# ClickFix

Published articles for ClickFix.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Atomic macOS (AMOS) Stealer Activity

DevFeed: [Atomic macOS (AMOS) Stealer Activity](<https://devfeed.tech/articles/atomic-macos-amos-stealer-activity-30906.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/>)

Author: Bradley Duncan

Published: 2026-09-16T10:00:06Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Aeternum](<https://devfeed.tech/topics/aeternum.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [sensitive data](<https://devfeed.tech/topics/sensitive-data.md>), [Zsh](<https://devfeed.tech/topics/zsh.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [cURL](<https://devfeed.tech/topics/curl.md>)

Tags: [ads](<https://devfeed.tech/tags/ads.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [curl](<https://devfeed.tech/tags/curl.md>), [general](<https://devfeed.tech/tags/general.md>), [insights](<https://devfeed.tech/tags/insights.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sensitive-data](<https://devfeed.tech/tags/sensitive-data.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [unit-42](<https://devfeed.tech/tags/unit-42.md>), [zsh](<https://devfeed.tech/tags/zsh.md>)

### AI overview

This article analyzes a laboratory-generated Atomic macOS (AMOS) stealer infection observed on Aug. 5, 2026. It describes a deceptive macOS toolkit installation page that led users to paste a command into Terminal, retrieving a Zsh script containing an encoded compressed payload and a follow-up script designed to run a Mach-O binary. AMOS targets macOS and can exfiltrate system information, login credentials, and sensitive data from applications including browsers and cryptocurrency wallets.

### Source excerpt

Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.

## HBO Max's verified Reddit account hijacked to spread malware

DevFeed: [HBO Max's verified Reddit account hijacked to spread malware](<https://devfeed.tech/articles/hbo-max-s-verified-reddit-account-hijacked-to-spread-malware-26612.md>)

Original publisher: [Read original article](<https://www.malwarebytes.com/blog/news/2026/09/hbo-maxs-verified-reddit-account-hijacked-to-spread-malware>)

Author: Pieter Arntz

Published: 2026-09-15T11:51:03Z

Content type: news

Language: en

Sources: [Malwarebytes](<https://devfeed.tech/sources/malwarebytes.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [Reddit](<https://devfeed.tech/topics/reddit.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [passwords](<https://devfeed.tech/topics/passwords.md>), [Cryptocurrency](<https://devfeed.tech/topics/cryptocurrency.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [clickfix](<https://devfeed.tech/tags/clickfix.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [hbo-max](<https://devfeed.tech/tags/hbo-max.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [news](<https://devfeed.tech/tags/news.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [pasteswitch](<https://devfeed.tech/tags/pasteswitch.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [reddit](<https://devfeed.tech/tags/reddit.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [terminal](<https://devfeed.tech/tags/terminal.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Cybercriminals hijacked HBO Max's verified Reddit account and used it to run 108 malicious ads over about 48 hours. The ads promoted fake software and used ClickFix-style instructions to distribute infostealers and cryptocurrency clipboard hijackers to macOS and Windows users.

### Source excerpt

Cybercriminals used HBO Max's verified Reddit account to run 108 malicious ads that tricked people into installing information stealers.

## HBO Max Reddit account compromised to serve ClickFix attacks

DevFeed: [HBO Max Reddit account compromised to serve ClickFix attacks](<https://devfeed.tech/articles/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks-21627.md>)

Original publisher: [Read original article](<https://www.theregister.com/cyber-crime/2026/09/14/hbo-max-reddit-account-compromised-to-serve-clickfix-attacks/5296408>)

Author: Jessica Lyons

Published: 2026-09-14T22:43:01Z

Content type: news

Language: en

Sources: [www.theregister.com - Articles](<https://devfeed.tech/sources/www-theregister-com-articles.md>)

Topics: [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Reddit](<https://devfeed.tech/topics/reddit.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [Windows](<https://devfeed.tech/topics/windows.md>)

Tags: [clickfix](<https://devfeed.tech/tags/clickfix.md>), [cyber-crime](<https://devfeed.tech/tags/cyber-crime.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [hbo-max](<https://devfeed.tech/tags/hbo-max.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [reddit](<https://devfeed.tech/tags/reddit.md>), [security](<https://devfeed.tech/tags/security.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

The article reports that an HBO Max Reddit account was compromised and used to serve ClickFix attacks in a massive 48-hour malvertising campaign targeting macOS and Windows machines with malware.

