TF-1863222
high
📛 Threat Title
IClickFix: Domain name that delivers a malware payload www.irandavari.com
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-07-29 08:58:00 UTC. Reporter: varysz. Tags: ClickFix, Mac, WordPress.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
www.irandavari.com
UrlVoid 3 / 35
IOC database
- Type
- domain
- Value
www.irandavari.com- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Domain name that delivers a malware payload attributed to IClickFix
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: Domain name that delivers a malware payload. Attributed malware: IClickFix. Confidence: 100. First seen: 2026-07-29 08:58:00 UTC. Reporter: varysz. Tags: ClickFix, Mac, WordPress.
Remediations (10)
-
web:any.run
Learn how ClickFix malware hijacks the clipboard and exploits user trust to silently install infostealers, ransomware, and remote access trojans without triggering traditional security controls, and how businesses can defend against it with real-time threat intelligence.
-
web:cybersecuritynews.com
In mid-2025, Lab539 researchers observed an unexpected surge in a novel browser-based malware campaign dubbed "ClickFix." Emerging quietly in July, the threat quickly expanded its reach by registering over 13,000 unique domains designed to lure users into executing malicious commands on their own devices. The attack leverages compromised or low-cost hosting infrastructure, including a ...
-
web:cybersecuritynews.com
Elastic analysts identified a substantial increase in ClickFix-related alerts across monitored environments, particularly within the first quarter of 2025, with attackers predominantly focusing on deploying mass infection malware including Remote Access Trojans and information stealers. The security researchers have tracked these campaigns leading to the deployment of sophisticated malware ...
-
web:hunt.io
In this post, we outlined how ClickFix is being used across a range of web-based delivery mechanisms-from clipboard-injected malware to credential harvesting and fileless payload staging.
-
web:thehackernews.com
Microsoft details a new ClickFix variant abusing DNS nslookup commands to stage malware , enabling stealthy payload delivery and RAT deployment.
-
web:thehackernews.com
Researcher analyzed 3,000 ClickFix payloads and found rotating wrappers plus a Downloads-folder method built to bypass AMSI.
-
web:www.elastic.co
A Wretch Client: From ClickFix deception to information stealer deployment Elastic Security Labs detected a surge in ClickFix campaigns, using GHOSTPULSE to deploy Remote Access Trojans and data-stealing malware .
-
web:www.malwarebytes.com
ClickFix just got more convincing, hiding malware in PNG images and faking Windows updates to make users run dangerous commands.
-
web:www.mcafee.com
Authored by Yashvi Shah and Vignesh Dhatchanamoorthy McAfee Labs has discovered a highly unusual method of malware delivery, referred to by researchers as the "Clickfix" infection chain. The attack chain begins with users being lured to visit seemingly legitimate but compromised websites. Upon visiting, victims are redirected to domains hosting fake popup windows that instruct them to ...
-
web:www.microsoft.com
The ClickFix social engineering technique has been growing in popularity, with campaigns targeting thousands of enterprise and end-user devices daily. This technique exploits users' tendency to resolve technical issues by tricking them into running malicious commands. These commands, in turn, deliver payloads that ultimately lead to information theft and exfiltration.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Reputation of linked indicators
DomScan scores the domains, AbuseIPDB + GreyNoise score the IPs. Verdicts are per-indicator — this is a roll-up, so no lookup is triggered by opening this page.