Security firm Report URI says its threat intelligence tools have identified 15,579 compromised websites, collectively receiving an estimated 135 million visits a month. The infections include credit card skimmers, ClickFix malware traps, device-exploitation code and malicious redirects, introduced either through direct site compromises like WordPress flaws or via infected third-party scripts loaded by the sites.
scotthelme.co.uk
· 2026-11-06
A security analysis describes three attack patterns—stolen GitHub developer tokens, ClickFix lures disguised as Claude Code install commands, and help-desk vishing that tricks employees into approving MFA prompts—that let intruders access and extract data within about 15 minutes of gaining entry. The report found that existing detection tools, including GitHub's native monitoring and identity providers, failed to flag these techniques as malicious. One example cited involved a GitHub Desktop OAuth token left dormant for 95 days before being used by an attacker.
bleepingcomputer.com
· 2026-10-22
Google announced new Chrome features that warn users when they land on suspicious or dangerous websites, available through the browser's Enhanced Protection mode. The update targets fake antivirus and browser-update scams with a likelihood score, and counters 'ClickFix' attacks by clearing the clipboard and showing a warning when a site tries to trick users into pasting malicious code.
cnet.com
· 2026-10-21
Google is rolling out new Chrome protections under Safe Browsing's Enhanced Protection mode that use a server-side Gemini model to flag deceptive websites and warn users about scam risk. The update also adds detection for ClickFix attacks, where users are tricked into pasting malicious commands into their terminal, and introduces a milder 'suspicious site' warning for pages that show scam-like patterns without meeting the threshold for a full red warning.
bleepingcomputer.com
· 2026-10-21
Google has updated Chrome to flag websites it deems 'suspicious,' not just those already confirmed as dangerous. The new alerts, powered partly by Gemini AI analysis of a site's content, branding and domain reputation, let users choose to leave the page, mark it safe, or continue browsing. The update also adds protections against fake antivirus update prompts and ClickFix-style social engineering attacks.
zdnet.com
· 2026-10-21
Huntress researchers Sarah Reddish and Spike Brandt detailed a ClickFix campaign that begins with a sponsored Google ad for 'amazon business,' redirecting victims through a suspicious domain to a spoofed Amazon login page hosted on Google Sites. A fake CAPTCHA on that page triggers Windows' decades-old finger utility, which launches a multi-stage chain delivering a pirated NetSupport Client RMM tool and Lumma Stealer infostealer malware. Google has pulled the malicious ad, but the attackers' infrastructure, which now uses barbeque-themed domain names, remains active.
darkreading.com
· 2026-10-21
Push Security reports that ClickFix, a phishing technique that tricks users into running malicious commands, accounted for an average 52% of its detections through Q2 2026, rising to 67% in August. Newer variants impersonate AI tools like Claude and ChatGPT, with ANY.RUN linking over 1,200 sandbox analyses to fake AI campaigns between April and October 2026, 81% of which impersonated Claude or ChatGPT/Codex.
bleepingcomputer.com
· 2026-10-21
Varonis Threat Labs discovered AvisLoader, a new Windows malware loader found on an exposed staging server alongside a ClickFix phishing lure and its control panel. The malware is delivered via a fake DocuSign verification page hosted on Cloudflare Workers that tricks victims into pasting and running a malicious command, which then fetches code from a Cloudflare Quick Tunnel address.
bleepingcomputer.com
· 2026-10-12
Push Security reports that a malvertising campaign is routing Google search ads through Bing's trusted click-tracking domain before funneling victims through a hacked WordPress site to a fake Claude download page. The scheme, found after a malicious ad surfaced for searches like "claude mac," uses layered cloaking checks to hide the malicious payload from scanners and direct visitors, ultimately pushing macOS users toward ClickFix-style attacks that trick them into running malicious commands.
bleepingcomputer.com
· 2026-10-09
Security researchers at Flare identified a ClickFix social-engineering campaign distributing the CrocoRat remote access Trojan and cryptocurrency stealer via a misspelled domain showing a fake house-wiring image. Instead of fetching malware directly, the pasted PowerShell command queries an attacker-controlled DNS TXT record, which returns instructions for the next stage of the attack.
darkreading.com
· 2026-10-06
Security researchers have identified a campaign in which threat actors create malicious custom GPTs within ChatGPT and abuse legitimate OpenAI and Google domains to lure victims. The technique follows a ClickFix-style approach, tricking users into executing steps that ultimately deliver a remote access trojan (RAT) to their systems.
darkreading.com
· 2026-09-30
Microsoft Threat Intelligence reported on Sept. 29 that Russia-linked APT group Star Blizzard has replaced its ClickFix social-engineering technique with a new malware delivery method called RedFlick. The group, also known as ColdRiver or Callisto, has used RedFlick since January to install its CosmicPulse backdoor via scheduled tasks, requiring only a single victim interaction instead of multiple steps.
darkreading.com
· 2026-09-30
GoKawiil