ClickFix malware delivery now uses API servers and Windows script evasion

Intelligence Summary

A researcher analyzed thousands of live ClickFix payloads and found the delivery chain has evolved. Instead of static drops, API-driven infrastructure serves malware with the same core commands disguised per visitor. The campaign uses a “prove you’re human” flow to induce users to trigger malicious actions manually. The research also identified a Windows-focused delivery approach intended to bypass script scanning. This increases both scale and stealth, so users should treat CAPTCHA-like prompts and verification pages as suspicious and verify URLs before interacting.

Recommended Action

Review affected assets, schedule urgent remediation, and monitor related indicators.

Topics