#clickfix articles

NONetomize Official Blogblog.netomize.ca4d ago · 3 min read

Clustering macOS ClickFix Campaign Webpages Using the HTTP-Basma Fingerprinting Algorithm

Introduction On August 5, 2026, the Microsoft Security Research Team (MSRT) blogged about a new macOS ClickFix campaign titled From open lures to cloaked gates: How a macOS ClickFix campaign learned t

0

VNVũ Nhật Lâmblog.fiscybersec.comJul 28 · 21 min read

UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant

Campaign Summary A Russian-speaking criminal group tracked by Cisco Talos as UAT-11795 has been running a continuous campaign since at least June 2025, distributing malware inside trojanized installer

0

VNVũ Nhật Lâmblog.fiscybersec.comJul 14 · 7 min read

Mistic Backdoor: KongTuke's New Weapon in the ClickFix – ModeloRAT – Ransomware Ecosystem

Executive Summary A new backdoor named Backdoor.Mistic (also tracked by Zscaler as MLTBackdoor) has surfaced in intrusions since April 2026, hitting organizations across insurance, education, IT, and

0

VNVũ Nhật Lâmblog.fiscybersec.comJul 7 · 10 min read

ClickFix Grows Into an Ecosystem: A New Wave of Loaders (BabaDeda, Lorem Ipsum, Potemkin) and the Convergence With EtherHiding

Summary In mid-2026, three independent reports from Morphisec, BlueVoyant, and Huntress converged on the same point: ClickFix has stopped being a one-off social engineering trick and become the delive

0

RRelayShieldAdminrelayshield.hashnode.devJun 24 · 4 min read

Your Mac Told You to Run a Command. You Did. Now Your Passwords Are Gone.

The macOS ClickFix attack nobody warned you about and what to do if you've been hit. A new attack targeting Mac users is spreading fast, and it works by doing something almost no one expects: it asks

0

VNVũ Nhật Lâmblog.fiscybersec.comJun 8 · 9 min read

MSHTA: The Retired Windows Tool Still Running Malware

Executive Summary A Windows utility most people assume died with Internet Explorer is quietly powering live malware campaigns. Bitdefender reports that since the start of 2026, detections of mshta.exe

0

RKrakib khanilove.hashnode.devApr 17 · 2 min read

North Korea Deploys ClickFix Malware to Harvest macOS Credentials

When a “Critical” Zoom Patch Becomes a Credential Harvester A newly identified macOS malware family dubbed ClickFix has been linked to a North Korean state‑sponsored hacking unit. The campaign blends fabricated high‑salary job postings with counterfe...

0

LTLưu Tuấn Anhblog.fiscybersec.comApr 4 · 8 min read

You are the "security vulnerability": ClickFix is causing users to install malware themselves.

Overview Amid increasingly sophisticated cyberattacks, a worrying trend is emerging: attackers no longer need to exploit system vulnerabilities—they exploit the users themselves. The ClickFix campaign

0

LTLưu Tuấn Anhblog.fiscybersec.comMar 1 · 9 min read

CAPTCHA Giả Đang Đánh Lừa Hàng Nghìn Người Dùng: Sự Thật Đằng Sau ClickFix

ClickFix về DNS đánh lừa người dùng chưa kịp lắng xuống thì một chiến dịch mới lại tiếp tục nổi lên trong tháng 02 năm 2026 vừa qua. Chiến dịch này cũng dựa hoàn toàn vào yếu tố con người để khai thác

0

DDeepSeaXdeepseax.hashnode.devMar 1 · 4 min read

QuickLens Chrome Extension Compromised to Steal Crypto via ClickFix Attacks

What Happened A popular Chrome extension called QuickLens — Search Screen with Google Lens has been removed from the Chrome Web Store after being compromised to push malware via ClickFix social engineering attacks and steal cryptocurrency from thousa...

0

#clickfix

#clickfix

Explore Hashnode

Trending tags this week

Clustering macOS ClickFix Campaign Webpages Using the HTTP-Basma Fingerprinting Algorithm

UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant

Mistic Backdoor: KongTuke's New Weapon in the ClickFix – ModeloRAT – Ransomware Ecosystem

ClickFix Grows Into an Ecosystem: A New Wave of Loaders (BabaDeda, Lorem Ipsum, Potemkin) and the Convergence With EtherHiding

Your Mac Told You to Run a Command. You Did. Now Your Passwords Are Gone.

MSHTA: The Retired Windows Tool Still Running Malware

North Korea Deploys ClickFix Malware to Harvest macOS Credentials

You are the "security vulnerability": ClickFix is causing users to install malware themselves.

CAPTCHA Giả Đang Đánh Lừa Hàng Nghìn Người Dùng: Sự Thật Đằng Sau ClickFix

QuickLens Chrome Extension Compromised to Steal Crypto via ClickFix Attacks

#clickfix

Search Hashnode

#clickfix

Explore Hashnode

Trending tags this week

Clustering macOS ClickFix Campaign Webpages Using the HTTP-Basma Fingerprinting Algorithm

UAT-11795: Trojanized WebEx, Zoom and MobaXterm Installers Deliver Starland RAT and the WLDR Implant

Mistic Backdoor: KongTuke's New Weapon in the ClickFix – ModeloRAT – Ransomware Ecosystem

ClickFix Grows Into an Ecosystem: A New Wave of Loaders (BabaDeda, Lorem Ipsum, Potemkin) and the Convergence With EtherHiding

Your Mac Told You to Run a Command. You Did. Now Your Passwords Are Gone.

MSHTA: The Retired Windows Tool Still Running Malware

North Korea Deploys ClickFix Malware to Harvest macOS Credentials

You are the "security vulnerability": ClickFix is causing users to install malware themselves.

CAPTCHA Giả Đang Đánh Lừa Hàng Nghìn Người Dùng: Sự Thật Đằng Sau ClickFix

QuickLens Chrome Extension Compromised to Steal Crypto via ClickFix Attacks