17,000 URLs Reveal How Click Fix Turns Trusted Websites Into Malware Traps: Report by CTM360

Summary: CTM360's report traces ClickFix from a late-2023 novelty to the leading initial-access technique in enterprise intrusion telemetry, with Microsoft attributing 47% of the initial-access cases its Defender Experts team handled in 2025 to it, ahead of conventional phishing. The analysis covers more than 17,000 infected URLs serving fake Cloudflare verification pages, about 3,000 still active at the time of writing, and finds the injected script carries no attacker domain, instead reading the current lure hostname from a smart contract on the Polygon blockchain via a technique called EtherHiding.
Bottom line: The dropper base64-encodes a machine fingerprint - machine GUID, volume serial, computer name, BIOS manufacturer, system model, GPU and username - into the download path, so the command-and-control server sees the victim's identity before serving anything and can return a payload chosen per machine or nothing at all, which makes detonation-based verdicts structurally unreliable. The kit is sold to multiple affiliates at around $380 a month and is built so that no single takedown breaks it, with two independent resolution mechanisms at two different stages.

Read the original at The Hacker News ↗