Threat reportMalwareTL-2026-1027
ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques
ClickFix Campaigns Evolve API-Driven Payload Delivery (TL-2026-1027), also tracked as ClickFix, is a high-severity malware campaign, first published 2026-07-01. It is attributed to APT28 (Russia, Iran, North Korea) with medium confidence, affects Microsoft Windows (Run dialog / File Explorer / PowerShell), maps to 29 MITRE ATT&CK techniques (T1005, T1008, T1027), and is covered by 9 detection rules and 18 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 29MITRE ATT&CK
- Actors
- 4APT28
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-1027
- Threat ID
- TL-2026-1027
- Also known as
- ClickFix, FileFix, DownloadFix, ClearFake, ClickFake Interview
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- APT28, MuddyWater, Kimsuky, APT43
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia, Iran, North Korea
- Motivation
- ESPIONAGE
- Target sectors
- cryptocurrency, finance, government administration, technology, retail, media marketing
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in ClickFix Campaigns Evolve API-Driven Payload Delivery
Malware and tooling: BeaverTail - S1246, FlexibleFerret, GolangGhost (OS X), InvisibleFerret - S1245, PylangGhost, Stealc, EtherHiding
How ClickFix Campaigns Evolve API-Driven Payload Delivery works
Researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and found backend servers dynamically generating freshly obfuscated PowerShell commands (Base64/AES/TripleDES/Rijndael/Deflate) across 25 languages, with delivery adapted per visitor OS, including a Downloads-folder redirect variant that evades clipboard monitoring. ClickFix (T1204.004) is used by state-backed actors (APT28, MuddyWater, Kimsuky/Lazarus) and North Korean fake-job campaigns (ClickFake Interview), alongside variants FileFix, DownloadFix, and ClearFake.
In findings presented at OrangeCon (early June 2026) and published June 30, 2026, independent researcher Bert-Jan Pals analyzed approximately 3,000 live ClickFix payloads retrieved directly from active backend delivery servers. Rather than static payloads, the analyzed infrastructure behaves as an on-demand obfuscation-as-a-service layer: requesting the same server for 100 payloads returned 100 distinct outputs, each wrapped in a rotating combination of Base64, AES, TripleDES, Rijndael, and Deflate encoding/encryption/compression. The delivery logic is API-driven and content-aware, serving 25 different languages and adapting the payload to the visitor's detected operating system (separate code paths for Windows and macOS). A newly documented Downloads-folder redirect variant sidesteps clipboard-content monitoring defenses: instead of placing a malicious command directly on the clipboard, the lure first silently drops a file (e.g., a ZIP archive) into the victim's Downloads folder, then places only a short 'orchestrator' command on the clipboard (observed example: `powershell -C "$t=$env:TMP;Move-Item \"$HOME\Downloads\tmp.zip\" \"$t\7947.zip\";tar -xf..."`) that moves and extracts the pre-staged file and continues execution — defeating tooling that only inspects clipboard payloads for suspicious strings. Across the analyzed sample, the most common launchers were PowerShell.exe (~39%), Cmd.exe (~39%), and Msiexec.exe (~34%), with core payload execution frequently occurring via in-memory PowerShell runspaces rather than on-disk script files, limiting artifacts available to EDR and antivirus. Three payload/staging servers were identified in the dataset: comicstar.lat, babybon.cfd, and merkantalolol.asia.
ClickFix (tracked by MITRE ATT&CK as sub-technique T1204.004, User Execution: Malicious Copy and Paste, added March 2025) is a fake-error/fake-CAPTCHA social engineering technique: a compromised or lookalike website displays a bogus 'verification failed' or CAPTCHA prompt instructing the visitor to press Win+R (or, in the FileFix variant, paste into File Explorer's address bar) and paste a clipboard payload, then press Enter. Because the victim manually executes the command rather than a file or macro doing so, ClickFix evades most execution-based and file-based endpoint controls. ESET recorded a 517% increase in ClickFix cases from late 2024 through H1 2025, and Microsoft's Digital Defense Report attributes ClickFix as the initial-access vector in 47% of intrusions its Defender Experts team observed in 2025 — the report source states ClickFix is now the second most common attack vector behind phishing.
