TF-1932721
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload winter-finch-slaibteis.life
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-25 08:10:00 UTC. Reporter: varysz. Tags: ClickFix, Mac, MacFinger.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
winter-finch-slaibteis.life
VT 4 / 91
UrlVoid 2 / 36
IOC database
- Type
- domain
- Value
winter-finch-slaibteis.life- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Ingested from IOC source: https://threatfox.abuse.ch/downloads/hostfile/
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 4 of 91 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| LevelBlue | malicious | phishing |
| SOCRadar | malicious | malware |
| alphaMountain.ai | suspicious | spam |
| Fortinet | suspicious | spam |
Details From VirusTotal
Basic Properties
| TLD | life |
History
| Last analysis | 2026-09-25 18:02 UTC |
| Last modified on VirusTotal | 2026-09-26 01:39 UTC |
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-25 08:10:00 UTC. Reporter: varysz. Tags: ClickFix, Mac, MacFinger.
Remediations (10)
-
web:any.run
Learn how ClickFix malware hijacks the clipboard and exploits user trust to silently install infostealers, ransomware, and remote access trojans without triggering traditional security controls, and how businesses can defend against it with real-time threat intelligence.
-
web:cybersecuritynews.com
In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed "ClickFix." Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices. The attack leverages compromised or low-cost hosting infrastructure, including a ...
-
web:hunt.io
In this post, we outlined how ClickFix is being used across a range of web-based delivery mechanisms-from clipboard-injected malware to credential harvesting and fileless payload staging.
-
web:thehackernews.com
ClickFix accounted for 47% of Microsoft Defender Experts initial-access cases in 2025, while a Polygon contract rotated lure hosts.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are usually associated with certain tags. Every IOC can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of IOCs in the ThreatFox corpus. The page below gives you an overview on IOCs that are tagged with ClickFix. You can also get this data through the ThreatFox API. Database Entry
-
web:wizardcyber.com
In just two years, ClickFix has evolved from a simple social-engineering trick into one of the most industrialized attack vectors in the world. What began as fake verification prompts instructing users to paste clipboard-poisoned commands into the Windows Run dialog has now expanded into a wider ecosystem of variants, builder platforms, browser-based lures, DNS-staged payloads , and token theft ...
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
-
web:www.sophos.com
Counter Threat Unit™ (CTU) researchers investigated a June 2026 campaign in which threat actors used the Deno JavaScript runtime as a core execution mechanism within a ClickFix-driven intrusion chain. On June 3 and June 4, compromised WordPress sites served Cloudflare-themed ClickFix lures that prompted users to execute a clipboard-delivered PowerShell command. This command initiated an MSI ...
-
web:www.stormshield.com
Preamble In a previous article, we introduced the ClickFix technique. A full attack chain leveraging this technique was detected in mid-March 2026. It was publicly disclosed on X (formerly Twitter) by a MalwareBazaar member, known to regularly share malware samples. Despite attackers changed the initially used domains , we provide in this post an in-depth analysis of this ClickFix campaign.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.