ET MALWARE Observed ClickFix Landing Page

IPS-SWG

3 SIDs: 2067291, 2067945, 2067947

Stats

First seen: February 2026
Last seen: July 2026

Description

Detects malicious activity associated with the Observed ClickFix malware family.

Related malware families

Related blogs

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

Malware on the Blockchain: An Ongoing Campaign's New WebRTC Twist

August 31, 20265 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

Developers in the Crosshairs: Fake AI Tools Deliver Infostealer

August 3, 20268 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

From ClickFix to MaaS: Exposing a Modular Windows RAT and Its Admin Panel

April 6, 20268 min read