# ClickFix Campaigns Evolve API-Driven Payload Delivery: Analysis of 3,000 Live Payloads Reveals New Evasion Techniques

> Researcher Bert-Jan Pals analyzed roughly 3,000 live ClickFix payloads and found backend servers dynamically generating freshly obfuscated PowerShell commands (Base64/AES/TripleDES/Rijndael/Deflate) across 25 languages, with delivery adapted per visitor OS, including a Downloads-folder redirect variant that evades clipboard monitoring. ClickFix (T1204.004) is used by state-backed actors (APT28, MuddyWater, Kimsuky/Lazarus) and North Korean fake-job campaigns (ClickFake Interview), alongside variants FileFix, DownloadFix, and ClearFake.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1027
- **ID:** TL-2026-1027
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** APT28 (Russia, Iran, North Korea)
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In findings presented at OrangeCon (early June 2026) and published June 30, 2026, independent researcher Bert-Jan Pals analyzed approximately 3,000 live ClickFix payloads retrieved directly from active backend delivery servers. Rather than static payloads, the analyzed infrastructure behaves as an on-demand obfuscation-as-a-service layer: requesting the same server for 100 payloads returned 100 distinct outputs, each wrapped in a rotating combination of Base64, AES, TripleDES, Rijndael, and Deflate encoding/encryption/compression. The delivery logic is API-driven and content-aware, serving 25 different languages and adapting the payload to the visitor's detected operating system (separate code paths for Windows and macOS). A newly documented Downloads-folder redirect variant sidesteps clipboard-content monitoring defenses: instead of placing a malicious command directly on the clipboard, the lure first silently drops a file (e.g., a ZIP archive) into the victim's Downloads folder, then places only a short 'orchestrator' command on the clipboard (observed example: `powershell -C "$t=$env:TMP;Move-Item \"$HOME\Downloads\tmp.zip\" \"$t\7947.zip\";tar -xf..."`) that moves and extracts the pre-staged file and continues execution — defeating tooling that only inspects clipboard payloads for suspicious strings. Across the analyzed sample, the most common launchers were PowerShell.exe (~39%), Cmd.exe (~39%), and Msiexec.exe (~34%), with core payload execution frequently occurring via in-memory PowerShell runspaces rather than on-disk script files, limiting artifacts available to EDR and antivirus. Three payload/staging servers were identified in the dataset: comicstar.lat, babybon.cfd, and merkantalolol.asia.

ClickFix (tracked by MITRE ATT&CK as sub-technique T1204.004, User Execution: Malicious Copy and Paste, added March 2025) is a fake-error/fake-CAPTCHA social engineering technique: a compromised or lookalike website displays a bogus 'verification failed' or CAPTCHA prompt instructing the visitor to press Win+R (or, in the FileFix variant, paste into File Explorer's address bar) and paste a clipboard payload, then press Enter. Because the victim manually executes the command rather than a file or macro doing so, ClickFix evades most execution-based and file-based endpoint controls. ESET recorded a 517% increase in ClickFix cases from late 2024 through H1 2025, and Microsoft's Digital Defense Report attributes ClickFix as the initial-access vector in 47% of intrusions its Defender Experts team observed in 2025 — the report source states ClickFix is now the second most common attack vector behind phishing.

