TF-1931072
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload univesalcheckrobot.site
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 90. First seen: 2026-09-23 21:00:01 UTC. Reporter: sveinn. Tags: ClickFix, etherhiding.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
univesalcheckrobot.site
IOC database
- Type
- domain
- Value
univesalcheckrobot.site- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 90. First seen: 2026-09-23 21:00:01 UTC. Reporter: sveinn. Tags: ClickFix, etherhiding.
Remediations (10)
-
web:femtosec.io
Analysis of the ClickFix loader emerging on underground forums. Learn how this malware deployment tool impacts enterprise security and how to mitigate the risk.
-
web:github.com
A comprehensive threat intelligence and malware analysis of an active ClickFix / ConsentFix malvertising campaign operating through deceptive streaming websites. This project documents the complete attack chain—from initial webpage interaction to browser fingerprinting, JavaScript analysis, network communications, infrastructure analysis, and Indicators of Compromise (IOCs).
-
web:hunt.io
In this post, we outlined how ClickFix is being used across a range of web-based delivery mechanisms-from clipboard-injected malware to credential harvesting and fileless payload staging. By focusing on the behavioral patterns of these pages, we were able to surface active infrastructure that may otherwise evade traditional detection pipelines.
-
web:socprime.com
They captured the exact PowerShell execution pattern used to retrieve the final payload and recovered the dropped NetSupport RAT components along with associated C2 infrastructure indicators. Mitigation Monitor web content for the ic-tracker-js injection and block known malicious domains , redirectors, and short-link services used in the chain.
-
web:sourcedefense.com
The operators have built a coordinated malware -delivery framework that can move between newly registered domains , reuse the same attack components, maintain persistent visitor identities, run randomized experiments, measure conversion and abandonment, filter automated analysis, and hide the attack from authenticated WordPress administrators.
-
web:www.csoonline.com
The WordPress ClickFix campaign delivers three separate infostealer payloads — two of them previously unknown — and uses domain infrastructure that appears to have been set up since July 2025.
-
web:www.ctm360.com
ClickFix is a rapidly evolving social engineering technique that tricks users into executing malicious commands through fake CAPTCHA checks, browser errors, verification prompts, and other seemingly legitimate instructions. Unlike traditional malware delivery, ClickFix often requires no software exploit—the user is manipulated into initiating the attack themselves. In ClickFix & Beyond ...
-
web:www.hhs.gov
Overview of ClickFix Attacks Threat actors initiate these campaigns by logging into websites with stolen credentials and installing fake plugins in compromised environments. Once installed, the plugins inject malicious JavaScript containing a known variation of fake browser update malware that uses blockchain and smart contracts to obtain malicious payloads ( a practice known as EtherHiding ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
-
web:www.stormshield.com
Preamble In a previous article, we introduced the ClickFix technique. A full attack chain leveraging this technique was detected in mid-March 2026. It was publicly disclosed on X (formerly Twitter) by a MalwareBazaar member, known to regularly share malware samples. Despite attackers changed the initially used domains , we provide in this post an in-depth analysis of this ClickFix campaign.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.