Topic
Social-engineering technique that uses fake CAPTCHA, error, or verification prompts to trick users into running attacker commands, often delivering malware.
Patrick Wardle found that any local process on a Mac can redirect Meta Muse's voice endpoint and capture its account token, with no macOS permission needed. Muse also zipped and exported the 6.8 GB root filesystem of its own sandbox on request.
Reality
Sophos linked ClickFix lures that open Windows Terminal, not the Run dialog, to STAC4924, a campaign it has tracked since at least March. The intrusions plant Lorem Ipsum Loader and a Python reverse-tunnel implant that relays attacker traffic through the victim host.
Reality
Check Point Research says exposed directories revealed the logs, source code and management tooling behind StopAndProtect, a campaign it links to more than 5,000 infected machines.
Perspective Coverage
3 publishersReality
Microsoft's TerminalFix writeup shows the same fake CAPTCHA lure now feeding multi-line PowerShell into Windows Terminal, where it sideloads a signed binary, pulls payloads out of PNG files and leaves a reverse tunnel behind.
Perspective Coverage
4 publishersReality
Cisco Talos traces a crypto skimmer running since October 2025 that keeps persistence in a Tampermonkey userscript and pulls its code from a public Google Sheet. Talos says most organisations are not the target.
Reality
The Threat Hunter Team says the technique has hit government departments, technology firms and hotels since February 2026. In one case, the operators moved to node.exe only after their Cobalt Strike beacons kept getting blocked.
Reality
Bitdefender puts 84% of its high-severity incidents on binaries that were already installed on the host. That figure and Microsoft's ClickFix number cover the two largest volume plays in the telemetry, and both sit outside what attachment scanning and patch cycles reach.
Reality
Bitdefender logged 873 claimed ransomware victims in July, the third-highest month in a year. A brand that barely existed in June supplied 46 of them, on a leak site the analysts say they cannot fully verify.
Reality
Field Effect logged three ClickFix chains between mid-June and July 2026, two of them landing on the same hidden file pair in ProgramData, and in one case the operator phoned the victim to open the lure.
Reality
Microsoft says the campaign now delivers its payload through a command pasted into Terminal rather than a .dmg installer. The review step that mattered was tied to that older delivery method, and the attackers no longer need it.
Reality
Microsoft Threat Intelligence says this ClickFix variant ends in Active Directory reconnaissance and a reverse-tunnel implant, giving a single tricked employee a route into the network.
Reality
Socket says the operators bought their way onto tens of thousands of machines and delivered the payload in a routine update. Cleanup means rotating passwords and moving crypto to fresh wallets, user by user.
Reality
An extension allowlist pins an ID, and the ID survives a sale. The operators behind Superior bought or seeded trust that users had already granted, then spent it in an automatic update that stripped page CSP on the way through.
Reality
Forcepoint's X-Labs found short-lived ClickFix domains carrying white-on-white characters and zero-width spaces, which puts the trust boundary for any agent you point at the open web inside your own extraction code.
Reality
Malwarebytes traces one loader through ClickFix prompts, malicious game installs and fake software downloads. The shared part is a .csproj-to-MSBuild handoff and a blockchain lookup for C2.
Reality
Cato says a sponsored result for "codex macos download" leads to a Google Sites clone whose Terminal command strips quarantine flags and stages an AMOS-linked payload.
Reality
The StopAndProtect campaign keeps its payloads, command channel and stolen-file storage on other people's blogs. That makes domain reputation a weaker signal, and cleanup somebody else's bill.
Reality
Huntress says a researcher targeted after Black Hat and Def Con was sent a Google Doc that rendered an Apps Script sidebar with ClickFix instructions. The lure arrived by DM, not email.
Reality
Sophos X-Ops confirmed 38 AI-related MDR cases across twelve months. Impersonation of AI software accounted for 30 of them, and conventional payload controls were what stopped them.
Reality
Jamf Threat Labs describes a Rust stealer that copies Chromium profiles and drives them over Chrome DevTools Protocol. Password rotation does not revoke what it exports.
Reality
Security · August 14, 2026 · 1 publisher
Security · August 14, 2026 · 1 publisher