TF-1811927 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 75. First seen: 2026-05-13 18:54:35 UTC. Reporter: varysz. Tags: ClickFix, Vidar.

Indicators of Compromise (3)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile Threatfox IOCs/Threats
• ThreatFox IOC page Threatfox IOCs/Threats

  Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 75. First seen: 2026-05-13 18:54:35 UTC. Reporter: varysz. Tags: ClickFix, Vidar.

• Meet IClickFix: a widespread framework using the ClickFix tactic
  web:blog.sekoia.io

  Uncover IClickFix : a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

  2026-05-22 00:35 UTC
• Threat Actors Advertising New 'ClickFix' Payload That Stores Malware ...
  web:cybersecuritynews.com

  A threat actor is advertising a "ClickFix" payload delivery method that allegedly stores malware within browser cache to evade detection and bypass EDR, claiming it avoids suspicious web requests and executes via disguised commands in File Explorer.

  2026-05-22 00:35 UTC
• ThreatFox | 2026123.xyz
  web:threatfox.abuse.ch

  IClickFix IOC: 2026123.xyz ( domain ) You are viewing the ThreatFox database entry for domain 2026123.xyz .

  2026-05-22 00:35 UTC
• New ClickFix attack abuses nslookup to retrieve PowerShell payload via DNS
  web:www.bleepingcomputer.com

  Threat actors are now abusing DNS queries as part of ClickFix social engineering attacks to deliver malware , making this the first known use of DNS as a channel in these campaigns.

  2026-05-22 00:35 UTC
• New ClickFix wave infects users with hidden malware in images and fake ...
  web:www.malwarebytes.com

  ClickFix just got more convincing, hiding malware in PNG images and faking Windows updates to make users run dangerous commands.

  2026-05-22 00:35 UTC
• Think before you Click(Fix): Analyzing the ClickFix social engineering ...
  web:www.microsoft.com

  The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.

  2026-05-22 00:35 UTC
• Microsoft Warns of ClickFix Attack Abusing DNS Lookups
  web:www.securityweek.com

  Microsoft has warned users that threat actors are leveraging a new variant of the ClickFix technique to deliver malware .

  2026-05-22 00:35 UTC
• Caught in the CAPTCHA: How ClickFix is Weaponizing ... - SentinelOne
  web:www.sentinelone.com

  Learn about the latest ClickFix tactics compromising websites and embedding fraudulent CAPTCHA images to deliver malware and malicious code.

  2026-05-22 00:35 UTC
• Meet ClickFix - The "CAPTCHA" Scam That Tricks You Into Installing Malware
  web:www.seraphsecure.com

  As if that isn't already bad enough, sometimes it comes bundled with additional malware , things we promise you don't want on your device. After the malicious command is run, infostealer malware downloads and installs silently and begins collecting passwords, session cookies, and other sensitive data.

  2026-05-22 00:35 UTC
• DNS-Based ClickFix Attack Uses Nslookup for Malware
  web:zerodai.com

  Microsoft warns of a new ClickFix attack using nslookup for DNS-based malware delivery. Learn how to detect and mitigate this stealthy threat.

  2026-05-22 00:35 UTC

Only Available for Registered Users. Sign in to view.