Hijacked Hotel Wi-Fi Serves Fake Updates to Deploy CornFlake RAT in CaptiveCrunch Campaign
Microsoft has disclosed a cyber espionage campaign, tracked as CaptiveCrunch, that abuses hijacked hotel Wi-Fi captive portals to deliver a remote access…
Tag: ClickFix
ChocoShell (CHERRYPIE): PowerShell Infostealer with LLM-Generated Code
ChocoShell, also known as CHERRYPIE, is a PowerShell-based infostealer delivered via ClickFix lures. It steals browser session cookies, saved passwords, Microsoft 365…
DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware
Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake…
BlueNoroff Zoom Phishing Kit Profiles Crypto Wallets Before Malware Delivery
The North Korean threat actors behind the ClickFix-style campaigns that employ typosquatted Zoom and Microsoft Teams domains have been found to operate…
ClickFake Interview: North Korea-Aligned Threat Cluster
ClickFake Interview is a threat cluster tracked by Sekoia, associated with North Korea-aligned actors. It uses ClickFix-like lures to deceive targets into…
Golden Chickens Resurfaces With Four New Malware Families and Modular Implants
The threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem have resurfaced with four new malware families, indicating that the operators are…
TAG-127: Operator and Customer of TAG-195 Tooling
TAG-127 is an operator and customer of TAG-195's MaaS tooling. It has been observed deploying TinyEgg via ClickFix-style social engineering campaigns and…
TinyEgg: Lightweight Initial-Access Backdoor
TinyEgg is a lightweight initial-access backdoor that provides host profiling, interactive shell access, and persistence management. It is deployed via ClickFix social…
UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware
Russian state-sponsored threat actors from the UAC-0145 sub-cluster, linked to Sandworm and GRU, are using fake CAPTCHA checks on compromised websites to…
GHETTOVIBE: VBS File Dropped via ClickFix
GHETTOVIBE is a VBS file saved in the Startup autorun directory, delivered through fake CAPTCHA checks in the UAC-0145 campaign targeting Ukrainian…