Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

ClickFix fake CAPTCHA and browser-update campaign

Campaign
First reported
Last updated
Happening score
H score 47
1 unique sources, 1 articles

Summary

Hide ▲

The ClickFix campaign has become a scalable social-engineering operation that uses compromised websites, phishing kits, and malvertising to push victims into running attacker commands. The lure set has broadened to include fake CAPTCHA, browser-update, and other troubleshooting prompts that make the command look routine. The expanding infrastructure and reusable lure kits increase the campaign’s reach and make it harder to block using old indicators.

Related Happenings

PylangGhost and GolangGhost ClickFix RAT delivery on Windows and macOS

Malware Activity
H score29 First: 21.07.2026 12:30 Last: 21.07.2026 12:30 Sources 1

About this happening: The PylangGhost and GolangGhost malware operation now uses ClickFix interview portals to install remote access trojans on Windows and macOS, putting Web3 a...

Open Happening

SeasonalInvite eCard phishing campaign targeting Windows and macOS users

Campaign
H score30 First: 15.07.2026 18:00 Last: 15.07.2026 18:00 Sources 1

About this happening: The SeasonalInvite phishing campaign has been active for six months, tricking Windows and macOS users into installing legitimate RMM software through fake eCards...

Open Happening

ClickFix mitigation guidance for Windows and macOS

Defensive Guidance
H score34 First: 30.06.2026 15:00 Last: 30.06.2026 15:00 Sources 1

About this happening: Organizations are being urged to harden defenses against ClickFix on Windows and macOS, reducing the chance that social-engineering lures can turn trusted dialogs into...

Open Happening

REF8372 malicious Google Ads CastleStealer delivery campaign

Campaign
H score27 First: 22.06.2026 16:20 Last: 22.06.2026 16:20 Sources 1

About this happening: The REF8372 campaign now uses malicious Google Ads and a fake Node.js download site to deliver OXLOADER and CastleStealer, putting search users at risk of malw...

Open Happening

TikTok and Instagram Reels Vidar social-engineering campaign

Campaign
H score37 First: 10.06.2026 19:00 Last: 10.06.2026 19:00 Sources 1

About this happening: A TikTok and Instagram Reels campaign is using fake free-software tutorials to push Vidar, turning social feeds into a high-reach malware delivery channel. The operati...

Open Happening

Timeline

  1. 06.10.2026 08:22 2 articles · 2h ago

    ClickFix fake CAPTCHA and browser-update campaign

    Initial Disclosure

    Early ClickFix activity used fake troubleshooting prompts on compromised sites and through malvertising to convince victims to paste attacker commands into trusted utilities. The initial lure pattern established a repeatable path from social engineering to payload retrieval and execution.

    Show sources
    Open in new tab