Browse public community intelligence reports, source analysis, and threat research.
19 intel reports
The TAG-195 threat group is using the ChonkyChicken RAT and ChromEggscalator helper to bypass Chrome App-Bound encryption and hijack authenticated browser sessions via the ClickFix social engineering technique.
TELEPUZ is a full-featured modular malware spreading through CLICKFIX social engineering and VIDAR stealer, featuring advanced evasion and dead-drop resolver techniques.
ClickFix campaigns utilize fake Google and Cloudflare verification pages to trick users into executing PowerShell commands that deliver loaders like ResiLoader and various stealers.
The REF6045 activity cluster uses ClickFix social engineering to deploy SCMBANKER, a PowerShell toolkit designed for banking fraud targeting Mexican financial institutions.
Rapid Brigantine and other cybercrime clusters are utilizing ClickFix social engineering to deploy modular loaders and backdoors including Potemkin, RMMProject, BabaDeda, and Lorem Ipsum.
An unidentified threat actor used ClickFix social engineering to deploy Potemkin Loader and RMMProject, moving laterally via SMBExec to distribute EtherRAT across 11 hosts.
A new macOS ClickFix campaign uses social engineering to trick users into running Terminal commands that silently mount DMGs and execute the Atomic macOS Stealer (AMOS).
A campaign using Amazon-themed phishing and ClickFix social engineering to deliver the HarborWatch Agent RAT, managed via the Harbor Sentinel Chinese-language admin panel.
A widespread initial access campaign using fraudulent human-verification prompts to trick victims into executing malicious commands via native system tools.
