ET ATTACK_RESPONSE ClickFix Related Payload Inbound

IPS-SWG

1 SID: 2061865

Stats

First seen: May 2025
Last seen: October 2026

Description

Detects malicious activity relevant to incident response workflows covering ClickFix tooling or activity.

Related malware families

Related blogs

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

August 31, 20265 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

August 3, 20268 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

April 6, 20268 min read