Russian Calisto Hackers Target NATO Research with ClickFix Malware

First seen 5 Dec 2025, 13:44 UTC • Gbhackers

•27

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Russian Calisto hackers have launched a campaign targeting NATO research sectors using ClickFix malicious code. This sophisticated phishing attack employs new infection methods, including AiTM tactics, to compromise systems within these critical sectors.

How this analysis works

Attack Flow

7 entities, 12 inferred relationships (STIX 2.1).

Threat Actor (2)

Calisto
Calisto Hackers

Technique (2)

Malware
Phishing

Organization (2)

NATO
NATO Research

Malware (1)

ClickFix

Relationships

Calisto uses ClickFix
Calisto Hackers uses ClickFix
Calisto uses Malware
Calisto uses Phishing
Calisto Hackers uses Malware
Calisto Hackers uses Phishing
Calisto targets NATO
Calisto targets NATO Research
Calisto Hackers targets NATO
Calisto Hackers targets NATO Research
ClickFix targets NATO
ClickFix targets NATO Research

Continue Reading

Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants Rapid7 Reports Surge in Vulnerability Exploitation Outpacing Patching Efforts ACSC Issues Critical Alert on Exploited CMS Vulnerabilities Cybercriminals Exploit BNB Chain for Malware via Fake CAPTCHAs

Russian Calisto Hackers Target NATO Research with ClickFix Malware

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading