Huntress researchers found a custom ChatGPT variant named 'Plus 5.6', promoted via sponsored Google search results, that redirects users to a fake Google Sites page mimicking a Cloudflare check. That page instructs visitors to run a PowerShell command which installs a signed application alongside a malicious DLL, deploying a remote access trojan. Huntress says it has investigated at least 40 related incidents, and OpenAI plans to retire the custom GPTs feature on December 11.
bleepingcomputer.com
· 2026-09-29
9to5Mac's latest Security Bite roundup finds that ClickFix, a technique tricking victims into pasting Terminal commands themselves, has become the default delivery method for nearly all new Mac stealer malware since the Q1 2026 review. Researchers at Group-IB, Huntress, and Kaspersky have each identified new malware families—including ClickLock, a Go-based stealer, and a MacSync variant disguised as Homebrew—all using this same social-engineering approach. The report notes attackers are adding persistence, backdoors, and infrastructure hidden inside Apple's own services.
9to5mac.com
· 2026-09-28
Kaspersky researchers report a new variant of the MacSync info-stealing malware that hides commands inside public iCloud calendar event descriptions to fetch additional payloads onto infected Macs. The malware, which evolved from the AMOS stealer family, has been spread via ClickFix-style social engineering, fake Homebrew and disk-analyzer tools, and a bogus crypto wallet app called Toria. A newly discovered Objective-C backdoor module disguises itself as Finder to maintain persistence.
bleepingcomputer.com
· 2026-09-24
Security researchers at Manifold Security found that third-party.com, a domain frequently used as a generic placeholder in developer documentation and code samples, now hosts a fake Cloudflare verification page. BleepingComputer confirmed the page mimics a 'Performing security verification' CAPTCHA that copies a malicious PowerShell command to a user's clipboard, then instructs them to paste and run it via Windows key + R, which downloads and executes malware from an external URL.
bleepingcomputer.com
· 2026-09-23
Brevo disclosed that hackers obtained a hardcoded, full-permission Cloudflare API key and used it to deploy a rogue Cloudflare Worker that rewrote content at the CDN edge for roughly 5.5 hours on September 14. The tampered scripts, including Brevo's forms widget, Conversations tool and SDK loader embedded on customer sites, were altered to serve ClickFix malware while stripping security headers to evade detection.
bleepingcomputer.com
· 2026-09-17
Security researchers say attackers compromised HBO Max's official Reddit account and used it to post hundreds of fake ads linking to a lookalike site that runs a ClickFix scam. The scheme tricks visitors into copying and pasting a malicious command into their Terminal or Command Prompt, which silently installs info-stealing malware. Warner Bros. Discovery has not responded to requests for comment, and it's unclear how many users were affected.
techcrunch.com
· 2026-09-14
Homebrew, the widely used macOS package manager, has shipped version 7.0.0 with a fully released BrewUI graphical interface for macOS 26 'Tahoe' and later, letting users browse packages and dependencies visually instead of via command line. The update also introduces a new 'brew vulns' command backed by a Homebrew-specific advisory database, which cross-references installed formulae against OSV.dev vulnerability records.
bleepingcomputer.com
· 2026-09-14
Attackers took over HBO Max's official, verified Reddit account and used it to post 108 malicious ads over roughly two days, tricking Windows and macOS users into installing information-stealing malware. The ads used the ClickFix technique, luring victims into pasting attacker-supplied commands into Run, PowerShell, or Terminal under the guise of fixing errors or verifying CAPTCHAs, with some posts impersonating a fake HBO Max app and others posing as AI tools or developer utilities.
bleepingcomputer.com
· 2026-09-14
Security researchers report that ClickFix-style attacks, which trick users into copying and running malicious commands via fake CAPTCHA pop-ups, are proliferating across both Windows and Mac systems. Researcher Kevin Beaumont notes victims are flooding Reddit for help, and attackers are now compromising legitimate websites to embed these prompts, making the scam harder to spot.
techspot.com
· 2026-09-14
Security researchers report that ClickFix, a malware technique relying on fake CAPTCHA prompts and terminal commands, has exploded in popularity among attackers, including state-backed hacking groups. The attack tricks victims into copying and pasting a malicious command into Windows Run, PowerShell, or macOS Terminal after clicking through a fraudulent verification screen on a compromised website.
arstechnica.com
· 2026-09-11
Cisco Talos researchers identified two separate ClickFix-style social engineering campaigns that trick victims into executing malicious code themselves, one aimed at stealing cryptocurrency and another designed to gain persistent enterprise network access. One campaign uses a publicly shared Google Sheet to distribute malicious browser code that hijacks Chrome transaction interfaces, while both operations abuse legitimate cloud services and trusted software to disguise malicious activity as normal user behavior.
darkreading.com
· 2026-09-08
Netskope researchers found over 5,400 compromised small-business websites, mostly running WordPress and PrestaShop, injected with scripts that fetch malicious payloads from smart contracts on the BNB Smart Chain Testnet. Visitors are shown a fake CAPTCHA that tricks them into pasting a PowerShell command via the Windows Run dialog, which downloads and runs the attacker's final payload. Later in the campaign, attackers swapped the ClickFix payload for a stealthier WebRTC data-channel stager that opens a covert encrypted connection without a genuine handshake.
bleepingcomputer.com
· 2026-09-05
GoKawiil