ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector (CrashFix, FileFix, ConsentFix Variants)
ClickFix Social-Engineering Technique Becomes Dominant (TL-2026-1127), also tracked as CrashFix, is a high-severity phishing campaign, first published 2026-07-05. It is attributed to Storm-0249 (North Korea) with medium confidence, affects Microsoft Windows (all supported versions), maps to 40 MITRE ATT&CK techniques (T1016, T1021.001, T1021.002), and is covered by 9 detection rules and 33 indicators of compromise.
Key facts for TL-2026-1127
- Threat ID
- TL-2026-1127
- Also known as
- CrashFix, FileFix, ConsentFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-07-05
- Last reviewed
- 2026-07-05
- Attribution
- Storm-0249
- Attribution confidence
- MEDIUM
- Nation-state nexus
- North Korea
- Motivation
- FINANCIAL
- Target sectors
- technology, education, government administration, finance, insurance, professional-services, corporate-enterprise, cryptocurrency
- Target regions
- Global, North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 33
Malware and tooling in ClickFix Social-Engineering Technique Becomes Dominant
Malware and tooling: DeepLoad, GateKeeper, Lorem Ipsum Loader, MacSync, Mistic (MLTBackdoor), ModeloRAT, Deno runtime, PySoxy, finger.exe
ClickFix — a social-engineering technique that tricks users into pasting attacker-supplied commands into trusted system dialogs (fake CAPTCHA, browser-crash, or update prompts) — has become the dominant malware delivery and defense-evasion vector industry-wide, per ReliaQuest's March-May 2026 Threat Spotlight (~28% of defense-evasion activity). It is now used by initial-access brokers (KongTuke), ransomware operators (LeakNet, Storm-0249, and downstream Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta), and nation-state actors (North Korea's Sapphire Sleet) to deliver RATs, infostealers, backdoors, and ransomware across Windows and macOS.
How ClickFix Social-Engineering Technique Becomes Dominant works
ClickFix is a social-engineering technique, first observed by Microsoft Threat Intelligence between March and June 2024 in Storm-1607 email campaigns delivering DarkGate malware, that manipulates victims into executing attacker-supplied commands themselves. Rather than exploiting a software vulnerability, ClickFix presents a fake problem — a CAPTCHA/human-verification check, a bogus browser or driver 'update', or (in its 'CrashFix' variant) a deliberately triggered browser crash — and then instructs the victim to 'fix' it by pasting a clipboard-hijacked command into the Windows Run dialog, PowerShell, Windows Terminal, or (on macOS) the Terminal/System Settings authentication prompt. Because the payload is manually typed/pasted and executed by the user via trusted OS dialogs, ClickFix bypasses email attachment scanning, file-based AV signatures, and browser download protections entirely.
By Q2 2026, ReliaQuest's March-May Threat Spotlight found that ClickFix-driven command and file obfuscation accounted for nearly 28% of all observed defense-evasion activity industry-wide, and that ClickFix led initial-access activity via Spearphishing Link (14.9%), making it the single most prevalent initial-access/defense-evasion technique tracked in the quarter. ClickFix's on-host fingerprint (heavy use of mshta.exe, PowerShell, and native LOLBins such as finger.exe) pushed MSHTA-based defense evasion from 16th to 2nd place among tracked defense-evasion techniques, now accounting for roughly a third of that activity.
The technique has evolved well past a one-shot delivery mechanism. Financially motivated initial-access broker KongTuke (aka 404 TDS, Chaya_002, LandUpdate808, TAG-124, Woodgnat) operates the 'CrashFix' sub-variant — a malicious Chrome extension (NexShield, typosquatting uBlock Origin Lite) that deliberately crashes the victim's browser and then serves a fake fix prompt — to deploy the Python-based ModeloRAT RAT and the .NET GateKeeper reconnaissance tool, differentiating payloads for domain-joined corporate targets versus standalone consumer machines. In June 2026, Symantec/Carbon Black linked KongTuke to a new fileless, self-deleting backdoor named Mistic (aka MLTBackdoor), which uses DLL side-loading against a legitimate Microsoft security binary (MpExtMs.exe) to execute entirely in memory. KongTuke has been confirmed as an access broker supplying corporate footholds to six of the most active ransomware operations — Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.
