MEDIUMMalware
Global

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery

·Source: The Hacker News

Updated:

Executive Summary

ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The same research also turned up a new delivery method built to slip past Windows' script scanning.

Analysis

ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office. New research shows the malicious commands behind its fake "prove you're human" pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The same research also turned up a new delivery method built to slip past Windows' script scanning.
Source Attribution

Originally published by The Hacker News on Jul 1, 2026.

Related Threats

MEDIUMMalware

Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its real payload inside an image. The goal is the usual one: steal banking logins and take

The Hacker News
MEDIUMMalware

Fileless Malware Abuses Google Blogspot to Deploy Infostealer in Memory

Securonix said the Veil#Drop campaign abuses Google Blogspot to deliver PureLog Stealer in memory

Infosecurity Magazine
MEDIUMMalware

Brazilian Banking Trojan Ousaban Targets Spain and Portugal

FortiGuard says the Brazilian banking trojan Ousaban is targeting Spain and Portugal via phishing

Infosecurity Magazine