ClickFix Attacks — Campaign Analysis & Threat Activity

Threat entity extracted from intelligence sources

Frequency
4
occurrences
First Seen
November 12, 2025
Last Seen
May 25, 2026

Related Threat Clusters

  • Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign

    A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS is being actively exploited in a large-scale cyberattack affecting over 700 websites, including those of Harvard University, Oxford University, Auburn…

    17 articles · Updated May 25, 2026
  • New ClickFix Attacks Target macOS Users via ChatGPT Exploit

    A malicious campaign is targeting macOS users by exploiting the official ChatGPT website. Attackers are utilizing a ClickFix technique to distribute the AMOS infostealer through fake installation guides on chatgpt.com.…

    2 articles · Updated December 11, 2025
  • Revival of Finger Command in ClickFix Malware Attacks

    Threat actors are exploiting the decades-old 'finger' command in new ClickFix malware attacks to execute remote commands on Windows devices. The command, which was historically used to retrieve user information on Unix…

    4 articles · Updated November 17, 2025
  • Rise of AI-Driven Ransomware: ESET Reports on PromptLock

    ESET's Threat Report for H2 2025 reveals the emergence of AI-driven malware, specifically PromptLock, the first known AI-driven ransomware capable of generating malicious scripts in real-time. This development marks a…

    2 articles · Updated December 16, 2025
  • Sophisticated ClickFix Attacks Target macOS and Windows Users

    Researchers at Push Security report an increase in ClickFix attacks, particularly targeting macOS users with tailored prompts. These social engineering attacks trick victims into executing malicious commands on their…

    2 articles · Updated November 12, 2025

Recent Intelligence Reports

  • Ghost CMS CVE-2026-26980 Exploited to Hijack 700+ Sites for ClickFix Attacks — Thehackernews · May 25, 2026
  • ESET Threat Report H2 2025 — Feeds.Feedburner · December 16, 2025
  • New ClickFix Attacks as macOS Infostealer Leverages Official ChatGPT Website by Piggybacking — Cybersecuritynews · December 11, 2025
  • Warning: ClickFix Attacks are Growing More Sophisticated — Blog.Knowbe4 · November 12, 2025

CVSS v3.1 Breakdown