ThreatCluster

New 'Executive Award' Campaign Delivers Stealerium Malware via ClickFix

First seen 3 Dec 2025, 11:41 UTC • •41

Article Content

1 / 4

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

A new campaign named 'Executive Award' is exploiting ClickFix to distribute Stealerium malware. This malware targets users by masquerading as a legitimate award notification, potentially compromising sensitive information. Organizations and individuals who engage with these fraudulent communications are at risk of malware infection.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 193d ago How this analysis works

More articles in this cluster (3)

Threat Graph

8 entities, 9 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (3)

Malware
Phishing
T1566 - Phishing

Campaign (3)

ClickFix Stealerium Malware Campaign
Executive Award
Stealerium Malware Campaign

Malware (2)

Stealerium
ClickFix

Relationships

ClickFix Stealerium Malware Campaign uses Stealerium
ClickFix Stealerium Malware Campaign uses ClickFix
Executive Award uses Stealerium
Executive Award uses ClickFix
Stealerium Malware Campaign uses Stealerium
Stealerium Malware Campaign uses ClickFix
ClickFix Stealerium Malware Campaign related to Malware
ClickFix Stealerium Malware Campaign related to Phishing
ClickFix Stealerium Malware Campaign related to T1566 - Phishing

Following this threat?

Track Stealerium in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Critical WSO2 API Manager Vulnerability Under Active Exploitation A critical vulnerability (CVE-2026-5430) in WSO2 API Manager is being actively exploited, allowing unauthenticated attackers to forge admin tokens via JWT authentication bypass. This flaw, which has a CVSS score of 10.0, affects multiple WSO2 products including API Manager, Universal Gateway, Traffic Manager, and API…

Critical Linux Kernel Vulnerability CVE-2025-39682 Under Active Exploitation A critical vulnerability (CVE-2025-39682) in the Linux kernel allows remote code execution through mishandling of zero-length TLS records. This flaw affects kTLS-enabled hosts running vulnerable kernel versions, exposing them to attackers without authentication. CISA added this vulnerability to its Known Exploited…