Researcher Analyzes 3,000 Live Click Fix Payloads, Exposing API-Driven Malware Delivery

Summary: Researcher Bert-Jan Pals analyzed roughly 3,000 payloads from live ClickFix campaigns and found the fake-CAPTCHA pages now pull commands from API-driven servers that check an access token, log the caller, and return a freshly scrambled command each time - 100 requests produced 100 different payloads wrapped in rotating Base64, AES, TripleDES, Rijndael, and Deflate. He also documented a newer variant that copies a short orchestrator line to the clipboard which moves a downloaded file from the Downloads folder and runs it, keeping the payload out of the pasted text so it can slip past AMSI script scanning. Pals presented the findings at OrangeCon in early June and published them on June 30.
Why it matters: Microsoft's 2025 Digital Defense Report attributed 47% of the initial-access cases seen by its Defender Experts team to ClickFix, and Expel estimated one ClearFake wave likely infected as many as 147,521 systems since late August 2025 - with state-backed groups including APT28, MuddyWater, and Kimsuky now folding it into existing infection chains.

Read the original at The Hacker News ↗

Topics: Detection & Response
Related: YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026
Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026
Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026