MalwarePublished 10 Oct 2025Updated 9 Nov 2025

The ClickFix Factory: First Exposure of IUAM ClickFix Generator

Source AlienVault OTX General

Description

Palo Alto Unit42 have uncovered a phishing kit named the IUAM ClickFix Generator that automates the creation of these attacks. The kit is designed to generate highly customizable phishing pages that lure victims by mimicking browser verification challenges often used to block automated traffic. It includes advanced features such as operating system detection and clipboard injection, enabling low-effort, cross-platform malware deployment.

Impact

For European organizations, the IUAM ClickFix Generator poses a substantial risk by enabling sophisticated phishing campaigns that can bypass traditional automated traffic filters and deceive users into executing malicious payloads. The potential impacts include credential theft, unauthorized remote access, data exfiltration, and broader network compromise through deployed RATs and info stealers. Financial institutions, government agencies, and enterprises with sensitive data are particularly vulnerable due to the high value of stolen credentials and access. The cross-platform nature of the kit increases the attack surface, affecting organizations using diverse operating systems including macOS, which is increasingly prevalent in European corporate environments. The clipboard injection technique can lead to stealthy malware execution that evades detection by conventional endpoint security solutions. Additionally, the kit’s automation capabilities may lead to rapid scaling of phishing campaigns, increasing the volume and reach of attacks. This can strain incident response resources and increase the likelihood of successful breaches. The absence of known exploits in the wild currently limits immediate impact, but the availability of the kit suggests a high potential for future exploitation. Overall, the threat could lead to significant operational disruption, financial loss, and reputational damage for affected organizations in Europe.

Defensive guidance

European organizations should implement targeted defenses against this threat by enhancing phishing detection capabilities to recognize IUAM-style browser verification mimicry. Deploy advanced email filtering solutions that use machine learning to detect phishing content and URLs associated with the ClickFix Generator. Web gateways should be configured to block access to known phishing domains and monitor for unusual traffic patterns indicative of automated phishing campaigns. Endpoint detection and response (EDR) tools must be tuned to detect clipboard injection behaviors and suspicious process injections associated with info stealers and RATs. User awareness training should specifically include education on the risks of fake browser verification pages and the dangers of interacting with unexpected clipboard content. Network segmentation can limit lateral movement if a compromise occurs. Organizations should also monitor threat intelligence feeds for emerging indicators related to this kit and update intrusion detection/prevention systems accordingly. Incident response teams should prepare playbooks for phishing incidents involving clipboard injection and remote access malware. Finally, multi-factor authentication (MFA) should be enforced to reduce the impact of credential theft resulting from phishing.

Indicators of compromise

Domains 23

365-drive.com
apposx.com
asmicareer.com
claudflurer.com
cloudlare-lndex.com
coffeyelectric.com
emailreddit.com
evodigital.com.au
favorite-hotels.com
financementure.com

IP addresses 10

194.26.29.217CC=RU ASN=AS206728 media land llc
45.135.232.33CC=RU ASN=AS50340 ooo network of data-centers selectel
83.222.190.214CC=BG ASN=AS8866 bulgarian telecommunications company plc.
185.93.89.62CC=GB ASN=ASNone
188.92.28.186CC=IT ASN=ASNone
38.242.212.5CC=US ASN=AS51167 contabo gmbh
45.146.130.129CC=AT ASN=AS60781 leaseweb netherlands b.v.
45.146.130.131CC=AT ASN=AS60781 leaseweb netherlands b.v.
45.146.130.132CC=AT ASN=AS60781 leaseweb netherlands b.v.
88.214.50.3CC=US ASN=AS207710 sia singularity telecom

Hashes 78

132e25ea2d3d03895eff21604af17f45MD5 of cd78a77d40682311fd30d74462fb3e614cbc4ea79c3c0894ba856a01557fd7c0
1fa2337e518007fa58372131884b1442MD5 of 7765e5e0a7622ff69bd2cee0a75f2aae05643179b4dd333d0e75f98a42894065
2380171dc36e65afaf80c3f2d1b8d161MD5 of d81cc9380673cb36a30f2a84ef155b0cbc7958daa6870096e455044fba5f9ee8
3bae56eadb97d989914a3cf501b6a0a5MD5 of 029a5405bbb6e065c8422ecc0dea42bb2689781d03ef524d9374365ebb0542f9
3dce9829ad6e7520a44caee0ca4f7cfaMD5 of 397ee604eb5e20905605c9418838aadccbbbfe6a15fc9146442333cfc1516273
3f98877f798fe4dcff570f3000683132MD5 of 9090385242509a344efd734710e60a8f73719130176c726e58d32687b22067c8
52b94f794f71aed4109feda245a815aaMD5 of 081921671d15071723cfe979633a759a36d1d15411f0a6172719b521458a987d
5739ed3f8734497bfe782dcad9cbc6a7MD5 of 3aee8ad1a30d09d7e40748fa36cd9f9429e698c28e2a1c3bcf88a062155eee8c
63a7cd62e4108f3c5c4b599b2bdf035bMD5 of 8ed8880f40a114f58425e0a806b7d35d96aa18b2be83dede63eff0644fd7937d
674d3bcfbcc296ccb583496edd06de84MD5 of ba5305e944d84874bde603bf38008675503244dc09071d19c8c22ded9d4f6db4

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Oct 2025, 18:24 UTC

MITRE ATT&CK techniques5 from threat tags

Technical details

Indicators of compromise

Domains 23

IP addresses 10

Hashes 78

Community reviews

Related threats