Adoption has proliferated among nation-state and financially motivated operators. Russia-nexus APT28 (Fancy Bear/Sofacy) and Iran-nexus MuddyWater have both incorporated ClickFix lures into espionage operations. North Korea-aligned Lazarus Group runs 'ClickFake Interview' (a sub-cluster of the long-running Contagious Interview / Gwisin Gang operation, active since December 2022), in which fake recruiters on LinkedIn/X lure cryptocurrency and retail-sector professionals into fraudulent job interviews that deliver a ClickFix prompt; the resulting JavaScript-based BeaverTail infostealer/downloader then installs the Python-based InvisibleFerret backdoor (remote control, browser data theft, keylogging, exfiltration), with related payloads GolangGhost, PylangGhost, and FlexibleFerret also observed. North Korea-aligned Kimsuky (APT43) has separately abused GitHub repositories for stealer delivery and data exfiltration. Related variant FileFix (publicly disclosed by researcher mr.d0x in June 2025) replaces the Win+R Run dialog with Windows File Explorer's address bar as the paste target, exploiting user trust in Explorer and bypassing Mark-of-the-Web/SmartScreen checks since no internet-origin-tagged file is ever downloaded; ransomware group Interlock adopted FileFix within roughly two weeks of its disclosure, and a September 2025 multilingual FileFix wave delivered the StealC infostealer. DownloadFix is a further variant abusing trusted native tools as the execution vector. ClearFake, first documented July 2023, is a malicious in-browser JavaScript framework injected into compromised WordPress sites (via stolen admin credentials, not a WordPress vulnerability) that displays fake browser-update lures; it adopted the ClickFix PowerShell-paste technique in May 2024 and uses EtherHiding (staging next-stage payloads inside Binance Smart Chain contracts) for resilient payload hosting. As of February 2025, ClearFake had compromised at least 9,300 websites, and per Expel, one ClearFake wave likely infected approximately 147,521 systems since August 2025. No CVE applies — this is a technique-based, social-engineering delivery mechanism rather than a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1027
Collection
T1005 Data from Local System; T1056.001 Keylogging
Command and Control
T1008 Fallback Channels; T1071.001 Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1218 System Binary Proxy Execution; T1620 Reflective Code Loading
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204 User Execution; T1204.004 Malicious Copy and Paste
Discovery
T1082 System Information Discovery
Persistence
Initial Access
stealth
Credential Access
T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores
persistence
T1554 Compromise Host Software Binary
Resource Development
T1584.004 Server; T1585.001 Social Media Accounts; T1587.001 Malware
Reconnaissance
T1589 Gather Victim Identity Information
defense-impairment
Affected products and versions in ClickFix Campaigns Evolve API-Driven Payload Delivery
- Microsoft — Windows (Run dialog / File Explorer / PowerShell)
Vulnerable versions: All supported Windows versions - Apple — macOS
Vulnerable versions: All supported macOS versions (OS-adapted payload variant observed) - WordPress — WordPress (compromised sites used as ClearFake watering holes)
Vulnerable versions: N/A - credential compromise, not a CVE
Remediation for ClickFix Campaigns Evolve API-Driven Payload Delivery
Immediate actions
- Block outbound access to identified payload servers: comicstar.lat, babybon.cfd, merkantalolol.asia
- Disable or restrict Win+R Run dialog execution and File Explorer address-bar command execution via GPO/AppLocker/WDAC for standard users
- Deploy clipboard-content monitoring alongside Downloads-folder and TEMP-directory move/extract behavioral detections to close the clipboard-monitoring bypass gap
- Block or alert on PowerShell, Cmd, and Msiexec launched directly from Explorer.exe or browser processes
- Enable PowerShell Script Block Logging and Constrained Language Mode enterprise-wide
Workarounds
- Restrict clipboard paste-and-execute pathways by disabling the Run dialog for non-administrative users where feasible
- Use browser extensions/policies that block auto-copy-to-clipboard JavaScript on untrusted sites
Longer-term hardening
- User awareness training specifically covering ClickFix/FileFix fake-CAPTCHA and fake-error lures
- Deploy EDR behavioral rules for in-memory PowerShell runspace execution absent a corresponding on-disk script
- Harden WordPress admin credentials (MFA, credential rotation) to reduce ClearFake watering-hole compromise surface
- Monitor for EtherHiding-style payload staging via blockchain smart-contract read calls from endpoint processes
- Extend recruiter/job-interview social engineering awareness training to crypto and trading roles, not just developers
Weaknesses (CWE) in ClickFix Campaigns Evolve API-Driven Payload Delivery
Timeline of ClickFix Campaigns Evolve API-Driven Payload Delivery
- ClearFake first documented as a fake browser-update JavaScript injection framework on compromised WordPress sites
- ClearFake operators adopt the ClickFix PowerShell-paste social engineering technique
- ClearFake reported to have compromised at least 9,300 websites using fake reCAPTCHA/Turnstile lures
- MITRE ATT&CK formally adds ClickFix behavior as sub-technique T1204.004 (User Execution: Malicious Copy and Paste)
- Researcher mr.d0x publicly discloses the FileFix variant, using File Explorer's address bar instead of the Run dialog
- Check Point Research observes cybercriminals actively testing FileFix in real-world campaigns roughly two weeks after disclosure; Interlock ransomware group adopts the technique
- Start of the ClearFake wave later estimated by Expel to have infected approximately 147,521 systems
- New multilingual FileFix variant observed delivering the StealC infostealer
- DPRK-aligned actors reported using ClickFix within the ClickFake Interview campaign to deliver BeaverTail malware in fake crypto job interviews
- ESET's H1 2025 telemetry period closes, later cited as showing a 517% increase in ClickFix cases from late 2024 into H1 2025
- Researcher Bert-Jan Pals presents ClickFix payload-server analysis findings at OrangeCon
- Bert-Jan Pals publishes detailed analysis of ~3,000 live ClickFix payloads, documenting API-driven polymorphic obfuscation and the Downloads-folder redirect variant
- The Hacker News publishes coverage of the research, surfacing payload servers comicstar.lat, babybon.cfd, and merkantalolol.asia
Sources cited for ClickFix Campaigns Evolve API-Driven Payload Delivery
- Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery
- ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services
- T1204.004 - User Execution: Malicious Copy and Paste
- ClickFix Attacks Sector Alert
- Beyond The Click: Unveiling Fake CAPTCHA Campaigns
- FileFix: The New Social Engineering Attack Building on ClickFix Tested in the Wild
- New FileFix Variant Delivers StealC Malware Through Multilingual Phishing Site
- What is FileFix — a ClickFix variation?
- New FileFix attack weaponizes Windows File Explorer for stealthy commands
- DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams
- ClickFake Interview Campaign by Lazarus Targets Crypto Job Seekers
- Lazarus ClickFake Interview Campaign: From Contagious to ClickFix Malware Tactics
- ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers
- ClearFake: a newcomer to the fake updates threats landscape
- ClearFake's New Widespread Variant: Increased Web3 Exploitation for Malware Delivery
Detection coverage for TL-2026-1027
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1027 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.