Elektrine
Log in Register

#clickfix

31 posts · Last used 8d

13 @13@2137.social
· 1w ago
Cyberprzestępcy serwują malware na zhakowanych stronach. Szczegóły kampanii Psychedelic Stealer https://sekurak.pl/cyberprzestepcy-serwuja-malware-na-zhakowanych-stronach-szczegoly-kampanii-psychedelic-stealer/ #Wbiegu #CAPTCHA #Clickfix #Infostealer #Malware #Ukraina
Cyberprzestępcy serwują malware na zhakowanych stronach. Szczegóły kampanii Psychedelic Stealer
Sekurak

Cyberprzestępcy serwują malware na zhakowanych stronach. Szczegóły kampanii Psychedelic Stealer

Badacze bezpieczeństwa z Arctic Wolf Labs przedstawili analizę kampanii cyberprzestępczej skupiającej się na propagacji złośliwego oprogramowania – Psychodelic Stealer. To co zasługuje na szczególną uwagę to sposób dystrybucji malware.  TLDR: Zamiast tworzyć od zera (podszywać się pod) ukraińskie strony biznesowe, cyberprzestępcy podejmowali szereg działań, aby przejąć legalne i zaufane witryny....

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 1w ago
Discover how the Psychedelic Stealer malware uses fake Cloudflare CAPTCHA ClickFix lures to infect computers and steal passwords and cryptocurrency. #PsychedelicStealer #ClickFix #CyberSecurity #Malware #Cloudflare https://meterpreter.org/psychedelic-stealer-clickfix-campaign/?utm_source=mastodon&utm_medium=jetpack_social
Psychedelic Stealer Spreads via Fake Cloudflare ClickFix Pages
Information Security News

Psychedelic Stealer Spreads via Fake Cloudflare ClickFix Pages

Discover how the Psychedelic Stealer malware uses fake Cloudflare CAPTCHA ClickFix lures to infect computers and steal passwords and cryptocurrency.

0
0
0
0
CyberWorldOps @cyberworldops@infosec.exchange
· 1w ago
Compromised Ukrainian business sites are serving a fake Cloudflare CAPTCHA via hidden iframes. Clicking copies an msiexec command that victims are told to run via Windows Run, installing Psychedelic Stealer. Abuse of trusted sites and native binaries makes detection harder. #ClickFix #InfoStealer #Cloudflare #ThreatIntel https://cyberworldops.eu/en/fake-captcha-pushes-psychedelic-stealer-through-compromised-ukrainian
cyberworldops.eu
0
0
0
0
Brad @malware_traffic@infosec.exchange
· 2w ago
2026-09-21 (Monday): IOCs for #SmartApeSG #ClickFix activity pushing #CNCMachineRMS RAT: https://github.com/malware-traffic/indicators/blob/main/2026-09-21-IOCs-for-SmartApeSG-ClickFix-activity.txt When I checked my GitHub project, I saw that I hadn't posted anything to it since February 2026, so now's as good a time as any to put something new into it!
GitHub

indicators/2026-09-21-IOCs-for-SmartApeSG-ClickFix-activity.txt at main · malware-traffic/indicators

Indicators of Compromise (IOCs) from malware or suspicious network traffic - malware-traffic/indicators

3
0
1
0
Hackread.com @Hackread@mstdn.social
· 2w ago
Fake Spotify, Zoom and Teams installers are being used in ClickFix attacks to spread ChainScript, a Node.js RAT that uses Polygon smart contracts to locate its C2 server. Listen/Read: https://hackread.com/clickfix-chainscript-rat-fake-spotify-teams-installers/ #Cybersecurity #Malware #ClickFix #ChainScript #NodeJS #Polygon
ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers
Hackread - Cybersecurity News, Data Breaches, AI and More

ClickFix Attacks Spread ChainScript RAT via Fake Spotify and Teams Installers

Blackpoint Cyber found ChainScript, a Node.js RAT spread through fake Spotify, Zoom and Teams installers that uses Polygon smart contracts to locate its C2 server.

