Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads

By Assaf Morag, Cybersecurity Researcher A fake version of a gaming marketplace that quietly disables Windows Defender using a tool that impersonates Google. A kitchen supplier lookalike domain that exploits the Stripe payment API into a covert spy channel, hiding in plain sight behind legitimate, encrypted traffic. A Czech-targeted site using a Microsoft typosquat. These […] The post Hunting ClickFix Attacks: Deep D…

Malware & Threats Phishing Ransomware Threat Intelligence Networking & Internet Operating Systems Hardware & Chips Cryptography Open Source Incident Response & Forensics
Read the full article at Flare Removal request

This page shows only the headline and the short summary. The full text is published by the original source.

Related news

Full archive →
NCSC Netherlands

NCSC-2026-0492 [1.00] [M/H] Kwetsbaarheden verholpen in Node.js

Node.js heeft meerdere kwetsbaarheden verholpen in versies 22.x, 24.x en 26.x, waaronder in de HTTP/2-implementatie, HTTPS-servermodule, TLS-handling en proxy error handling. Verschillende kwetsbaarheden in Node.js kunnen leiden tot informatielekken, geheugenfouten en serveruitval. Vooral omgevingen met HTTP/2, HTTPS en TLS worden geraakt. - Proxy-authenticatie: uitlekken van inloggegevens via foutmeldingen. - HTTP/2…

NCSC Netherlands

NCSC-2026-0491 [1.00] [M/H] Meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console.

Citrix heeft meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console. Citrix heeft meerdere kwetsbaarheden verholpen in Citrix Secure Access Client for Windows, NetScaler ADC, NetScaler Gateway en NetScaler Console. De kwetsbaarheden hebben CVSS v4.0-scores variërend van 6.9 tot 9.5 en omvatten onder andere geheugenbeschadiging (Memory Corruption), authe…

Flare

ClickFix in the Wild: New RATs, Stripe-Based C2, and a Signed Google Tool Turned Against Defender

By Assaf Morag, Cybersecurity Researcher A friend messaged me one word: “Help!” He had been infected with malware after following what looked like a routine Cloudflare verification prompt. While helping him respond, I had to fully analyze the website and gather strong lure detection markers. That turned into a larger project: a script that finds […] The post ClickFix in the Wild: New RATs, Stripe-Based C2, and a Sign…