Other threat actors and campaigns observed abusing ClickFix in the same window include: DeepLoad, an AI-obfuscated PowerShell loader that injects into the Windows lock-screen process (LockAppHost.exe) to steal credentials; LeakNet, a ransomware operator that pivoted from IAB-purchased access to running its own ClickFix campaigns via compromised legitimate websites, paired with a Deno-runtime in-memory loader, jli.dll side-loading into Java, PsExec lateral movement, and S3-bucket payload staging; Storm-0249, an IAB that combined ClickFix with DLL side-loading of a trojanized component alongside a legitimate SentinelOne EDR binary to conceal post-exploitation activity; DriveSurge, a new threat actor operating a traffic-distribution system (zTDS) across thousands of compromised legitimate websites to dynamically serve either ClickFix or FakeUpdates lures, including a macOS-specific clipboard-hijacking payload; the Lorem Ipsum loader operators, who pivoted to ClickFix-based delivery via compromised WordPress sites after Microsoft's May 2026 takedown of the Fox Tempest infrastructure and revocation of 1,000+ fraudulent Microsoft Trusted Signing certificates; and North Korea's Sapphire Sleet/UNC1069 (overlapping with APT38/Stardust Chollima/Lazarus Group), which uses ClickFix-style fake technical-interview and video-call lures to deploy a multi-stage macOS malware stack (WAVESHAPER, HYPERCALL, HIDDENCALL, DEEPBREATH, CHROMEPUSH) against cryptocurrency-sector targets. A parallel macOS-focused ClickFix wave delivers the MacSync infostealer, harvesting credentials, files, Keychain data, and cryptocurrency wallet contents via fake macOS-utility lures.
Payloads delivered via ClickFix now span the full spectrum of the criminal ecosystem: infostealers (Lumma Stealer, Danabot, StealC, MacSync), RATs (ModeloRAT, Quasar RAT, NetSupport RAT, SectopRAT), loaders (DeepLoad, Lorem Ipsum Loader, GateKeeper), backdoors (Mistic/MLTBackdoor), proxy tools (PySoxy, used for durable encrypted C2 that survives outbound blocking via scheduled-task re-execution), keyloggers, cryptominers, and ransomware precursors. ReliaQuest anticipates roughly 30% of Ransomware-as-a-Service affiliates will integrate ClickFix in the near term, and a July 2026 independent analysis of over 3,000 live ClickFix payloads found attackers increasingly rely on API-driven backend infrastructure to dynamically generate and rotate lures, payloads, and C2 endpoints at scale.
MITRE ATT&CK techniques used in TL-2026-1127
Discovery
T1016 System Network Configuration Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087.001 Local Account; T1482 Domain Trust Discovery; T1518.001 Security Software Discovery
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares
Defense Evasion
T1027 Obfuscated Files or Information; T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1202 Indirect Command Execution; T1497.001 System Checks; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1204 User Execution
Command and Control
T1071.001 Web Protocols; T1090.002 External Proxy; T1568.002 Domain Generation Algorithms
Collection
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Impact
T1486 Data Encrypted for Impact
Privilege Escalation
T1548.002 Bypass User Account Control
Credential Access
T1552.001 Credentials In Files; T1555.001 Keychain
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
Exfiltration
T1567.002 Exfiltration to Cloud Storage
stealth
Resource Development
T1583.001 Domains; T1583.008 Malvertising; T1585.003 Cloud Accounts; T1608.001 Upload Malware
Affected products and versions in ClickFix Social-Engineering Technique Becomes Dominant
- Microsoft — Windows (all supported versions)
Vulnerable versions: Windows 10; Windows 11; Windows Server 2019; Windows Server 2022 - Apple — macOS
Vulnerable versions: macOS Sonoma; macOS Sequoia - Google — Google Chrome / Chrome Web Store
Vulnerable versions: all versions supporting third-party extensions - WordPress — WordPress CMS (compromised sites abused as delivery infrastructure)
Vulnerable versions: N/A — abused as hosting, not a WordPress core vulnerability
Remediation for ClickFix Social-Engineering Technique Becomes Dominant
Patches
- No vendor patch applicable — ClickFix is a social-engineering/LOLBin-abuse technique, not a software vulnerability
- Apply Microsoft Defender behavioral signature updates (Behavior:Win32/ClickFix.ZAB, Behavior:Win32/SuspClickFix, Trojan:HTML/FakeCaptcha)
Immediate actions
- Disable or restrict the Windows Run dialog (Win+R) via Group Policy for users who don't need it
- Block execution of mshta.exe, finger.exe, and other abused LOLBins via Attack Surface Reduction (ASR) rules where not required for business use
- Deploy browser policies blocking installation of unverified/unlisted Chrome extensions
- Block known ClickFix/CrashFix/DriveSurge/KongTuke IOCs (domains, IPs) at DNS resolvers and perimeter firewalls
Workarounds
- Configure Windows Terminal/PowerShell to warn or block on multi-line paste operations
- Restrict clipboard access for browser-rendered content via enterprise browser policy
- Enforce application allow-listing to prevent LOLBin execution invoked from the Run dialog
Longer-term hardening
- Deploy EDR/behavioral detection tuned to flag clipboard-to-Run-dialog and clipboard-to-Terminal execution chains
- Enable PowerShell Script Block Logging and ship logs to a SIEM for ClickFix pattern hunting
- Conduct user-awareness training specifically covering fake CAPTCHA/verification and browser-crash social-engineering lures
- Implement DLL side-loading detection for trusted EDR/security-vendor binaries (e.g., SentinelOne, MpExtMs.exe)
Timeline of ClickFix Social-Engineering Technique Becomes Dominant
- Microsoft Threat Intelligence first observes the ClickFix technique in email campaigns attributed to Storm-1607, delivering DarkGate malware to targets in the US and Canada.