### Source excerpt

Part of a 'massive 48-hour malvertising blitz' targeting macOS and Windows machines with malware

## TerminalFix campaign deploys a reverse tunnel through multistage intrusion

DevFeed: [TerminalFix campaign deploys a reverse tunnel through multistage intrusion](<https://devfeed.tech/articles/terminalfix-campaign-deploys-a-reverse-tunnel-through-multistage-intrusion-7636.md>)

Original publisher: [Read original article](<https://www.microsoft.com/en-us/security/blog/2026/08/28/terminalfix-campaign-deploys-reverse-tunnel-through-multistage-intrusion/>)

Author: Microsoft Security Research, Sagar Patil, Suriyaraj Natarajan and Parasharan Raghavan

Published: 2026-08-29T03:43:27Z

Content type: article

Language: en

Sources: [Microsoft Security Blog](<https://devfeed.tech/sources/microsoft-security-blog.md>)

Topics: [High Profile Threats](<https://devfeed.tech/topics/high-profile-threats.md>)

Tags: [analysis](<https://devfeed.tech/tags/analysis.md>), [c2](<https://devfeed.tech/tags/c2.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [cloudflare](<https://devfeed.tech/tags/cloudflare.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [powershell](<https://devfeed.tech/tags/powershell.md>), [python](<https://devfeed.tech/tags/python.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [security](<https://devfeed.tech/tags/security.md>), [windows](<https://devfeed.tech/tags/windows.md>)

### AI overview

Microsoft analyzes the TerminalFix ClickFix campaign, which uses a fake Cloudflare CAPTCHA to induce PowerShell execution and deploys a multi-stage intrusion chain. The chain includes DLL sideloading, steganographic payload delivery, Active Directory reconnaissance, persistence, and an encrypted reverse tunnel that can provide access into the compromised network.

### Source excerpt

Microsoft Threat Intelligence provides analysis of a ClickFix campaign that uses fake CAPTCHA prompts, DLL sideloading, and a reverse tunnel, with detections and hunting guidance. The post TerminalFix campaign deploys a reverse tunnel through multistage intrusion appeared first on Microsoft Security Blog.

## ESET Threat Report H1 2026

DevFeed: [ESET Threat Report H1 2026](<https://devfeed.tech/articles/eset-threat-report-h1-2026-8365.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/eset-threat-report-h1-2026/>)

Author: Jiří Kropáč

Published: 2026-07-08T08:45:00Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [ESET research](<https://devfeed.tech/topics/eset-research.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Generative AI](<https://devfeed.tech/topics/generative-ai.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [Android](<https://devfeed.tech/topics/android.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [QR Code](<https://devfeed.tech/topics/qrcode.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Social engineering](<https://devfeed.tech/topics/social-engineering.md>), [Endpoint Security & XDR](<https://devfeed.tech/topics/endpoint-security-xdr.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [android](<https://devfeed.tech/tags/android.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [code](<https://devfeed.tech/tags/code.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [generative-ai](<https://devfeed.tech/tags/generative-ai.md>), [malware](<https://devfeed.tech/tags/malware.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [threat-report](<https://devfeed.tech/tags/threat-report.md>)

### AI overview

ESET's H1 2026 threat report describes attackers adapting established techniques across new platforms and behaviors. It highlights the expanding abuse of AI skills, PromptSpy Android malware using Google Gemini, the spread of ClickFix and QR-code phishing, and continued ransomware activity involving EDR killers.

### Source excerpt

A view of the H1 2026 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts.

## Security Week 2609: новые варианты атак ClickFix

DevFeed: [Security Week 2609: новые варианты атак ClickFix](<https://devfeed.tech/articles/security-week-2609-clickfix-23057.md>)

Original publisher: [Read original article](<https://habr.com/ru/companies/kaspersky/articles/1002934/>)

Author: Kaspersky\_Lab ("Лаборатория Касперского")

Published: 2026-02-24T15:15:01Z

Content type: news

Language: ru

Sources: ["Лаборатория Касперского" RU](<https://devfeed.tech/sources/ru-2.md>)

Topics: [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [Security](<https://devfeed.tech/topics/security.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>)

Tags: [bitcoin](<https://devfeed.tech/tags/bitcoin.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [dns](<https://devfeed.tech/tags/dns.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [microsoft](<https://devfeed.tech/tags/microsoft.md>), [nslookup](<https://devfeed.tech/tags/nslookup.md>), [security](<https://devfeed.tech/tags/security.md>), [tag-9fe8963de219](<https://devfeed.tech/tags/tag-9fe8963de219.md>), [zip](<https://devfeed.tech/tags/zip.md>)

### AI overview

The article reviews two recent ClickFix attack studies. One variant uses nslookup to retrieve part of a malicious script from a controlled DNS server, downloads a ZIP archive, and installs ModeloRAT through VBS persistence. Another uses social engineering and JavaScript pasted into the Swapzone.io browser interface to replace Bitcoin wallet addresses and divert cryptocurrency.

