s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1916584 high

📛 Threat Title

IClickFix: Domain name that delivers a malware payload www.mirandaschool.org

Category: IClickFix Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-13 12:10:19 UTC. Reporter: varysz. Tags: ClickFix, Mac.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain www.mirandaschool.org VT 3 / 89 UrlVoid 2 / 36

IOC database

Type
domain
Value
www.mirandaschool.org
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
Domain name that delivers a malware payload attributed to IClickFix

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 3 of 89 VirusTotal vendors

VendorVerdictDetection
Certego suspicious suspicious
Gridinsoft suspicious suspicious
SOCRadar suspicious suspicious

Details From VirusTotal

Basic Properties
RegistrarPDR Ltd. d/b/a PublicDomainRegistry.com
TLDorg
History
Creation date2015-03-24 08:53 UTC
Last analysis2026-09-13 12:34 UTC
Last modified on VirusTotal2026-09-14 00:11 UTC
Last WHOIS update2026-08-12 08:34 UTC

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-09-13 12:10:19 UTC. Reporter: varysz. Tags: ClickFix, Mac.

Remediations (10)

  • ClickFix Malware Analysis, Overview by ANY.RUN
    web:any.run

    ClickFix is a social engineering technique used to deliver malware by tricking users into performing actions that appear to "fix" a technical problem. It emerged prominently around late 2023-early 2024 and surged in popularity throughout 2025.

  • ClickFix Campaign Delivers Modular TELEPUZ Malware With 36 Remote Commands
    web:cybersecuritynews.com

    A new malware operation is using ClickFix pages to trick Windows users into running malicious commands themselves. The campaign delivers TELEPUZ, a lightweight but capable remote-access malware that can receive dozens of instructions from its operators.

  • iClicker Website Compromised in ClickFix Malware Attack Targeting ...
    web:dailysecurityreview.com

    The official iClicker website was compromised in mid-April 2025 by a ClickFix attack that leveraged a deceptive CAPTCHA prompt to infect users with malware . The breach specifically impacted users between April 12 and April 16 and targeted college students and instructors across the U.S.

  • Proactive ClickFix Threat Hunting with Hunt.io
    web:hunt.io

    In this post, we outlined how ClickFix is being used across a range of web-based delivery mechanisms-from clipboard-injected malware to credential harvesting and fileless payload staging.

  • IClickFix malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    4,967 indicators of compromise attributed to the IClickFix malware family — domains , IPs, URLs and file hashes, from abuse.ch feeds.

  • Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven ...
    web:thehackernews.com

    Researcher analyzed 3,000 ClickFix payloads and found rotating wrappers plus a Downloads-folder method built to bypass AMSI.

  • ThreatFox | www.mirandaschool.org
    web:threatfox.abuse.ch

    IClickFix IOC: www.mirandaschool.org ( domain ) You are viewing the ThreatFox database entry for domain www.mirandaschool.org .

  • 700+ education and tech websites hijacked in huge ClickFix malware ...
    web:www.malwarebytes.com

    In this case, cybercriminals turned websites belonging to trusted organizations, including universities and tech companies, into delivery platforms for the malware campaign. More than 700 Ghost‑powered websites were compromised through a known SQL injection vulnerability tracked as CVE‑2026‑26980.

  • Think before you Click(Fix): Analyzing the ClickFix social engineering ...
    web:www.microsoft.com

    The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  • Detecting and Stopping ClickFix Attacks Before They Reach Your ...
    web:www.opswat.com

    ClickFix bypasses EDR by making the user the execution layer. Learn how it works and how MetaDefender Aether detects ClickFix payloads pre-execution.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.