Cybersecurity News
Filters
Filtered by tag: clickfix × Clear
ClickFix Campaigns Deploy PavinLoader With Blockchain-Based C2 and Amatera Stealer
Matched: cryptocurrency
ClickFix campaigns are delivering PavinLoader malware through fake CAPTCHA pages, software downloads, and malicious game installers that trick users into running malicious commands. The loader uses legitimate Windows tools like MSBuild to hide its activity, employs blockchain-based command-and-control via EtherHiding to obscure infrastructure, and deploys payloads including Amatera Stealer and HijackLoader to steal passwords, browser data, and cryptocurrency wallet information.
Fake Codex Download Uses Google Sites to Deliver macOS Malware
Attackers created fake codec download pages hosted on Google Sites to distribute macOS malware. The campaign used sponsored search results to drive traffic and employed a ClickFix-style social engineering technique, tricking users into manually running malicious commands. The use of Google's infrastructure helped bypass security warnings and lend the pages false legitimacy.
AmnesiaStealer Gives Hackers Hidden Control of Logged-In Browsers on Macs
Matched: cryptocurrency
AmnesiaStealer is a new macOS malware spread via fake GitHub pages that trick users into running a Terminal command. Beyond stealing passwords, cookies, and keychain data, it can silently mirror an active browser session in a hidden Chromium instance, giving attackers real-time control of already-authenticated accounts. This makes MFA protections ineffective. A LaunchDaemon ensures persistence after the initial infection.
Fake CAPTCHA Tricks Mac Users Into Installing a Backdoor That Steals Passwords and Mines Crypto
Matched: cryptocurrency
A ClickFix campaign is targeting Mac users with a fake CAPTCHA page styled as "TrustKey" that tricks victims into running a malicious Terminal command. The command fetches an AppleScript payload via Cloudflare Workers, installs a persistent LaunchAgent, and uses blockchain-based EtherHiding to locate its command server. The backdoor steals browser credentials, keychain data, and crypto wallet information, while also deploying XMRig to mine Monero. Any CAPTCHA requesting Terminal access should be treated as malicious.
Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect
Researchers at Check Point identified a ransomware operation called StopAndProtect in May 2026. The campaign uses the ClickFix social-engineering technique to trick victims into running a PowerShell command, triggering a multi-stage downloader chain. Thousands of hacked WordPress sites serve as infrastructure for the operation, which researchers have now partially unmasked through analysis of its infection chain and supporting infrastructure.
ClickFix Attacks Deliver macOS Stealer That Can Drain Crypto Wallets
Matched: cryptocurrency
A ClickFix-style attack campaign is targeting macOS users with Go-based malware that steals cryptocurrency, browser passwords, Apple iCloud Keychain data, and cached credentials. The infection chain uses a shell script to profile the host before delivering a CPU-compatible payload, allowing attackers to drain crypto wallets and harvest sensitive data from compromised machines.
Mac Malware Drains Crypto Wallets Via Fake CAPTCHA Scam
A Mac user was tricked by a fake CAPTCHA prompt into running a Terminal command that installed Go-based malware. The attack, a variant of the ClickFix scam, gave attackers access to macOS Keychain passwords and cryptocurrency wallets. Security researchers warn the technique is growing more common and targets users across platforms.
North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials
Matched: cryptocurrency
North Korean hackers are using fake macOS update screens to deploy malware targeting cryptocurrency wallets, browser data, and developer credentials. The campaign uses a ClickFix-style lure that makes browser pages appear broken, prompting users to run malicious commands. Entry points include routine web searches, making the attack difficult to detect.