ClickFix
A macOS ClickFix kit we pulled apart skips all of its own bot and admin checks if you add ?force_fake_captcha=1 to the URL. I guess even malware authors need to test their code too! Debug Mode Every developer has written something like this at some point: if
ClickFix
On 7th October our Threat Intelligence pipeline flagged a script from ohhhhhmoney.com injected into compromised WordPress sites. It is a ClickFix kit, and at the end of the chain is a backdoored copy of a real desktop app. Its Command and Control (C2) server moves to a new domain
InfoStealer
Yesterday, we traced a single domain from an external threat feed through an extensive delivery chain: compromised WordPress sites, a fake reCAPTCHA challenge and a macOS cryptocurrency stealer delivered from infrastructure operated by a sanctioned Russian hosting provider. Here’s the walkthrough. The starting point At Report URI, we subscribe
Magecart
Most of the client-side attacks we track generally do one thing. A skimmer skims, or a ClickFix lure talks someone into pasting a command. They come from different operators, they use different infrastructure, and we list them separately in our Threat Intelligence feeds. This one does both, from the
ClickFix
A customer forwarded us something last week that has stuck with me. It was a live attack campaign — a good one, in the professional-admiration sense — along with a detailed public write-up dissecting exactly how it worked. The analysis was genuinely impressive. It traced the whole thing from the