ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques — Threadlinqs Intelligence
As of 2026-07-01, ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques is a high-severity malware threat attributed to Multiple (APT28 (Russia, Iran, North Korea), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1027 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Multiple (APT28 · Russia, Iran, North Korea · ESPIONAGE
Researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and found backend servers dynamically generating freshly obfuscated PowerShell commands (Base64/AES/TripleDES/Rijndael/Deflate)
In findings presented at OrangeCon (early June 2026) and published June 30, 2026, independent researcher Bert-Jan Pals analyzed approximately 3,000 live ClickFix payloads retrieved directly from active backend delivery servers. Rather than static payloads, the analyzed infrastructure behaves as an on-demand obfuscation-as-a-service layer: requesting the same server for 100 payloads returned 100 distinct outputs, each wrapped in a rotating combination of Base64, AES, TripleDES, Rijndael, and Deflate encoding/encryption/compression. The delivery logic is API-driven and content-aware, serving 25 different languages and adapting the payload to the visitor's detected operating system (separate code paths for Windows and macOS). A newly documented Downloads-folder redirect variant sidesteps clipboard-content monitoring defenses: instead of placing a malicious command directly on the clipboard, the lure first silently drops a file (e.g., a ZIP archive) into the victim's Downloads folder, then places only a short 'orchestrator' command on the clipboard (observed example: `powershell -C "$t=$env:TMP;Move-Item \"$HOME\Downloads mp.zip\" \"$t\7947.zip\";tar -xf..."`) that moves and extracts the pre-staged file and continues execution — defeating tooling that only inspects clipboard payloads for suspicious strings. Across the analyzed sample, the most common launchers were PowerShell.exe (~39%), Cmd.exe (~39%), and Msiexec.exe (~34%), with core payload execution frequently occurring via in-memory PowerShell runspaces rather than on-disk script files, limiting artifacts available to EDR and antivirus. Three payload/staging servers were identified in the dataset: comicstar.lat, babybon.cfd, and merkantalolol.asia.
ClickFix (tracked by MITRE ATT&CK as sub-technique T1204.004, User Execution: Malicious Copy and Paste, added March 2025) is a fake-error/fake-CAPTCHA social engineering technique: a compromised or lookalike website displays a bogus 'verification failed' or CAPTCHA prompt instructing the visitor to press Win+R (or, in the FileFix variant, paste into File Explorer's address bar) and paste a clipboard payload, then press Enter. Because the victim manually executes the command rather than a file or macro doing so, ClickFix evades most execution-based and file-based endpoint controls. ESET recorded a 517% increase in ClickFix cases from late 2024 through H1 2025, and Microsoft's Digital Defense Report attributes ClickFix as the initial-access vector in 47% of intrusions its Defender Experts team observed in 2025 — the report source states ClickFix is now the second most common attack vector behind phishing.
Adoption has proliferated among nation-state and financially motivated operators. Russia-nexus APT28 (Fancy Bear/Sofacy) and Iran-nexus MuddyWater have both incorporated ClickFix lures into espionage operations. North Korea-aligned Lazarus Group runs 'ClickFake Interview' (a sub-cluster of the long-running Contagious Interview / Gwisin Gang operation, active since December 2022), in which fake recruiters on LinkedIn/X lure cryptocurrency and retail-sector professionals into fraudulent job interviews that deliver a ClickFix prompt; the resulting JavaScript-based BeaverTail infostealer/downloader then installs the Python-based InvisibleFerret backdoor (remote control, browser data theft, keylogging, exfiltration), with related payloads GolangGhost, PylangGhost, and FlexibleFerret also observed. North Korea-aligned Kimsuky (APT43) has separately abused GitHub repositories for stealer delivery and data exfiltration. Related variant FileFix (publicly disclosed by researcher mr.d0x in June 2025) replaces the Win+R Run dialog with Windows File Explorer's address bar as the paste target, exploiting user trust in Explorer and bypassing Mark-of-the-Web/SmartScreen checks since no internet-origin-tagged file is ever downloaded; ransomware group Interlock adopted FileFix within roughly two weeks of its disclosure, and a September 2025 multil
Target sectors: cryptocurrency, finance, government administration, technology, retail, media marketing
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1204, T1204.004, T1059, T1059.001, T1059.003, T1218.007, T1176, T1140, T1027
