Beyond the clipboard: The evolving tradecraft of ClickFix

ClickFix is a malware campaign that has evolved from simple clipboard-based social engineering to complex attack chains involving malvertising, typosquatting, and SEO poisoning. It uses fake verification prompts and sophisticated PowerShell scripts with animated progress bars to deceive victims. Payloads include Node.js-based RATs such as DuskDesk, with lateral movement targeting domain controllers via WinRM and SSH tunnels. Delivery methods include steganography hiding executables in PNG files and browser-cache-seeded attacks that detect the victim's browser to retrieve payloads. Defenses focus on user training, application control, and behavioral monitoring for suspicious command execution and persistence.

• Remcos RATMalware2026-11-06
• BITTER Expands Its Arsenal with PapRATMalware2026-11-03
• Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and a C2 ImplantMalware2026-11-09
• Lookalike Domains Expose the iPhone Theft EconomyCampaign2026-11-06
• Inside Phexia: A macOS malware delivered through ClickFixMalware2026-11-05