Bleepingcomputer ClickFix Malware Campaign Uses Fake Windows Updates to Deploy Infostealers
Article Content
Browse articles 
A new wave of ClickFix attacks is utilizing fake Windows Update screens to deceive users into executing malicious commands that install infostealing malware. These attacks employ steganography to hide malware within PNG images, making them harder to detect. Organizations across the U.S., EMEA, and Asia-Pacific regions have been targeted since late September 2025.
Ask AI about this cluster
Answers cite the sources they use
Updated 228d ago How this analysis works
More articles in this cluster (24)
Following this threat?
Track ClickFix in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Active Exploitation of Siemens Software Center Vulnerability in ClickFix Campaign Siemens has confirmed that a DLL side-loading vulnerability (CVE-2026-110936) in Siemens Software Center is actively being exploited in malware attacks. The vulnerability allows attackers to execute malicious code by placing a specially crafted DLL in a directory searched by the application. Siemens first disclosed… 
Cybercriminals Exploit ChatGPT Custom GPTs for ClickFix RAT Attacks A new ClickFix campaign has been discovered that exploits ChatGPT Custom GPTs to impersonate legitimate products, luring users into executing malicious code. Cybersecurity firm Huntress reported that at least 40 users have been infected, with two confirmed incidents linked to Custom GPT instances. The attackers…