The Evolution of ClickFix: From Cleartext to Server Side Polymorphism

The ClickFix campaign is a malware operation that has evolved from simple disk-based infections to advanced, obfuscated attacks using fake CAPTCHA pages to trick victims into running malicious PowerShell commands. Early variants used cleartext commands to download batch scripts deploying DeerStealer InfoStealer. Later versions employ fileless execution with XOR encryption or Base64 compression, running entirely in memory. The most advanced stage uses server-side polymorphism to dynamically generate unique obfuscated payloads per victim, delivering Vidar InfoStealer. The campaign has been active since March 2026, with increased activity through May, leveraging approximately 4,500 live domains. It uses techniques to evade forensic detection by deleting traces after execution.

• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• September 2026 Infostealer Trend ReportMalware2026-10-28
• Variola: From ClickFix to a Modular ImplantMalware2026-10-16
• August 2026 Threat Trend Report on APT Attacks (South Korea)Malware2026-10-02
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29