Executive Summary
Insikt Group has identified five distinct activity clusters utilizing the 'ClickFix' technique, a social engineering method that bypasses browser security by manipulating users into manually executing malicious, obfuscated code. Since May 2024, these campaigns have evolved from simple fake updates to sophisticated lures impersonating brands like Intuit QuickBooks, Booking.com, and Birdeye. The technique relies on a living-off-the-land (LotL) approach, leveraging native utilities such as the Windows Run dialog box and macOS Terminal to execute scripts in-memory, minimizing forensic footprints. This methodology has been adopted by a wide range of actors, from cybercriminal 'traffers' to APT groups like BlueDelta (APT28) and PurpleBravo, primarily for delivering infostealers and Remote Access Trojans (RATs).