ReliaQuest says ClickFix has rapidly become a leading malware delivery technique, driving both initial access and defense evasion by tricking users into pasting malicious commands into Windows and macOS tools. The tactic has evolved with variants like CrashFix, AMOS delivery on macOS, and loaders for Deepload, while attackers increasingly target developers through malvertising and emailed lures. #ClickFix #AtomicmacOSStealer #AMOS #Deepload #ReliaQuest #GoogleAds #Bitbucket #npm
Keypoints
- ClickFix has become a dominant technique for initial access and defense evasion.
- Attackers use fake CAPTCHAs, error prompts, and verification messages to make users paste commands.
- The technique has expanded to macOS, including campaigns delivering Atomic macOS Stealer.
- ReliaQuest observed ClickFix loaders used to deliver Deepload with heavy obfuscation.
- Developers are being targeted through malvertising and fake installation pages on Google Ads.
Read More: https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix