TF-1931071
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload checkmrobot.site
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 90. First seen: 2026-09-23 21:00:01 UTC. Reporter: sveinn. Tags: ClickFix, etherhiding.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
checkmrobot.site
UrlVoid 0 / 36
IOC database
- Type
- domain
- Value
checkmrobot.site- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 90. First seen: 2026-09-23 21:00:01 UTC. Reporter: sveinn. Tags: ClickFix, etherhiding.
Remediations (10)
-
web:any.run
Learn how ClickFix malware hijacks the clipboard and exploits user trust to silently install infostealers, ransomware, and remote access trojans without triggering traditional security controls, and how businesses can defend against it with real-time threat intelligence.
-
web:cybersecuritynews.com
In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed "ClickFix." Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices. The attack leverages compromised or low-cost hosting infrastructure, including a ...
-
web:ismalicious.com
5,607 indicators of compromise attributed to the IClickFix malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.
-
web:protectyourwp.com
The IClickFix framework serves as a widespread and persistent initial access vector, leveraging the ClickFix social engineering tactic for malware distribution.
-
web:thehackernews.com
Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are usually associated with certain tags. Every IOC can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of IOCs in the ThreatFox corpus. The page below gives you an overview on IOCs that are tagged with ClickFix. You can also get this data through the ThreatFox API. Database Entry
-
web:www.csoonline.com
The WordPress ClickFix campaign delivers three separate infostealer payloads — two of them previously unknown — and uses domain infrastructure that appears to have been set up since July 2025.
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
-
web:www.microsoft.com
Threat actors are targeting macOS users with fake utility fixes that trick them into running malicious Terminal commands. This campaign evades traditional defenses by stealing credentials, wallets, and sensitive data.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.