1
0
3
0
Tuxxin @tuxxin@infosec.exchange
· 2w ago
Brevo delivered ClickFix malware to 51 of its own customers Kirk at ADAMnetworks found Brevo serving ClickFix malware from its own infrastructure to 51 customer sites. I took part in the investigation using whack.sh. https://tuxxin.com/blog/brevo-clickfix-customer-sites #security #threatintelligence #whacksh #clickfix
Tuxxin

Brevo delivered ClickFix malware to 51 of its own customers

Brevo delivered ClickFix malware to 51 customer sites in September 2026. Research by ADAMnetworks, with Tuxxin taking part via whack.sh.

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 1mo ago
A new TerminalFix campaign uses fake CAPTCHAs to breach systems. Explore the TerminalFix attack chain and its covert reverse tunnel. #TerminalFix #ClickFix #Malware #Cybersecurity #ThreatIntel https://securityonline.info/terminalfix-campaign-reverse-tunnel/?utm_source=mastodon&utm_medium=jetpack_social
Microsoft Warns of TerminalFix Campaign Deploying Reverse Tunnels
Daily CyberSecurity

Microsoft Warns of TerminalFix Campaign Deploying Reverse Tunnels

A new TerminalFix campaign uses fake CAPTCHAs to breach systems. Explore the TerminalFix attack chain and its covert reverse tunnel.

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2mo ago
JUMPSEC analyzed the BlueNoroff phishing kit's source code. The DPRK ClickFix attack fakes Zoom and Teams calls to profile and drain crypto wallets. #BlueNoroff #ClickFix #Lazarus #CryptoTheft https://securityonline.info/bluenoroff-phishing-kit/?utm_source=mastodon&utm_medium=jetpack_social
BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine
Daily CyberSecurity

BlueNoroff Phishing Kit Turns Fake Zoom and Teams Calls Into a Crypto Wallet Theft Machine

JUMPSEC analyzed the BlueNoroff phishing kit's source code. The DPRK ClickFix attack fakes Zoom and Teams calls to profile and drain crypto wallets.

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2mo ago
The new TAG-150 attack chain uses ClickFix to deploy DenoRAT malware and NightshadeC2. Learn how this threat targets financial sectors and crypto wallets. #TAG150 #DenoRAT #CyberSecurity #Malware #InfoSec #ClickFix https://securityonline.info/tag-150-attack-chain-denorat/?utm_source=mastodon&utm_medium=jetpack_social
TAG-150 Attack Chain Deploys DenoRAT Malware
Daily CyberSecurity

TAG-150 Attack Chain Deploys DenoRAT Malware

The new TAG-150 attack chain uses ClickFix to deploy DenoRAT malware and NightshadeC2. Learn how this threat targets financial sectors and crypto wallets.

0
0
0
0
ESET Research @ESETresearch@infosec.exchange
· 2mo ago
ESET detections of #ClickFix doubled (+108%) between H2 2025 and H1 2026 as attackers expanded beyond fake CAPTCHAs to AI platforms (#AI-fix), browser extensions (#CrashFix), and cloud authentication workflows (#ConsentFix). In AI-fix attacks, attackers craft web pages that impersonate legitimate AI services, including #Anthropic Artifacts, #OpenAI Canvas, and Microsoft #Copilot Pages. The web pages display fake troubleshooting content designed to trick users into executing malicious commands. Another ClickFix evolution, CrashFix, operates in the browser environment through a fake ad blocker, causing fake browser crashes and displaying warnings of data loss to pressure victims into following malicious "quick fix" instructions. Finally, ConsentFix targets OAuth authorization tokens instead of passwords. Victims are tricked into handing over tokens that can provide access to Microsoft accounts without the need for credential theft. Read more about the evolution of ClickFix threat landscape in the latest #ESETThreatReport: https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h12026.pdf
web-assets.esetstatic.com
2
0
2
0
Cloud 🤖 @cloud@infosec.exchange
· 2mo ago
🤖 UAC-0145 (Sandworm/GRU) uses ClickFix fake CAPTCHAs to trick Ukrainian targets into infecting themselves with data-stealing malware. Victims paste a PowerShell script from a fake verification page. Technical breakdown by CERT-UA. 🔗 https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html #CyberSec #Malware #Sandworm #ClickFix #APT
thehackernews.com

UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware

0
0
0
0