A new wave of ClickFix social-engineering attacks is tricking users into running dangerous commands by showing realistic full-screen Windows Update animations or fake human-verification pages.
Once the victim follows instructions (usually pasting commands into Command Prompt), malware silently deploys.
🔍 What’s new in this wave?
• Hackers hide malware inside PNG image pixels using steganography 🎨
• Victims see a fake “Critical Windows Security Update” prompt
• JavaScript secretly copies malicious commands to the clipboard
• Attackers drop LummaC2 and Rhadamanthys infostealers
• Malware is reconstructed in memory using multi-stage PowerShell + .NET loaders
• Variants use a “ctrampoline” evasion method (10k empty function calls)
• Even after Operation Endgame disrupted Rhadamanthys' infrastructure, the fake domains remain active
💣 Why ClickFix is so dangerous
Because users manually execute the commands, the attack bypasses many security tools.
This is why ClickFix has become a favorite method for both low-skill criminals and advanced threat actors.
🛡 How to stay safe
✔ Never paste “verification” or “update” commands into CMD/PowerShell
✔ Disable Windows Run box if not needed
✔ Monitor for suspicious process chains (e.g., explorer.exe → mshta.exe)
✔ During investigations, check the RunMRU registry entries
⚠️ Stay alert — these campaigns are spreading fast.
