How the Phexia macOS infostealer spreads via ClickFix, hides C2 in Polygon smart contracts, and how to detect and remove it. Includes IOCs and MITRE mapping.

Huntress announced Defense Drill Interventions, which pairs Managed EDR Attack Disruption with just-in-time ClickFix training after a blocked attempt. The…

「ClickFix」と呼ばれる、偽の画面を表示してコマンドを実行させる攻撃がいくつかのサイトで確認されました。不正アクセスを受けた正規のウェブサイトで確認されているため注意が必要です。

🔍 Contexte : Analyse publiée le 3 novembre 2026 par Kirk (Ohey) sur le kit ClickFix baptisé ClockTail, actif du 28 juillet au 3 novembre 2026 sur 245 hôtes (176 noms de domaine et 69 adresses IP). ⚙️ Fonctionnement : ClockTail est une page HTML sauvegardée de Google Merchant Center ("Promote Your Business with Merchant Center"), enregistrée depuis le compte Gmail jovevkystaxsilverv@gmail.com.

ハッカーがClickFix攻撃を使い、macOS向けのモジュール型バックドア「Phexia」をインストールさせています。Phexiaはパスワードを盗み、ブラウザーのデータを収集し、暗号資産のマイナーを展開します。 WithSecureの調査によると、この商用販売されているマルウェアは、少なくとも2025年後半から複数

Push Security found a Google search ad for 'claude mac' that used a Bing redirect and a compromised WordPress site to send users to a fake Claude download page (claude-desk-code[.]com). The page shows Anthropic's real install command but copies a different malicious command to the clipboard…

thedfirreport.com

Blackpoint’s APG discovered Variola, a previously unclassified modular Windows implant delivered through ClickFix, with encrypted C2, persistent state, and browser-targeting capabilities.

Gekaperter Reddit-Account verbreitet 108 Schadsoftware-Anzeigen in 48 Stunden.

Introduction: Cybersecurity Defense Shifts Toward Continuous Attack Disruption and User Awareness Cybersecurity threats are increasingly exploiting two critical weaknesses in enterprise environments: insufficient endpoint protection and human interaction with malicious instructions. As attackers refine their social engineering techniques and expand their post-exploitation infrastructure, security companies are developing strategies that combine automated threat disruption with employee education. Two recent cybersecurity developments highlight this evolving landscape.

Introduction: Four Cybersecurity Stories Highlight an Evolving Threat Landscape A new cybersecurity news roundup discussed in a Dark Reading episode highlights several developments spanning phishing awareness, government data exposure, alleged foreign intelligence operations, and enterprise endpoint defense. The stories include criticism surrounding the New York Knicks' championship-ring-themed phishing simulation, an investigation into DDoSecrets' publication of a dataset allegedly containing Department of Homeland Security (DHS) employee information, reports of a Chinese intelligence asset allegedly targeting NVIDIA CEO Jensen Huang, and a new defensive initiative announced by Huntress to combat ClickFix social engineering attacks.

Phexia macOS malware uses ClickFix scams to steal passwords, browser data, and keychain files through malicious Terminal commands.

Νέα εκστρατεία ClickFix χρησιμοποιεί ψεύτικες σελίδες επαλήθευσης Cloudflare για να ξεγελάσει τους χρήστες Windows και Mac ώστε να εγκαταστήσουν κακόβουλο λογισμικό.

In this Soap Box episode Patrick Gray chats to Push Security co-founder and CEO Adam Bateman about the benefits of taking a browser-centric approach to security. By now most Risky Business listeners know that Push sells a browser extension-based product that can reliably prevent phishing, ClickFix and ConsentFix. But what’s next? Where to from here once you’re already in the browser? Well, Push is expanding into the data loss prevention and secure web gateway product space. Why use a SWG based on 15-year-old technology when an extension can give you an even better security result? Especially when you can drop the drawbacks, like tromboning all your traffic into a random data centre… This episode is also available on YouTube.