ClickFix Initial Access Activity

Kaung Khant Ko@kaungkhantko

•updated Jul 14, 2025•1•32

Detects various initial access TTPs associated with the "ClickFix" attack vector, where users are tricked into running malicious commands. This includes behaviors observed in Lumma Stealer, Latrodectus, and NetSupport RAT campaigns.