ClickFix

Google Strengthens Chrome Defenses Against ClickFix Clipboard-Based Scams

Google has updated Chrome to detect and warn users about malicious commands copied to the clipboard as part of ClickFix attacks. These scams trick users into pasting harmful scripts into system tools such as PowerShell under the guise of fixing errors or providing tech support. The new protections activate when Enhanced Protection in Safe Browsing is enabled and send suspicious commands for analysis after removing personal data. Google has also shifted scam page detection from a local Gemini model to a server-side implementation to improve accuracy against fake tech support, antivirus, and browser update sites. The changes make it harder for attackers to bypass browser download checks by abusing clipboard and system console execution. Official details were published in the Google Security Blog.

Scammers Abuse Custom GPT on ChatGPT.com to Deploy Windows RAT via ClickFix Technique

Researchers at Huntress uncovered a phishing campaign that leveraged a custom GPT named Plus 5.6 hosted directly on the official ChatGPT.com domain. Victims searching for ChatGPT were directed to the malicious GPT through sponsored Google results, where the bot instructed them to visit a backup domain due to alleged service issues. The link led to a Google Sites page mimicking a Cloudflare security check that triggered the ClickFix social engineering tactic. Users were prompted to copy and execute a command in Windows, initiating a multi-stage infection with a remote access trojan capable of full system control, file access, screen viewing, and camera or microphone activation. Huntress confirmed at least 40 incidents tied to the campaign, though only two infections were directly traced to the malicious GPT. The first GPT was removed on September 25 after notification, but a replacement linked to the same operation appeared by September 27.

EtherHiding Campaign Hides Banking Trojan C2 in Polygon Smart Contracts

Security researchers have detailed the EtherHiding campaign, which conceals command-and-control infrastructure inside smart contracts on the Polygon blockchain. The final payload is a malicious browser extension that functions as a banking trojan, intercepting credentials and two-factor codes from approximately 479 financial and cryptocurrency websites. Instead of embedding fixed addresses in its code, the malware queries an encrypted C2 server address from the smart contract, allowing operators to change destinations through low-cost blockchain transactions that bypass domain blocking. Infection begins when victims visit one of 31 compromised legitimate sites that inject JavaScript displaying a fake CAPTCHA prompt. The prompt instructs users to press Windows+R and execute a PowerShell command, a social engineering technique known as ClickFix that downloads the malicious scripts without exploiting any software vulnerability. The campaign has remained active from November 2025 through at least September 2026, demonstrating the resilience of blockchain-based infrastructure against traditional takedown methods.

Attackers Abuse Legitimate Node.js Runtime to Deploy Persistent Malware in Targeted Operations

Cybercriminals are increasingly misusing the legitimate Node.js runtime to execute malicious JavaScript scripts and maintain persistence on corporate networks. The technique has been observed since February 2026 against governments, technology firms, hotels, and financial organizations. Attackers favor the signed node.exe binary to evade signature-based detections after initial access via ClickFix social engineering. In one case against an Asian technology company, Node.js was deployed following blocked attempts to install AdaptixC2 and Cobalt Strike. The resulting implant establishes registry persistence and communicates with Ethereum blockchain gateways to retrieve commands hidden in smart contracts. The approach has been linked to multiple tools including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer, with some campaigns attributed to the initial-access broker Woodgnat, also known as KongTuke.

ClickLock Stealer Locks macOS Until Victims Enter Real Passwords and Exfiltrates Browser, Crypto and Keychain Data

Researchers at Group-IB have discovered a new macOS infostealer called ClickLock that blocks normal computer operation until the user supplies valid account credentials. The campaign, active since May 2026, has already affected at least 100 victims across 33 countries. Infection begins with a fake Cloudflare verification page that tricks users into pasting a command into Terminal, after which the malware silently downloads four modules from compromised WordPress sites. A convincing macOS password prompt then appears; ClickLock validates the entered password locally and only forwards working credentials to the operators. Two persistent LaunchAgent modules repeatedly close all visible applications and force Keychain authorization, while a separate process disables Notification Center for several hours. The malware harvests data from eight browsers, 31 crypto-wallet extensions, seven password managers, eight desktop wallets, Keychain items, command history, FTP credentials and six blockchain addresses before exfiltrating everything via Telegram bots and hijacked domains, leaving behind a disguised GSocket backdoor.

TELEPUZ Malware Spreads via ClickFix Social Engineering, Targets Windows with Modular Capabilities and Resilient C2 Infrastructure

Since late April 2026, compromised websites have been distributing the new modular malware TELEPUZ through the ClickFix scheme. Attackers replace standard browser error fixes with instructions that trick users into pasting and executing a PowerShell command from the clipboard, which then downloads an intermediate loader, the Vidar infostealer, and finally TELEPUZ via rundll32.exe. The malware performs extensive environment checks to avoid sandboxes and debuggers before disabling Windows security features, escalating privileges, and persisting as a service inside svchost.exe. For command-and-control, TELEPUZ relies on WebSocket connections with multiple fallback mechanisms, including encrypted links stored in Telegram profiles, Steam accounts, DNS records, and a Polygon smart contract. It offers a wide range of capabilities such as file manipulation, keylogging, screenshot capture, process management, cookie theft from Chromium browsers, and arbitrary JavaScript execution in both Chromium and Firefox. Researchers at Elastic assess TELEPUZ as a malware-as-a-service offering still in early development, evidenced by a limited number of C2 domains yet frequent daily builds and rapid updates hosted on compromised sites in Brazil and India.