Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

Introduction: Cybercriminals are constantly refining social engineering techniques to bypass traditional security controls. The IClickFix campaign now employs a deceptive fake CAPTCHA that instructs victims to copy and execute a crafted SSH command, disabling strict host key checking and suppressing errors to establish a covert connection to a malicious server (91.92.33.149) which then delivers a PowerShell payload that downloads NetSupport RAT, granting attackers remote access to compromised systems.

WordPressサイト群を大規模に改ざんする攻撃基盤IClickFixが見つかった。偽の認証画面で利用者にコマンドを実行させ、遠隔操作ツール「NetSupport RAT」に感染させるという。被害は3800以上のWebサイト、82カ国に及んでいる。

<img src="https://blog.sekoia.io/wp-content/uploads/2026/01/iclickfix_featured_image-scaled.png" /><br /> Uncover IClickFix: a malicious framework exploiting the ClickFix tactic in widespread malware campaigns to deliver NetSupport RAT.

IClickFix malware hijacks 3,800+ WordPress sites with fake Cloudflare CAPTCHAs. This watering hole attack tricks users into running malicious PowerShell.

WordPressサイト群を大規模に改ざんする攻撃基盤IClickFixが見つかった。偽の認証画面で利用者にコマンドを実行させ、遠隔操作ツール「NetSupport RAT」に感染させるという。被害は3800以上のWebサイト、82カ国に及んでいる。