ClickFix Investigation Exposes API-Driven Malware Across 3,000 Live Payloads

A growing number of ClickFix campaigns are advancing from simple social engineering operations into highly orchestrated malware delivery operations supported by dynamic infrastructure. A recent study analyzing nearly 3,000 ClickFix payloads reveals that attackers are utilizing API-based delivery systems that allow them to generate uniquely disguised malicious commands for each victim while serving the same underlying malware to all victims. 

Bert-Jan Pals conducted the analysis, which uncovered previously unknown techniques for evading Windows script inspections, thus demonstrating the deliberate efforts of threat actors to increase detection resistance and operational scalability through evasion of Windows script inspection.
These findings show how what once appeared to be a straightforward clipboard-based deception has evolved into a resilient, adaptive ecosystem in which infection success is maximized despite conventional security controls being compromised. It is concerning that the findings come as ClickFix continues to gain traction as one of the most widespread social engineering exploits. 

First identified in March 2024, ClickFix has since become one of the most widely abused social engineering exploits in the cybercrime landscape.
As opposed to exploiting software vulnerabilities, ClickFix exploits user trust by presenting fake browser errors, anti-bot CAPTCHA challenges, security warnings, or access restrictions that appear legitimate and gain the user’s trust. 

Once the victims have completed the seemingly routine verification procedure, the attacker-supplied code is executed manually by the victim.

According to Microsoft’s Cyber Signals report for 2025, 47 percent of observed first-time access incidents were attributed to ClickFix-based activity, demonstrating the prevalence of deception-driven attack chains among malware operators. 

An attack sequence that transforms ordinary web pages into malware launch points is at the center of these campaigns, and it appears to be deceptively simple.
It is common for attackers to compromise legitimate websites or create convincing phishing pages and substitute counterfeit CAPTCHA screens for verification prompts that require visitors to perform a series of manual tasks, including executing a command copied to the clipboard. These commands typically launch PowerShell, which retrieves and executes remote payloads, thereby enabling the deployment of information stealers and other malicious applications. 

On Windows systems, researchers observed ClickFix delivering multiple malware families, including Deepload, during the observed campaigns. Researchers have documented the use of the same technique beyond the Windows ecosystem, with the Atomic Stealer (AMOS) malware being distributed to macOS users for the first time. The technique targets browser credentials, session cookies, cryptocurrency wallets, and Apple Keychain data, illustrating its increasing cross-platform scope. 

ClickFix’s popularity is largely attributed to its ability to bypass many of the security mechanisms commonly utilized by organizations. ESET’s telemetry shows that ClickFix activity increased 517 percent between late 2024 and the first half of 2025 in response to this model, and Microsoft’s Digital Defense Report indicates that the technique accounted for 47 percent of initial access incidents investigated by its Defender Experts team in 2025.
A dedicated entry under technique T1204.004 has also been made under the MITER ATT&CK framework, recognising ClickFix as a unique form of user-assisted malicious execution, based on its inc

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.