TF-1932680 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-25 05:14:10 UTC. Reporter: threatcat_ch. Tags: ClickFix.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-25 05:14:10 UTC. Reporter: threatcat_ch. Tags: ClickFix.

• One Paste to Rule Them All: Inside a ClickFix → EtherHiding → GULoader ...
  web:blog.sicuranext.com

  EtherHiding: blockchain-based payload delivery Two seconds after the page loaded, the injected JavaScript initiated outbound queries to the BNB Smart Chain (BSC) Testnet. The BSC Testnet (Chain ID 97) is a free-to-use Ethereum Virtual Machine-compatible blockchain.

  2026-09-25 15:08 UTC
• IClickFix malware — IOCs & CVEs | isMalicious
  web:ismalicious.com

  7,609 indicators of compromise attributed to the IClickFix malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  2026-09-25 15:08 UTC
• Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for ...
  web:thehackernews.com

  Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.

  2026-09-25 15:08 UTC
• 17,000 URLs Reveal How ClickFix Turns Trusted Websites Into Malware ...
  web:thehackernews.com

  ClickFix accounted for 47% of Microsoft Defender Experts initial-access cases in 2025, while a Polygon contract rotated lure hosts.

  2026-09-25 15:08 UTC
• ClickFix Attacks: When Victims Install the Malware | Doppel
  web:www.doppel.com

  ClickFix scams turn fake CAPTCHAs and browser errors into malware delivery. Learn how the attack works, what to watch for, and how to respond.

  2026-09-25 15:08 UTC
• ClickFix Attack: How ClickFix Malware Scam Works | Group-IB
  web:www.group-ib.com

  Learn how the ClickFix attack works, how ClickFix malware spreads through social engineering, common scam techniques, and how to protect your organization.

  2026-09-25 15:08 UTC
• Criminals turn placeholder domain into ClickFix trap
  web:www.malwarebytes.com

  At the time of writing the domain hosting the script is not resolving. ClickFix is a social-engineering technique that turns the victim into the malware installer.

  2026-09-25 15:08 UTC
• Think before you Click(Fix): Analyzing the ClickFix social engineering ...
  web:www.microsoft.com

  The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  2026-09-25 15:08 UTC
• ClickFix Malware & Social Engineering Threat Grows | Proofpoint US
  web:www.proofpoint.com

  Learn how the threat of ClickFix malware is spreading through social engineering. Find out how to protect yourself from these attacks with Proofpoint.

  2026-09-25 15:08 UTC
• ClickFix HijackLoader Phishing Campaign Analysis | Seqrite
  web:www.seqrite.com

  Introduction With the evolution of cyber threats, the final execution of a malicious payload is no longer the sole focus of the cybersecurity industry. Attack loaders have emerged as a critical element of modern attacks, serving as a primary vector for initial access and enabling the covert delivery of sophisticated malware within an organization.

  2026-09-25 15:08 UTC

Only Available for Registered Users. Sign in to view.