TF-1863161 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-07-29 08:57:56 UTC. Reporter: varysz. Tags: ClickFix, Mac, WordPress.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-07-29 08:57:56 UTC. Reporter: varysz. Tags: ClickFix, Mac, WordPress.

• ClickFix Malicious Campaign Uses Fake Travel Sites to Deliver Malicious ...
  web:advisory.eventussecurity.com

  A threat campaign, dubbed ClickFix, has been observed leveraging social engineering tactics and obfuscated JavaScript payloads to infiltrate targeted environments. The campaign exploits the appearance of legitimate websites and tools to deceive users into executing malicious scripts. It monitors endpoint activity and DNS traffic have identified consistent patterns and behaviors associated with ...

  2026-07-31 01:14 UTC
• ClickFix Malware Analysis, Overview by ANY.RUN
  web:any.run

  Learn how ClickFix malware hijacks the clipboard and exploits user trust to silently install infostealers, ransomware, and remote access trojans without triggering traditional security controls, and how businesses can defend against it with real-time threat intelligence.

  2026-07-31 01:14 UTC
• Hackers Registered 13,000+ Unique Domains and Leverages Cloudflare to ...
  web:cybersecuritynews.com

  In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed "ClickFix." Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices. The attack leverages compromised or low-cost hosting infrastructure, including a ...

  2026-07-31 01:14 UTC
• Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for ...
  web:thehackernews.com

  Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.

  2026-07-31 01:14 UTC
• Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven ...
  web:thehackernews.com

  Researcher analyzed 3,000 ClickFix payloads and found rotating wrappers plus a Downloads-folder method built to bypass AMSI.

  2026-07-31 01:14 UTC
• A Wretch Client: From ClickFix deception to information stealer ...
  web:www.elastic.co

  A Wretch Client: From ClickFix deception to information stealer deployment Elastic Security Labs detected a surge in ClickFix campaigns, using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware .

  2026-07-31 01:14 UTC
• Think before you Click(Fix): Analyzing the ClickFix social engineering ...
  web:www.microsoft.com

  The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  2026-07-31 01:14 UTC
• ClickFix Campaign Exploits Compromised Websites to Deliver MIMICRAT ...
  web:www.rescana.com

  The ClickFix campaign represents a significant escalation in the abuse of compromised legitimate websites to deliver advanced malware , culminating in the deployment of the custom MIMICRAT Remote Access Trojan. First identified by Elastic Security Labs and corroborated by multiple open-source intelligence channels, this campaign leverages a multi-stage infection chain, sophisticated defense ...

  2026-07-31 01:14 UTC
• Analyzing a Full ClickFix Attack Chain - Part 1
  web:www.stormshield.com

  Preamble In a previous article, we introduced the ClickFix technique. A full attack chain leveraging this technique was detected in mid-March 2026. It was publicly disclosed on X (formerly Twitter) by a MalwareBazaar member, known to regularly share malware samples. Despite attackers changed the initially used domains , we provide in this post an in-depth analysis of this ClickFix campaign.

  2026-07-31 01:14 UTC
• AI Generated ClickFix Attack Delivers SmartRAT | ThreatLabz
  web:www.zscaler.com

  Key Takeaways In March 2026, ThreatLabz observed threat actors using a webpage likely generated with AI to impersonate a Brazilian bank and a ClickFix lure (fake CAPTCHA followed by a fullscreen fake BSOD/system recovery prompt) to pressure victims into running a PowerShell command that downloads and executes a RAT that ThreatLabz dubbed SmartRAT. SmartRAT is a PowerShell-based banking RAT ...

  2026-07-31 01:14 UTC

Only Available for Registered Users. Sign in to view.

Reputation of linked indicators

DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.