### Source excerpt

На прошлой неделе опубликовано сразу два новых исследования об атаках типа ClickFix, в которых пользователя так или иначе мотивируют самостоятельно выполнять вредоносный код в командной строке. Команда Microsoft Threat Intelligence поделилась чуть более сложным, чем обычно, вариантом атаки, продемонстрированном на скриншоте ниже. Как правило, команда, которую злоумышленники заставляют запустить, содержит адрес, с которого загружается и выполняется вредоносный скрипт. Вероятно, для того чтобы усложнить детектирование атаки в корпоративном окружении и продлить жизнь вредоносной инфраструктуре, в этот простой сценарий вставлен еще один шаг: обращение к контролируемому DNS-серверу. От имени пользователя происходит обращение к DNS-серверу c использованием утилиты nslookup, запрашиваются данные для домена example.com. Из полученных в ответ данных выделяется строка NAME:, которая и содержит вторую часть вредоносного скрипта. Он, в свою очередь, напрямую скачивает ZIP-архив с набором вредоносных программ. На финальной стадии один из VBS-скриптов прописывается в автозапуск и на компьютер жертвы устанавливается троянская программа ModeloRAT. Это далеко не самый изощренный вариант атаки ClickFix. Ранее та же Microsoft сообщала о нетривиальной тактике, предусматривающей намеренное выведение из строя браузера путем установки вредоносного расширения под видом адблокера. Читать далее

## Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan

DevFeed: [Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan](<https://devfeed.tech/articles/love-actually-fake-dating-app-used-as-lure-in-targeted-spyware-campaign-in-pakistan-8375.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/love-actually-fake-dating-app-used-lure-targeted-spyware-campaign-pakistan/>)

Author: Lukas Stefanko

Published: 2026-01-28T09:59:00Z

Content type: news

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [App](<https://devfeed.tech/topics/app.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [android](<https://devfeed.tech/tags/android.md>), [app](<https://devfeed.tech/tags/app.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [data](<https://devfeed.tech/tags/data.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [monitor](<https://devfeed.tech/tags/monitor.md>), [pakistan](<https://devfeed.tech/tags/pakistan.md>), [scam](<https://devfeed.tech/tags/scam.md>), [social-engineering](<https://devfeed.tech/tags/social-engineering.md>), [whatsapp](<https://devfeed.tech/tags/whatsapp.md>)

### AI overview

ESET describes GhostChat, an Android spyware app that poses as a dating chat platform to target people in Pakistan. Its hardcoded profile passcodes create a false sense of exclusivity while the app surveils devices and exfiltrates data; the investigation also links the activity to ClickFix and WhatsApp account-compromise attacks.

### Source excerpt

ESET researchers discover an Android spyware campaign targeting users in Pakistan via romance scam tactics, revealing links to a broader spy operation

## ESET Threat Report H2 2025

DevFeed: [ESET Threat Report H2 2025](<https://devfeed.tech/articles/eset-threat-report-h2-2025-8366.md>)

Original publisher: [Read original article](<https://www.welivesecurity.com/en/eset-research/eset-threat-report-h2-2025/>)

Author: Jiří Kropáč

Published: 2025-12-16T09:50:45Z

Content type: article

Language: en

Sources: [WeLiveSecurity](<https://devfeed.tech/sources/welivesecurity.md>)

Topics: [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [ESET research](<https://devfeed.tech/topics/eset-research.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>), [Android](<https://devfeed.tech/topics/android.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [ai](<https://devfeed.tech/tags/ai.md>), [android](<https://devfeed.tech/tags/android.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [eset-research](<https://devfeed.tech/tags/eset-research.md>), [malware](<https://devfeed.tech/tags/malware.md>), [nfc](<https://devfeed.tech/tags/nfc.md>), [ransomware](<https://devfeed.tech/tags/ransomware.md>), [research](<https://devfeed.tech/tags/research.md>), [threat-detection](<https://devfeed.tech/tags/threat-detection.md>), [threat-report](<https://devfeed.tech/tags/threat-report.md>)

### AI overview

ESET's H2 2025 threat report describes rapid changes in the threat landscape, including the emergence of AI-driven malware such as PromptLock, major shifts in malware distribution, growth in ransomware activity, and increasingly sophisticated Android NFC threats.

### Source excerpt

A view of the H2 2025 threat landscape as seen by ESET telemetry and from the perspective of ESET threat detection and research experts