New ClickFix Campaign Hijacks Facebook Sessions Using Fake Verification Pages

Cybersecuritynews •Tushar Subhra Dutta • January 22, 2026

Attackers have launched a widespread campaign called ClickFix that steals account credentials by tricking users into handing over their session tokens. Rather than using complex malware or software exploits, the attack relies on social engineering to guide victims through a fake verification process. This campaign has grown significantly since early 2025 and continues to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickFix Campaign Hijacks Facebook Sessions via Fake Verification Pages The ClickFix campaign exploits social engineering techniques to steal Facebook session tokens from users. By guiding victims through a fake verification process, attackers have successfully extracted live session credentials directly from browsers. This campaign has expanded significantly since early 2025, with researchers identifying numerous malicious webpages involved in the attack. 2 sources 20

Extracted Entities

New ClickFix Campaign Hijacks Facebook Sessions Using Fake Verification Pages

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Platforms (1)