ClickFix Campaigns Distribute Multiple Malware Families

Active since late 2025, the 'ClickFix' campaign has evolved to leverage sophisticated social engineering through fake Google reCAPTCHA and Cloudflare verification pages. The attack relies on human interaction, specifically coercing users to copy and paste malicious PowerShell commands into their terminals under the guise of technical troubleshooting or identity verification. Recent analysis reveals a diverse payload ecosystem including StealC, Remus, and a previously undocumented .NET NativeAOT loader dubbed 'ResiLoader'.

The technical workflow often involves trojanized legitimate applications, such as the messaging app Franz, and utilizes Cloudflare R2 buckets for payload delivery. ResiLoader distinguishes itself by using a Bring Your Own Driver (BYOD) technique—specifically leveraging a vulnerable OPSWAT AppRemover driver—to terminate security software and facilitate process hollowing of ServiceModelReg.exe for stealer deployment.

These campaigns represent a significant threat to corporate environments due to their reliance on user-initiated execution (T1204.003), which often bypasses traditional perimeter defenses. The attackers' ability to repurpose expired domains and compromise legitimate Cloudflare Pages subdomains makes simple URL filtering insufficient for protection.