026-09-21 (Monday): Some IOCs from today's #KongTuke #ClickFix activity: github.com/malware-traf...
@malware-traffic-analysis.net
@malware-traffic-analysis.net026-09-21 (Monday): Some IOCs from today's #KongTuke #ClickFix activity: github.com/malware-traf...
@malware-traffic-analysis.net2026-09-21 (Monday): IOCs for #SmartApeSG #ClickFix activity pushing #CNCMachineRMS RAT: github.com/malware-traf...
@radiohack.bsky.social📣 New Podcast! "Brevo Supply Chain Attack: Malware Injected Into 100,000+ Websites" on @Spreaker #apiattack #breach #brevo #clickfix #cloudflare #cloudsecurity #cyberattack #cybersecurity #cyberthreats #databreach #infosecurity #malware #malwareattack #securitynews #supplychainattack #wordpress
@sekoia.comTDR analysts uncovered #Exvicy, an emerging #ClickFix MaaS sold on Exploit.IN since May 2026.
We assess with high confidence that Exvicy is a copycat of #ErrTraffic, reusing its injected JavaScript, ClickFix HTML, and C2 communication logic.
@masaomi346.bsky.socialCompromised Site -> #ClickFix
Malicious Domain:
gonfuirkgroao[.]life
urlscan.io/search/#gonf...
#malware
@hackread.bsky.socialFake Spotify, Zoom and Teams installers are being used in ClickFix attacks to spread ChainScript, a Node.js RAT that uses Polygon smart contracts to locate its C2 server.
Listen/Read: hackread.com/clickfix-cha...
#Cybersecurity #Malware #ClickFix #ChainScript #NodeJS #Polygon
@thedailytechfeed.comChainScript RAT uses Polygon-based C2 rotation in ClickFix campaigns exploiting Windows & macOS. #Malware #ChainScript #BlockchainSecurity #ClickFix #Polygon #Cybersecurity https://thedailytechfeed.com/new-chainscript-rat-uses-polygon-smart-contracts-to-evade-detection/
@threadlinqs.bsky.socialEtherHiding hides its C2 inside a Polygon smart contract - malware that phones the blockchain, not a domain. https://intel.threadlinqs.com/threat/TL-2026-2600 #ThreatIntel #EtherHiding #ClickFix #Polygon
@ibipolice.bsky.social📢 SPOON SPORTS公式サイトで不正アクセスとWebサイト改ざんが発生
偽のセキュリティ確認画面から「Win＋R」「Ctrl＋V」「Enter」を促すClickFix型の誘導が確認され、実際に不正処理が実行された事例も公表されています。
#SPOONSPORTS #不正アクセス #Webサイト改ざん #ClickFix
👉 公式リリース永久保存版（ブログ）
blog.b-son.net/2026/09/sec2...
@cyberveille-ch.bsky.social📢 ChainScript : un RAT Node.js utilisant la blockchain Polygon pour sa découverte C2
Cet article présente l'analyse technique complète d'un RAT Node.js jusqu'alors non documenté, désormais suivi sous le nom ChainScript. La…
🟢 vérification factuelle haute
#ChainScript #ClickFix #Cyberveille
@cyberveille-ch.bsky.social📢 Cyberattaque chez Brevo : injection ClickFix via clé API Cloudflare compromise, 100 000 sites exposés
📰 Source : FrenchBreaches — publié le 18 septembre 2026. L'article rapporte deux incidents de sécurité distincts ayant…
🟡 vérification factuelle moyenne
#ClickFix #CloudflareWorker #Cyberveille
@ahmandonk.bsky.social📰 Serangan Supply Chain Brevo Suntikkan Skrip ClickFix ke Situs Pelanggan
👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/20/serangan-supply-chain-brevo-clickfix/
#brevo #clickfix #cybersecurity #keamananSiber #malware #supplyChainAttack #vulnerability #wordpress
@masaomi346.bsky.socialCompromised Site -> #ClickFix
Malicious Domain:
mesa-braior-k3w3b[.]life
urlscan.io/search/#mesa...
#malware
@thenewoil.org@threadlinqs.bsky.socialA stolen API key turned Brevo's CDN into a supply-chain weapon - fake CAPTCHAs, silent WordPress backdoors. https://intel.threadlinqs.com/threat/TL-2026-2573 #ThreatIntel #ClickFix #Web #Brevo
@hendryadrian.bsky.socialBrevo supply chain attack used a compromised Cloudflare API key to inject malicious scripts into customer sites, affecting 100,000+ websites. Earlier SAML SSO abuse exposed 138 accounts and enabled phishing. #Brevo #Cloudflare #ClickFix
@thedailytechfeed.comBrevo’s supply-chain hack hit 100K+ sites with backdoor installs and fake ClickFix prompts today. #Brevo #SupplyChain #WordPress #ClickFix #Malware #Cybersecurity thedailytechfeed.com/brevo-supply...
@cyberveille-ch.bsky.social📢 Attaque supply chain Brevo : backdoors WordPress et ClickFix déployés sur 100 000+ sites
L'analyse est publiée le 16 septembre 2026 par la Sansec Forensics Team sur la base d'investigations forensiques menées après un incident de…
🟢 vérification factuelle haute
#ClickFix #brevo #Cyberveille
@infosecbot.bsky.socialsoundcloudapp[.]com
#clickfix
— from @ex_raritas (https://x.com/ex_raritas/status/2100689750462005752)
@hendryadrian.bsky.socialBrevo said attackers stole a Cloudflare API key, used a malicious Worker to inject ClickFix scripts on Brevo and customer sites for hours, and pushed a fake WordPress plugin. Core app and email systems were unaffected. #Brevo #Cloudflare #ClickFix