#clickfix — Public Fediverse posts

Fake Zillow pages use ClickFix NetSupport RAT to target apartment hunters

A ClickFix campaign deployed NetSupport RAT through fraudulent Zillow apartment-review pages targeting Windows users. The attack leveraged social engineering by presenting fake verification checks that copied PowerShell commands to victims' clipboards. Users were instructed to execute these commands via Win+R, Ctrl+V, Enter key combinations, which fetched malicious scripts from decimal-encoded IP addresses. The scripts deployed NetSupport Manager remote administration software configured to hide windows and persist through startup folders. Targets primarily included apartment hunters and renters, with particular risk to those using work laptops. The campaign utilized short-lived domains with random numeric suffixes on .sbs TLD and wildcard subdomains, suggesting personalized targeting through direct messaging rather than search poisoning or malvertising. Attribution remains uncertain as NetSupport RAT is widely used across multiple threat actors.

Pulse ID: 6af65cd84505f8125e2ca3ed
Pulse Link: https://otx.alienvault.com/pulse/6af65cd84505f8125e2ca3ed
Pulse Author: AlienVault
Created: 2026-11-13 00:42:00

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #NetSupportRAT #Hide #Malvertising #OTX #AlienVault

2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

A malicious campaign utilizing SmartApeSG ClickFix (also known as BabaDeda) techniques has been observed distributing CNCmachineRMS RAT through fake CAPTCHA verification pages. The attack chain begins with compromised domains serving malicious JavaScript that injects ClickFix text for victims to paste into Windows Run windows. This retrieves an HTA file that subsequently downloads a ZIP archive containing a DLL side-loading package for deploying CNCmachineRMS RAT. The infection establishes command and control communication over TCP port 443 with encoded traffic. The campaign leverages social engineering through fraudulent CAPTCHA pages to trick users into executing malicious code, ultimately leading to RAT installation and persistent access.

Pulse ID: 6af6a2141941c1adfc3963ca
Pulse Link: https://otx.alienvault.com/pulse/6af6a2141941c1adfc3963ca
Pulse Author: AlienVault
Created: 2026-11-13 05:37:24

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #RAT #SmartApeSg #CAPTCHA #OTX #AlienVault

#TypoPrompting is the name given to the most recent batches of #malware available for your accidental perusal.

Cybersecurity researchers have found that lookalike domains masquerading as #AI tools are being used to serve ClickFix-style lures, browser-hijacking malware, and a set of extensions that hijack user searches.

While one category leads to a #ClickFix lure that serves a PowerShell command via a fake #Cloudflare verification page, the second route takes users to "Security Check" pages that deliver a browser-hijacking malware called #NetGuard. The third pathway sends users to a search-hijack extension family with 16 live Chrome Web Store listings and 972,000 declared users.

https://thehackernews.com/2026/11/186-fake-ai-domains-redirect-users-to.html

ISC diary: #Macfinger #ClickFix campaign sends #DownTheDRAIN #infostealer for #macOS https://isc.sans.edu/diary/33518

2026-11-12: SmartApeSG ClickFix campaign pushes CNCmachineRMS RAT

2026-11-12 (THURSDAY): SMARTAPESG CLICKFIX CAMPAIGN PUSHES CNCMACHINERMS RAT

Pulse ID: 6af66e1abcb5ac46992f96ae
Pulse Link: https://otx.alienvault.com/pulse/6af66e1abcb5ac46992f96ae
Pulse Author: CyberHunter_NL
Created: 2026-11-13 01:55:38

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #RAT #SmartApeSg #OTX #CyberHunter_NL

2026-11-12 (Thursday): #SmartApeSG #ClickFix campaign pushes #CNCmachineRMS #RAT

A #pcap of the infection traffic, malware samples, and indicators are available at https://www.malware-traffic-analysis.net/2026/11/12/index.html

New.

Akamai: Dissecting StrikeStub: ClickFix PowerShell Malware and Modular RAT https://www.akamai.com/blog/security-research/strikestub-clickfix-powershell-malware-modular-rat #infosec #malware #threatresearch #Windows #ClickFix

Beyond the clipboard: The evolving tradecraft of ClickFix

Pulse ID: 6af5441d43ec959b71f72819
Pulse Link: https://otx.alienvault.com/pulse/6af5441d43ec959b71f72819
Pulse Author: Tr1sa111
Created: 2026-11-12 04:44:13

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Clickfix #Clipboard #OTX #Tr1sa111