ET EXPLOIT_KIT ClickFix Payload Delivery Page Observed

IPS-SWG

2 SIDs: 2066515, 2066516

Stats

First seen: January 2026
Last seen: October 2026

Description

Detects malicious activity associated with the ClickFix Payload Delivery malware family.

Related malware families

Related blogs

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

August 31, 20265 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

August 3, 20268 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

April 6, 20268 min read