Adoption has proliferated among nation-state and financially motivated operators. Russia-nexus APT28 (Fancy Bear/Sofacy) and Iran-nexus MuddyWater have both incorporated ClickFix lures into espionage operations. North Korea-aligned Lazarus Group runs 'ClickFake Interview' (a sub-cluster of the long-running Contagious Interview / Gwisin Gang operation, active since December 2022), in which fake recruiters on LinkedIn/X lure cryptocurrency and retail-sector professionals into fraudulent job interviews that deliver a ClickFix prompt; the resulting JavaScript-based BeaverTail infostealer/downloader then installs the Python-based InvisibleFerret backdoor (remote control, browser data theft, keylogging, exfiltration), with related payloads GolangGhost, PylangGhost, and FlexibleFerret also observed. North Korea-aligned Kimsuky (APT43) has separately abused GitHub repositories for stealer delivery and data exfiltration. Related variant FileFix (publicly disclosed by researcher mr.d0x in June 2025) replaces the Win+R Run dialog with Windows File Explorer's address bar as the paste target, exploiting user trust in Explorer and bypassing Mark-of-the-Web/SmartScreen checks since no internet-origin-tagged file is ever downloaded; ransomware group Interlock adopted FileFix within roughly two weeks of its disclosure, and a September 2025 multilingual FileFix wave delivered the StealC infostealer. DownloadFix is a further variant abusing trusted native tools as the execution vector. ClearFake, first documented July 2023, is a malicious in-browser JavaScript framework injected into compromised WordPress sites (via stolen admin credentials, not a WordPress vulnerability) that displays fake browser-update lures; it adopted the ClickFix PowerShell-paste technique in May 2024 and uses EtherHiding (staging next-stage payloads inside Binance Smart Chain contracts) for resilient payload hosting. As of February 2025, ClearFake had compromised at least 9,300 websites, and per Expel, one ClearFake wave likely infected approximately 147,521 systems since August 2025. No CVE applies — this is a technique-based, social-engineering delivery mechanism rather than a software vulnerability.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1204 User Execution
- T1204.004 Malicious Copy and Paste
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1218.007 Msiexec
- T1176 Software Extensions
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1218 System Binary Proxy Execution
- T1685 Disable or Modify Tools
- T1620 Reflective Code Loading
- T1036 Masquerading
- T1554 Compromise Host Software Binary
- T1539 Steal Web Session Cookie
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1056.001 Keylogging
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1102 Web Service
- T1008 Fallback Channels
- T1041 Exfiltration Over C2 Channel
- T1584.004 Server
- T1587.001 Malware
- T1585.001 Social Media Accounts
- T1589 Gather Victim Identity Information

## Sources

- [Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery](https://thehackernews.com/2026/07/researcher-analyzes-3000-live-clickfix.html)
- [ClickFix Attacks Expand Using Fake CAPTCHAs, Microsoft Scripts, and Trusted Web Services](https://thehackernews.com/2026/01/clickfix-attacks-expand-using-fake.html)
- [T1204.004 - User Execution: Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [ClickFix Attacks Sector Alert](https://www.hhs.gov/sites/default/files/clickfix-attacks-sector-alert-tlpclear.pdf)
- [Beyond The Click: Unveiling Fake CAPTCHA Campaigns](https://www.splunk.com/en_us/blog/security/unveiling-fake-captcha-clickfix-attacks.html)
- [FileFix: The New Social Engineering Attack Building on ClickFix Tested in the Wild](https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/)
- [New FileFix Variant Delivers StealC Malware Through Multilingual Phishing Site](https://thehackernews.com/2025/09/new-filefix-variant-delivers-stealc.html)
- [What is FileFix — a ClickFix variation?](https://www.kaspersky.com/blog/filefix-attack-windows-file-explorer/54752/)
- [New FileFix attack weaponizes Windows File Explorer for stealthy commands](https://www.bleepingcomputer.com/news/security/filefix-attack-weaponizes-windows-file-explorer-for-stealthy-powershell-commands/)
- [DPRK Hackers Use ClickFix to Deliver BeaverTail Malware in Crypto Job Scams](https://thehackernews.com/2025/09/dprk-hackers-use-clickfix-to-deliver.html)
- [ClickFake Interview Campaign by Lazarus Targets Crypto Job Seekers](https://www.infosecurity-magazine.com/news/clickfake-interview-campaign/)
- [Lazarus ClickFake Interview Campaign: From Contagious to ClickFix Malware Tactics](https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/)
- [ClearFake Infects 9,300 Sites, Uses Fake reCAPTCHA and Turnstile to Spread Info-Stealers](https://thehackernews.com/2025/03/clearfake-infects-9300-sites-uses-fake.html)
- [ClearFake: a newcomer to the fake updates threats landscape](https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/)
- [ClearFake's New Widespread Variant: Increased Web3 Exploitation for Malware Delivery](https://blog.sekoia.io/clearfakes-new-widespread-variant-increased-web3-exploitation-for-malware-delivery/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1027