Back www.reversinglabs.com

123 lures evaded every antivirus engine Opens a new window

www.reversinglabs.com • October 14, 2026

The ClickFix social engineering technique does not exploit software — it exploits trust. And the fact that it's designed to bypass anti-virus (AV) and endpoint-detection and response (EDR) solutions explains why it's one of the most widely used vehicles for malware delivery today. In this new report, ReversingLabs' threat intelligence research team takes a deep dive into ClickFix's methodology, covering:

The attack chain: The complete campaign, from fake CAPTCHA to fileless execution.

The pushbutton nature: Malware-as-a-Service (MaaS) economy selling attack kits from $250/month.

Payload families: Lumma Stealer, RATs, loaders, and rootkits.

Case study: A real-world watering-hole case study with blockchain-hosted C2.

Hardening strategies: Methods to actually stop ClickFix.

Modern threat hunting: An RL-developed open-source YARA rule that caught 123 lures every AV engine missed.

The open-source YARA rule was built by RL and validated in Spectra Analyze against our curated repository of 422B+ samples. Deploy it today to hunt ClickFix lures already in your environment.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickFix Malware Technique Expands with ROMULUS Server Cybercriminals are increasingly utilizing the ClickFix social engineering technique to deploy malware, as evidenced by the discovery of the ROMULUS server, which can deliver multiple payloads. ClickFix tricks users into executing malicious commands on their own machines, effectively bypassing traditional security measures. The technique has seen a significant rise, with over 1.1 million devices affected in early 2026. The ROMULUS platform allows for scalable malware delivery, including the distribution of LegionLoader through disguised archives. Researchers warn that this evolution of ClickFix poses a growing threat, as it combines social engineering with sophisticated delivery methods. The identity of the operators behind ROMULUS remains unknown, but the infrastructure appears to support a wide range of cybercriminal activities. Security awareness training must adapt to address these evolving threats. 3 sources 62

Extracted Entities

123 lures evaded every antivirus engine Opens a new window

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (1)

Tools (1)