ClickFix Malware Campaign Evolves with Advanced Deception Techniques

Uk.Pcmag

ClickFix Malware Campaign Evolves with Advanced Deception Techniques

First seen 24 Nov 2025, 20:25 UTC • •27.7

Article Content

1 / 19

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

The ClickFix malware has evolved to utilize videos, timers, and OS-specific tricks to deceive users into self-infection. This campaign leverages social engineering tactics to manipulate victims into executing malicious code, with new variants featuring video tutorials and automatic OS detection. The attacks have expanded beyond traditional phishing methods, incorporating multiple delivery channels for greater effectiveness.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 227d ago How this analysis works

More articles in this cluster (18)

Threat Graph

22 entities, 36 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (8)

Malware
Phishing
Steganography
T1027 - Steganography
T1055 - Process Injection
T1059.001 - PowerShell
T1059 - Command and Scripting Interpreter
T1218.005 - Mshta

Campaign (4)

ClickFix Attack
ClickFix Malware Campaign
Operation Endgame
Rhadamanthys Campaign

Malware (4)

ClickFix
LummaC2
Rhadamanthys
Stego Loader

Affected Platform (2)

MacOS
Windows

Tool (4)

Donut
Mshta
Mshta.exe
PowerShell

Relationships

ClickFix Attack uses ClickFix
ClickFix Attack uses LummaC2
ClickFix Attack uses Rhadamanthys
ClickFix Attack uses Stego Loader
ClickFix Malware Campaign uses ClickFix
ClickFix Malware Campaign uses LummaC2
ClickFix Malware Campaign uses Rhadamanthys
ClickFix Malware Campaign uses Stego Loader
Operation Endgame uses ClickFix
Operation Endgame uses LummaC2
Operation Endgame uses Rhadamanthys
Operation Endgame uses Stego Loader
Rhadamanthys Campaign uses ClickFix
Rhadamanthys Campaign uses LummaC2
Rhadamanthys Campaign uses Rhadamanthys
Rhadamanthys Campaign uses Stego Loader
Malware targets MacOS
Malware targets Windows
Phishing targets MacOS
Phishing targets Windows
Steganography targets MacOS
Steganography targets Windows
T1027 - Steganography targets MacOS
T1027 - Steganography targets Windows
T1055 - Process Injection targets MacOS
T1055 - Process Injection targets Windows
T1059.001 - PowerShell targets MacOS
T1059.001 - PowerShell targets Windows
T1059 - Command and Scripting Interpreter targets MacOS
T1059 - Command and Scripting Interpreter targets Windows
T1218.005 - Mshta targets MacOS
T1218.005 - Mshta targets Windows
ClickFix Attack related to Donut
ClickFix Attack related to Mshta
ClickFix Attack related to Mshta.exe
ClickFix Attack related to PowerShell

Following this threat?

Track ClickFix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Active Exploitation of Siemens Software Center Vulnerability in ClickFix Campaign Siemens has confirmed that a DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center is actively being exploited in malware attacks. The vulnerability allows attackers to execute malicious code by placing a specially crafted DLL in a directory searched by the application. Siemens first disclosed…

Cybercriminals Exploit ChatGPT Custom GPTs for ClickFix RAT Attacks A new ClickFix campaign has been discovered that exploits ChatGPT Custom GPTs to impersonate legitimate products, luring users into executing malicious code. Cybersecurity firm Huntress reported that at least 40 users have been infected, with two confirmed incidents linked to Custom GPT instances. The attackers…