ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound

IPS-SWG

1 SID: 2057106

Stats

First seen: September 2026
Last seen: September 2026

Description

Detects malicious activity relevant to incident response workflows covering Observed ClickFix Powershell Delivery tooling or activity.

Related malware families

Related blogs

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

August 31, 20265 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

August 3, 20268 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

April 6, 20268 min read