ClickFix malware delivery now uses API servers and Windows script evasion

Intelligence Summary

A researcher analyzed thousands of live ClickFix payloads and found the delivery chain has evolved. Instead of static drops, API-driven infrastructure serves malware with the same core commands disguised per visitor. The campaign uses a “prove you’re human” flow to induce users to trigger malicious actions manually. The research also identified a Windows-focused delivery approach intended to bypass script scanning. This increases both scale and stealth, so users should treat CAPTCHA-like prompts and verification pages as suspicious and verify URLs before interacting.

Recommended Action

Confirm whether the affected technology is in use in your environment before deciding on remediation. Until then, watch authentication and outbound traffic logs for the indicators described in the source. This signal rests on a single report, so corroborate it before acting on anything irreversible.

Topics