ClickFix Attacks Archives

Placeholder domain used in dev docs now serves ClickFix attacks

24Sep

By RBNo Comments

News

Placeholder domain used in dev docs now serves ClickFix attacks

The domain "third-party.com", often employed as a placeholder in developer documentation and code samples, is now hosting a counterfeit Cloudflare verification page designed to deceive Windows users into running PowerShell commands. For a long time, the domain third-party.com has appeared in documentation to stand for any external website, API, or service, much like developers rely on domains such as example.com. Yet unlike example.com, example.net, and example.org, which IANA reserves specifically for documentation purposes, third-party.com is an ordinary registered domain whose content its owner is free to control. This discrepancy has now become a security issue, as the domain started hosting a ClickFix attack that mimics a Cloudflare security verification. Manifold Securit...

Steam forum ClickFix attacks infect gamers with XMRig cryptominers

27Jul

By RBNo Comments

News

Steam forum ClickFix attacks infect gamers with XMRig cryptominers

ClickFix assaults, which pose as remedies for computer and game issues but really infect devices with cryptocurrency, are abusing Steam discussion forums. Threat actors are setting up random Steam accounts to make what seem to be helpful fixes for people's postings about games crashing, lost inventory items, and other technical concerns, according to a reader who contacted BleepingComputer about the operation. In response to posts, the threat actors instruct other members to launch PowerShell as an administrator and execute a command to resolve the problem. Nevertheless, the code silently downloads and executes an XMRig miner software on the PC. These kinds of attacks are referred to as ClickFix, a social engineering technique that trick victims into manually carrying out malicio...

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

26May

By RBNo Comments

News

Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks

Threat actors are injecting malicious JavaScript code to support ClickFix assaults by taking advantage of a recently revealed critical security vulnerability in Ghost CMS. The activity involves exploiting CVE-2026-26980 (CVSS score: 9.4), a SQL injection vulnerability in Ghost's Content API that might enable an unauthenticated attacker to read any data from the database, according to QiAnXin XLab. Version 6.19.1 fixed the security vulnerability in February 2026. Anthropic used Claude to find the vulnerability. The vulnerability is serious since it gives an attacker unauthorized access to a site's admin API key, enabling them to inject malicious code and contaminate the site. Articles published on the content management system can be directly modified by using the admin API key to ac...

Fake ad blocker extension crashes the browser for ClickFix attacks

20Jan

By RBNo Comments

News

Fake ad blocker extension crashes the browser for ClickFix attacks

NexShield is a phony ad-blocking Chrome and Edge extension used in a malvertising campaign that purposefully crashes the browser in advance of ClickFix attacks. The attacks, which were discovered earlier this month, resulted in the deployment of ModeloRAT, a new Python-based remote access tool used in business settings. Raymond Hill, the creator of the authentic uBlock Origin ad blocker with over 14 million users, marketed the NexShield extension, which was taken down from the Chrome Web Store, as a high-performance, lightweight, privacy-focused ad blocker. NexShield causes a denial-of-service (DoS) problem in the browser by repeatedly establishing "chrome.runtime" port connections and depleting its memory resources according to researchers read more about Fake ad blocker extensi...

New FileFix Method Emerges as a Threat Following 517% Rise in ClickFix Attacks

27Jun

By RBNo Comments

News

New FileFix Method Emerges as a Threat Following 517% Rise in ClickFix Attacks

ESET research shows that between the second half of 2024 and the first half of this year, the ClickFix social engineering technique as an initial access vector employing phoney CAPTCHA verifications grew by 517%. The list of dangers that ClickFix attacks cause is constantly expanding and now includes ransomware, cryptominers, infostealers, remote access trojans, post-exploitation tools, and even custom malware from threat actors with ties to nation-states. ESET's Threat Prevention Labs Director Jiří Kropáč stated. ClickFix is a well-known and dishonest technique that uses fake error messages or CAPTCHA verification checks to trick users into copying and pasting a malicious script into the Apple macOS Terminal software or the Windows Run dialogue box, then running it. According to...