ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen

Cybersecuritynews •Guru Baran • November 25, 2025

A new wave of ClickFix attacks is abusing highly realistic fake Windows Update screens and PNG image steganography to secretly deploy infostealing malware such as LummaC2 and Rhadamanthys on victim systems. The campaigns rely on tricking users into manually running a pre-staged command, turning simple social engineering into a multi-stage, file-light infection chain that is […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickFix Malware Campaign Uses Fake Windows Updates to Deploy Infostealers A new wave of ClickFix attacks is utilizing fake Windows Update screens to deceive users into executing malicious commands that install infostealing malware. These attacks employ steganography to hide malware within PNG images, making them harder to detect. Organizations across the U.S., EMEA, and Asia-Pacific regions have been targeted since late September 2025. 24 sources 23

Extracted Entities

ClickFix Attack Uses Steganography to Hide Malicious Code in Fake Windows Security Update Screen

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Malware (2)

MITRE ATT&CK (1)