Researchers say a large ClickFix campaign turned trusted websites into malware traps by showing fake verification or troubleshooting prompts that trick visitors into infecting their own devices. CTM360 reports more than 17,000 malicious URLs tied to the activity. ClickFix is a social-engineering technique that tells users to copy, paste, or run commands locally, often leading to malware installation or credential theft.
Why it matters: This affects ordinary web users as well as organizations whose sites may be abused as infection points. Defenders should hunt for ClickFix-style prompts on web properties and warn users never to run commands from pop-ups or fake verification pages.
info@thehackernews.com (The Hacker News)
2026.09.24
100% relevant
This article establishes a distinct large-scale ClickFix campaign centered on 17,000 URLs and broad abuse of trusted websites, rather than a single vendor compromise or one previously tracked malware cluster.
← Back to all stories