Loading story…
Multiple threat reports describe ClickFix-style social engineering and related Windows loader chains that trick users into launching malicious PowerShell or staged binaries, culminating in memory-resident malware. In one campaign, a fake CAPTCHA coerces victims into running PowerShell that fetches a first-stage script, injects a .NET loader into powershell.exe, and launches a Donut 0.9.3 shellcode package entirely in memory to deploy an infostealer targeting Firefox data, Chromium cookies, and screenshots. Separate reporting also tied ClickFix activity to HijackLoader-based stealer delivery and to a campaign abusing signed Mozilla Firefox binaries for DLL sideloading of KongTuke, with Rust-based DLL variants handling loading, persistence, and command-and-control.
Another analyzed infection chain used a heavily obfuscated batch-script loader that rebuilt embedded payloads, renamed PowerShell to HDVz.exe, staged files under C:\ProgramData\IntelDriver, and created a scheduled task for logon persistence before injecting Donut shellcode into explorer.exe. That malware tampered with AMSI and ETW, used a custom memory marker DE AD BE CA FE BA EF to avoid duplicate injection, and sent execution notifications through the Telegram Bot API while attempting outbound communication to 167.88.167.9:8356. Across the reporting, the common pattern is the use of trusted binaries, in-memory execution, shellcode loaders, and evasive tradecraft to steal data or maintain access while minimizing disk artifacts and frustrating endpoint detection.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Gurucul reported that recent weeks had seen increased ClickFix social-engineering activity delivering KongTuke through DLL sideloading with legitimate Mozilla Firefox binaries. The report identified Rust-based DLL variants for loading, persistence, and command-and-control, along with DGA-based HTTPS infrastructure.
Aryaka Threat Research Lab analyzed a Windows malware campaign using an obfuscated batch-script loader that reconstructs payloads, renames PowerShell to HDVz.exe, persists via a scheduled task, and injects Donut shellcode into explorer.exe. The report also highlighted AMSI and ETW tampering, Telegram execution notifications, and outbound TCP communication to 167.88.167.9:8356.
Neso published the second part of its analysis of a live stealer campaign involving ClickFix and HijackLoader. No further dated event details are provided in the reference content.
Neso published the first part of its analysis of a live stealer campaign involving ClickFix and HijackLoader. No further dated event details are provided in the reference content.
JMP-ESP analyzed a new multi-stage ClickFix campaign that used mshta, VBScript, PowerShell, and repeated Donut-loader stages to deploy malware classified by VirusTotal as a Lumma variant. The chain ultimately injected into dllhost.exe and deployed ChromElevator to steal Chromium browser data, with AMSI, WLDP, and ETW patching plus Telegram Bot API exfiltration.
Swiss Post Cybersecurity reported a multi-stage ClickFix campaign in which a fake CAPTCHA tricked victims into running PowerShell, leading to an in-memory Donut-based loader and a bespoke infostealer. The report documented browser-data theft, screenshot capture, and exfiltration to 31.177.108.17:12345.
K7 Labs documented a malware delivery campaign in which FakeCaptcha/ClickFix pages, increasingly reached through malvertising, tricked users into running a copied PowerShell command that launched a multi-stage mshta, JavaScript, and PowerShell chain. The analysis said the chain commonly delivered Emmenhtal and in most observed cases ended with Lumma Stealer loaded in memory as a .NET assembly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcearyaka.com
Open sourcejmp-esp.org
Open sourceswisspost-cybersecurity.ch
Open sourcelabs.k7computing.com
Open sourcereversethemalware.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
A ClickFix-style social engineering chain tricked a Windows user into running a PowerShell one-liner from the Run dialog, launching a multi-stage malware infection that deployed two Python-based payloads. The first stage downloaded a fake **Intel Software Updater** Inno Setup package, unpacked a bundled **CPython 3.11** runtime, and launched a Python RAT that established persistence, profiled the host, and resolved follow-on command-and-control through the Ethereum blockchain using **EtherHiding**. A second PowerShell stage was then delivered over STDIN, downloading another Python runtime and payload into `ProgramData`, where `mod.pyc` decrypted its next stage with an inline **RC4** routine before moving toward process injection into `winver.exe` and a UAC elevation attempt involving **AppInfo** and `consent.exe`. The activity aligns with a broader malware-delivery ecosystem previously linked to **UNC5142**, which used EtherHiding-backed infrastructure and rapidly changing hosting on **Cloudflare Pages** (`pages.dev`), **Backblaze B2**, and domains such as `bluetroniq.vip` and `bytevista.cloud`. Observed lures frequently impersonated verification and security workflows, including fake **reCAPTCHA**, human verification, DNS resolver, IP provider, and macOS browser update pages, with staging paths such as `/support`, `/win`, and `/start` indicating payload delivery and redirection infrastructure designed to support social engineering and malware distribution at scale.
Jul 21, 2026
Security researchers reported that **ClickFix** has expanded into an industrialized malware-delivery ecosystem that relies on social engineering rather than software exploits. Attackers use fake CAPTCHA checks, browser updates, meeting errors, and verification prompts to trick users into manually running attacker-supplied commands through trusted tools such as PowerShell, `mshta`, `curl`, Windows Run, or macOS Terminal. ReversingLabs said the ecosystem now supports a wide range of payloads, including **Lumma Stealer**, **DarkGate**, **XWorm**, **AsyncRAT**, **NetSupport**, and **SectopRAT**, while related variants such as **CrashFix**, **FileFix**, **PromptFix**, and **ConsentFix** continue to emerge. The activity is being amplified through large-scale web compromise campaigns. Reports linked the **DriveSurge** actor to active **ClickFix** and **FakeUpdates** operations abusing thousands of compromised websites to distribute malware, while a separate SlowMist investigation documented a Google Sites-hosted phishing campaign targeting Web3 users on macOS with a fake community application flow that pushed victims to download a `.scpt` file or run a Base64-encoded Terminal command. That infection chain delivered a Mach-O stealer resembling **AMOS (Atomic macOS Stealer)**, which harvested browser credentials, cookies, Keychain data, Apple Notes, Telegram Desktop data, and cryptocurrency wallet files before archiving data to `/tmp/lksopo.zip` and exfiltrating it to `86.54.25.213`. Researchers said structural **YARA** detection of lure pages is currently one of the most effective ways to identify these campaigns, which often evade traditional AV and EDR controls because they depend on legitimate tools and user-approved execution.
Jul 18, 2026