGPT Custom GPTs promoted via sponsored Google results push a ClickFix fake-CAPTCHA lure that sideloads a RAT via signed executables.