- Interlock ransomware affiliates add ClickFix (and later FileFix) social-engineering lures to their initial-access arsenal, including drive-by downloads from compromised legitimate websites.
- Microsoft publishes an in-depth technical analysis of ClickFix, cataloging fake CAPTCHA lures, LOLBin abuse (mshta.exe, msbuild.exe), macOS AMOS delivery, and commercial ClickFix builder kits sold for $200-$1,500/month.
- ReliaQuest publishes Threat Spotlight on Storm-0249, documenting its pivot from mass phishing to ClickFix-driven, precision post-exploitation activity abusing legitimate EDR processes via DLL side-loading.
- The NexShield malicious Chrome extension (typosquatting uBlock Origin Lite) goes live on the Chrome Web Store, launching KongTuke's browser-crash 'CrashFix' campaign.
- Huntress publishes technical analysis of the CrashFix campaign, attributing it to KongTuke and detailing the ModeloRAT and GateKeeper payloads plus full IOC set.
- Microsoft Defender Experts publish analysis of the CrashFix ClickFix variant deploying the Python-based ModeloRAT trojan via the finger.exe LOLBin renamed to ct.exe.
- ReliaQuest reports LeakNet ransomware adopting ClickFix lures on compromised legitimate websites paired with a Deno in-memory loader, jli.dll side-loading, and PsExec lateral movement.
- ReliaQuest discloses the DeepLoad malware campaign, pairing ClickFix delivery with AI-generated PowerShell obfuscation and LockAppHost.exe process injection for credential theft.
- ReliaQuest observes ClickFix combined with the open-source PySoxy SOCKS5 proxy tool for redundant, scheduled-task-persisted encrypted C2 access that survives outbound connection blocking.
- Malwarebytes reports over 700 compromised education and technology websites redirecting visitors into a large-scale ClickFix malware campaign.
- Microsoft documents a ClickFix campaign using fake macOS utility lures to deliver the MacSync infostealer, harvesting credentials, files, Keychain data, and crypto-wallet contents.
- Microsoft dismantles the Fox Tempest (Forging Marauder) infrastructure and revokes over 1,000 fraudulently obtained Microsoft Trusted Signing certificates, prompting Lorem Ipsum loader operators to pivot to ClickFix delivery via compromised WordPress sites.
- DriveSurge threat actor is identified operating a zTDS traffic-distribution system across thousands of compromised websites to dynamically route visitors into ClickFix or FakeUpdates lures, including a macOS clipboard-hijacking payload.
- Broadcom Symantec and Carbon Black disclose the fileless, self-deleting Mistic (MLTBackdoor) backdoor, linking it to KongTuke and confirming the IAB supplies access to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta ransomware operations.
- ReliaQuest's March-May 2026 Threat Spotlight (covered by Dark Reading) finds ClickFix-driven obfuscation responsible for ~28% of observed defense-evasion activity, cementing it as the dominant malware delivery vector; a separate researcher analysis of 3,000+ live ClickFix payloads reveals growing API-driven delivery infrastructure.
Sources cited for ClickFix Social-Engineering Technique Becomes Dominant
- And the Winner in Dominant Malware Delivery? ClickFix
- What's Trending: Top Cyber Attacker Techniques, March - May 2026 | Threat Spotlight
- Dissecting CrashFix: KongTuke's New Toy
- New Clickfix variant 'CrashFix' deploying Python RAT Trojan
- Think before you Click(Fix): Analyzing the ClickFix social engineering technique
- DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion
- ClickFix Evolves with PySoxy Proxying
- 700+ education and tech websites hijacked in huge ClickFix malware campaign
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- 'Lorem Ipsum' Malware Pivots to ClickFix Delivery
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine
- Casting a Wider Net: ClickFix, Deno, and LeakNet's Scaling Threat
- New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
- Stealthy Mistic backdoor linked to ransomware access broker KongTuke
- DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks
Threats related to ClickFix Social-Engineering Technique Becomes Dominant
- ClickFix, CrashFix, InstallFix, FileFix & GhostClaw: Growing Family of Copy-and-Paste Social Engineering Attacks
- KongTuke ClickFix Campaign — ModeloRAT Deployment via Compromised WordPress Sites and CrashFix Browser Extension
- ClickFix Evolution — nslookup DNS Smuggling + CrashFix Browser DoS + ModeloRAT Python RAT, KongTuke Actor, Enterprise Domain-Joined Targeting
- Mistic Self-Destructing In-Memory Backdoor (MLTBackdoor) Deployed by KongTuke Access Broker Enabling Multi-Group Ransomware Intrusions
- BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency Credentials via ClickFix and AI Deepfake Social Engineering
- DriveSurge: Initial Access Broker Hijacks Thousands of Trusted Websites for ClickFix and FakeUpdate Malware Delivery via zTDS
Detection coverage for TL-2026-1127
As of 2026-07-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1127 across Splunk SPL, Microsoft KQL and Sigma, covering 33 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.