Threat actorRussiaTracked since 2026-04

ClickFix Operators

Also known as:ClickFixClearFake successorFakeCaptcha delivery

As of 2026-05-30, ClickFix Operators is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 1 threat spanning phishing. Also known as ClickFix, ClearFake successor, FakeCaptcha delivery.

Tracked threats: 11 high
First seen: 2026-042026-04-10
Last seen: 2026-042026-04-10
ATT&CK techniques: —No mapped techniques yet
Related CVEs: 0None referenced
Attribution: RussiaNation or origin

Nation: Russia · 1 tracked threat(s) · Categories: PHISHING

Activity timeline

ClickFix Operators appears in 1 tracked threat between 2026-04-10 and 2026-04-10.

Tracked threats

ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic StealerHIGH2026-04-10