Operation Endgame malware takedown turns up over 6 million stolen logins

ClickFix in the Wild: New RATs, Stripe-Based C2, and a Signed Google Tool Turned Against Defender

By Assaf Morag, Cybersecurity Researcher A friend messaged me one word: “Help!” He had been infected with malware after following what looked like a routine Cloudflare verification prompt. While helping him respond, I had to fully analyze the website and gather strong lure detection markers. That turned into a larger project: a script that finds […] The post ClickFix in the Wild: New RATs, Stripe-Based C2, and a Sign…

Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads

By Assaf Morag, Cybersecurity Researcher A fake version of a gaming marketplace that quietly disables Windows Defender using a tool that impersonates Google. A kitchen supplier lookalike domain that exploits the Stripe payment API into a covert spy channel, hiding in plain sight behind legitimate, encrypted traffic. A Czech-targeted site using a Microsoft typosquat. These […] The post Hunting ClickFix Attacks: Deep D…

Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems. The activity highlights the persistent challenge o…

Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT