Beware of the LegionLoader malware being distributed via the ClickFix method

LegionLoader malware is being distributed through ClickFix tactics using fake Cloudflare CAPTCHA pages. Two primary distribution methods have been identified: one exploits Korea's Newlywed Hope Town Namu Wiki page with malicious URLs, while the other uses spear phishing emails targeting specific companies disguised as internal business system account issuance instructions. When users access these malicious URLs, they are redirected to fake CAPTCHA pages that trick them into executing PowerShell commands, which download and execute LegionLoader. The malware sequentially decrypts encrypted shellcode and PE files, evaluates the infection environment through display device checks and ASN verification, then executes backdoor malware capable of running various payloads including PE files, shellcode, PowerShell scripts, and MSI files. It also steals Chrome browser credentials and profile information based on C2 server commands.

• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• third-party.com Placeholder Domain Now Serves ClickFixCampaign2026-09-24
• Disposable Domains, Durable HostingMalware2026-09-23
• TerminalFix campaign deploys a reverse tunnel through multistage intrusionMalware2026-08-29
• Tracking PavinLoader across ClickFix and fake download campaignsMalware2026-08-25