TF-1931079
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload misty-whirl-beacon-doa.life
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-23 22:03:28 UTC. Reporter: varysz. Tags: ClickFix, Mac, MacFinger.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
misty-whirl-beacon-doa.life
UrlVoid 3 / 36
IOC database
- Type
- domain
- Value
misty-whirl-beacon-doa.life- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-23 22:03:28 UTC. Reporter: varysz. Tags: ClickFix, Mac, MacFinger.
Remediations (10)
-
web:blog.sicuranext.com
This beacon feeds the Traffic Direction System controlled by the attacker, which uses the collected data to decide whether the visitor should receive the malicious payload : it checks user-agent, virtualized environments and blocks debuggers or advanced inspection tools. The second block is the ErrTraffic framework payload .
-
web:cybersecuritynews.com
In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed "ClickFix." Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices. The attack leverages compromised or low-cost hosting infrastructure, including a ...
-
web:hunt.io
Rather than relying on malware execution, this variant leverages ClickFix tactics to guide users into submitting credentials-an arguably more discreet approach. As awareness of clipboard-based delivery increases, phishing adaptations like this may offer a lower-friction path for threat actors targeting enterprise platforms.
-
web:thehackernews.com
Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.
-
web:thehackernews.com
Researcher analyzed 3,000 ClickFix payloads and found rotating wrappers plus a Downloads-folder method built to bypass AMSI.
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.hhs.gov
Overview of ClickFix Attacks Threat actors initiate these campaigns by logging into websites with stolen credentials and installing fake plugins in compromised environments. Once installed, the plugins inject malicious JavaScript containing a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads ( a practice known as EtherHiding ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
-
web:www.opswat.com
ClickFix bypasses EDR by making the user the execution layer. Learn how it works and how MetaDefender Aether detects ClickFix payloads pre-execution.
-
web:www.stormshield.com
Preamble In a previous article, we introduced the ClickFix technique. A full attack chain leveraging this technique was detected in mid-March 2026. It was publicly disclosed on X (formerly Twitter) by a MalwareBazaar member, known to regularly share malware samples. Despite attackers changed the initially used domains , we provide in this post an in-depth analysis of this ClickFix campaign.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.