Meet IClickFix: a widespread framework using the ClickFix tactic

IClickFix is a malicious framework that compromises WordPress sites to distribute malware using the ClickFix social engineering tactic. Active since December 2024, it has infected over 3,800 WordPress sites globally. The framework injects malicious JavaScript into compromised sites, leading users through a fake CAPTCHA challenge that tricks them into executing malicious code. This ultimately installs NetSupport RAT, granting attackers full control of infected systems. The campaign has evolved over time, adding traffic distribution systems and refining its lures. While initially distributing Emmenhtal Loader and XFiles Stealer, it now primarily delivers NetSupport RAT. The widespread nature of the attacks suggests opportunistic exploitation rather than targeted campaigns.

• TRUST#GRAFT : JavaScript-Compromised Sites Target WordPress Admin Browsers to Deploy a Persistent PHP BackdoorMalware2026-10-22
• PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP FlawsExploitedVulnerability2026-10-21
• WordPress 7.0.2 · Path TravesalExploitedVulnerability2026-10-01
• Amazon-Themed ClickFix Campaign Serves Up Finger-Licking MalwareMalware2026-10-21
• Active Exploitation of CVE-2026-110936 in Siemens Software CenterExploitedCampaign2026-10-20