~Varonis~
AvisLoader uses ClickFix delivery and Tox P2P C2 to evade domain takedowns.
-
IOCs: trycloudflare[.]com, workers[.]dev, 35dd164a7f5d8b42b9870c7009f7425b1c8cb771280c9e6c525e09f3dd13c2cc
-
#AvisLoader #ClickFix #Malware #ThreatIntel

~Recordedfuture~
ClickFix uses trusted logos and fake CAPTCHA pages to trick victims into running commands.
-
IOCs: (None identified)
-
#ClickFix #Phishing #ThreatIntel

Compromised Site -> #ClickFix

Malicious Domain:
ashen-trace-zephyr-draeix[.]life
urlscan.io/search/#ashe...
#malware

Fake CAPTCHA on hacked websites tricks Mac users into pasting Terminal commands that install an infostealer. https://intel.threadlinqs.com/threat/TL-2026-2622 #ThreatIntel #AMOS #Macfinger #ClickFix

This Cyberattack is Going Viral. Can You Spot It?

#ClickFix #cybersecurity

📢 Exvicy : un framework MaaS ClickFix copiant ErrTraffic, découvert sur Exploit.IN

Cet article détaille la découverte et l'analyse technique d'Exvicy, un nouveau framework de distribution de malware de type ClickFix vendu en…

🟡 vérification factuelle moyenne
#ClickFix #ErrTraffic #Cyberveille

026-09-21 (Monday): Some IOCs from today's #KongTuke #ClickFix activity: github.com/malware-traf...

2026-09-21 (Monday): IOCs for #SmartApeSG #ClickFix activity pushing #CNCMachineRMS RAT: github.com/malware-traf...

📣 New Podcast! "Brevo Supply Chain Attack: Malware Injected Into 100,000+ Websites" on @Spreaker #apiattack #breach #brevo #clickfix #cloudflare #cloudsecurity #cyberattack #cybersecurity #cyberthreats #databreach #infosecurity #malware #malwareattack #securitynews #supplychainattack #wordpress

TDR analysts uncovered #Exvicy, an emerging #ClickFix MaaS sold on Exploit.IN since May 2026.

We assess with high confidence that Exvicy is a copycat of #ErrTraffic, reusing its injected JavaScript, ClickFix HTML, and C2 communication logic.

buff.ly/nKNSjMy

Compromised Site -> #ClickFix

Malicious Domain:
gonfuirkgroao[.]life
urlscan.io/search/#gonf...
#malware

Fake Spotify, Zoom and Teams installers are being used in ClickFix attacks to spread ChainScript, a Node.js RAT that uses Polygon smart contracts to locate its C2 server.

Listen/Read: hackread.com/clickfix-cha...

#Cybersecurity #Malware #ClickFix #ChainScript #NodeJS #Polygon

ChainScript RAT uses Polygon-based C2 rotation in ClickFix campaigns exploiting Windows & macOS. #Malware #ChainScript #BlockchainSecurity #ClickFix #Polygon #Cybersecurity https://thedailytechfeed.com/new-chainscript-rat-uses-polygon-smart-contracts-to-evade-detection/

EtherHiding hides its C2 inside a Polygon smart contract - malware that phones the blockchain, not a domain. https://intel.threadlinqs.com/threat/TL-2026-2600 #ThreatIntel #EtherHiding #ClickFix #Polygon

📢 SPOON SPORTS公式サイトで不正アクセスとWebサイト改ざんが発生
偽のセキュリティ確認画面から「Win＋R」「Ctrl＋V」「Enter」を促すClickFix型の誘導が確認され、実際に不正処理が実行された事例も公表されています。
#SPOONSPORTS #不正アクセス #Webサイト改ざん #ClickFix

👉 公式リリース永久保存版（ブログ）
blog.b-son.net/2026/09/sec2...

📢 ChainScript : un RAT Node.js utilisant la blockchain Polygon pour sa découverte C2

Cet article présente l'analyse technique complète d'un RAT Node.js jusqu'alors non documenté, désormais suivi sous le nom ChainScript. La…

🟢 vérification factuelle haute
#ChainScript #ClickFix #Cyberveille

📢 Cyberattaque chez Brevo : injection ClickFix via clé API Cloudflare compromise, 100 000 sites exposés

📰 Source : FrenchBreaches — publié le 18 septembre 2026. L'article rapporte deux incidents de sécurité distincts ayant…

🟡 vérification factuelle moyenne
#ClickFix #CloudflareWorker #Cyberveille

📰 Serangan Supply Chain Brevo Suntikkan Skrip ClickFix ke Situs Pelanggan

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/20/serangan-supply-chain-brevo-clickfix/

#brevo #clickfix #cybersecurity #keamananSiber #malware #supplyChainAttack #vulnerability #wordpress

Compromised Site -> #ClickFix

Malicious Domain:
mesa-braior-k3w3b[.]life
urlscan.io/search/#mesa...
#malware