ClickFix in the Wild: New RATs, Stripe-Based C2, and a Signed Google Tool Turned Against Defender

NCSC-2026-0491 [1.00] [M/H] Meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console.

Citrix heeft meerdere kwetsbaarheden verholpen in Citrix Secure Access Client, NetScaler ADC, NetScaler Gateway en NetScaler Console. Citrix heeft meerdere kwetsbaarheden verholpen in Citrix Secure Access Client for Windows, NetScaler ADC, NetScaler Gateway en NetScaler Console. De kwetsbaarheden hebben CVSS v4.0-scores variërend van 6.9 tot 9.5 en omvatten onder andere geheugenbeschadiging (Memory Corruption), authe…

Hunting ClickFix Attacks: Deep Dive into One Trick Across Four Different Payloads

By Assaf Morag, Cybersecurity Researcher A fake version of a gaming marketplace that quietly disables Windows Defender using a tool that impersonates Google. A kitchen supplier lookalike domain that exploits the Stripe payment API into a covert spy channel, hiding in plain sight behind legitimate, encrypted traffic. A Czech-targeted site using a Microsoft typosquat. These […] The post Hunting ClickFix Attacks: Deep D…

Hackers abuse SQL Server’s weak passwords to drop cryptominers and Gh0st RAT

An active threat campaign is combining port scanning, password guessing, and Transact-SQL (T-SQL) commands to compromise exposed Microsoft SQL servers and deliver malware. The attackers are using predefined username and password lists to brute-force into these servers and exploit their administrative capabilities to execute commands on the underlying Windows systems. The activity highlights the persistent challenge o…

Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT