Threat actors deploy Reaper, an updated SHub Stealer variant abusing macOS Script Editor to bypass protections and steal cryptocurrency assets.

A fake Amazon alert uses ClickFix malware to trick users into deploying the HarborWatch Agent RAT. See how the self-infection scam works.

SilabRAT malware, aka SnappyClient, is a $5K/month MaaS RAT flagged as HijackLoader. It uses HVNC and cracks crypto wallets, per Group-IB.

ErrTraffic malware powers ClickFix attacks on hacked WordPress sites, using EtherHiding on the blockchain to hide its C2 and spread infostealers.

A new macOS ClickFix AppleScript stealer named the Meow macOS stealer acts as a persistent RAT, hijacking wallets and evading detection. Protect your Macs.

Attackers injected malicious JavaScript into Okendo Reviews, a product review widget used by more than 18,000 brands. The compromised script loaded on store pages. After a few checks, it could sho…

An AI-generated SmartRAT ClickFix campaign targets banking users, mimicking the Banana RAT. This threat relates to flaws like CVE-2026-26980.

Trend Micro tracked a ClickFix malvertising campaign that abused claude.ai shared chat to deliver the MacSync infostealer to Mac developers.

Malwarebytes links fake Google and Cloudflare verification pages to shared ClickFix infrastructure delivering StealC, NetSupport and other malware.

uBlock Origin, the popular ad-blocking extension, has gained new capabilities to protect users. It now detects and blocks websites that display malicious ClickFix pop-ups. These sites try to trick…

On June 18, 2026, security analysts detected a host downloading suspicious PowerShell scripts from an open directory. At a glance Actor or Group: REF6045 (suspected) Activity Type: Phishing, vishi…

Since late April 2026, compromised websites have been distributing a new modular malware with the curious name “TELEPUZ” through the ClickFix scheme. According to Elastic, the attacker…

At a glance Malware family ClickLock Stealer (new, named by Group-IB) Threat actor Unattributed. No actor or group named. Target / victims macOS users, especially crypto holders. At least 100 vict…

At a glance Malware family TELEPUZ Threat actor Unnamed; suspected solo developer or small team running a MaaS Target / victims Windows users reached through compromised web pages Delivery vector …

At a glance Actor / group UAT-11795 (suspected Russian-speaking, financially motivated) Activity type Credential and cryptocurrency theft via trojanized software installers Targets / victims Windo…

At a glance Malware family ACR Stealer (infostealer; linked to a rebrand of Amatera Stealer) Threat actor No named actor; sold via malware-as-a-service (MaaS) Target / victims Enterprise Windows e…

A recent cyberattack targeted a financial institution using a ClickFix social engineering lure. This incident revealed an evolving TAG-150 attack chain. Security researchers from eSentire Threat R…

Evolution of the Golden Chickens Ecosystem Cybercriminals operating within the TAG-195 ecosystem have fundamentally restructured their malware architecture, adopting a highly modular approach. Con…

At a glance Threat actor Famous Chollima, also called Wagemole; North Korea-aligned Activity type Social engineering via fake job interviews; ClickFix lures delivering RATs Targets Crypto and Web3…

At a glance Actor or group TAG-195, also tracked as Golden Chickens and Venom Spider; deployment observed by an operator tracked as TAG-127 Activity type Malware-as-a-service development; credenti…