# ClickFix Social-Engineering Technique Becomes Dominant Malware Delivery and Defense-Evasion Vector (CrashFix, FileFix, ConsentFix Variants)

> ClickFix — a social-engineering technique that tricks users into pasting attacker-supplied commands into trusted system dialogs (fake CAPTCHA, browser-crash, or update prompts) — has become the dominant malware delivery and defense-evasion vector industry-wide, per ReliaQuest's March-May 2026 Threat Spotlight (~28% of defense-evasion activity). It is now used by initial-access brokers (KongTuke), ransomware operators (LeakNet, Storm-0249, and downstream Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta), and nation-state actors (North Korea's Sapphire Sleet) to deliver RATs, infostealers, backdoors, and ransomware across Windows and macOS.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1127
- **ID:** TL-2026-1127
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** KongTuke (North Korea)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ClickFix is a social-engineering technique, first observed by Microsoft Threat Intelligence between March and June 2024 in Storm-1607 email campaigns delivering DarkGate malware, that manipulates victims into executing attacker-supplied commands themselves. Rather than exploiting a software vulnerability, ClickFix presents a fake problem — a CAPTCHA/human-verification check, a bogus browser or driver 'update', or (in its 'CrashFix' variant) a deliberately triggered browser crash — and then instructs the victim to 'fix' it by pasting a clipboard-hijacked command into the Windows Run dialog, PowerShell, Windows Terminal, or (on macOS) the Terminal/System Settings authentication prompt. Because the payload is manually typed/pasted and executed by the user via trusted OS dialogs, ClickFix bypasses email attachment scanning, file-based AV signatures, and browser download protections entirely.

By Q2 2026, ReliaQuest's March-May Threat Spotlight found that ClickFix-driven command and file obfuscation accounted for nearly 28% of all observed defense-evasion activity industry-wide, and that ClickFix led initial-access activity via Spearphishing Link (14.9%), making it the single most prevalent initial-access/defense-evasion technique tracked in the quarter. ClickFix's on-host fingerprint (heavy use of mshta.exe, PowerShell, and native LOLBins such as finger.exe) pushed MSHTA-based defense evasion from 16th to 2nd place among tracked defense-evasion techniques, now accounting for roughly a third of that activity.

The technique has evolved well past a one-shot delivery mechanism. Financially motivated initial-access broker KongTuke (aka 404 TDS, Chaya_002, LandUpdate808, TAG-124, Woodgnat) operates the 'CrashFix' sub-variant — a malicious Chrome extension (NexShield, typosquatting uBlock Origin Lite) that deliberately crashes the victim's browser and then serves a fake fix prompt — to deploy the Python-based ModeloRAT RAT and the .NET GateKeeper reconnaissance tool, differentiating payloads for domain-joined corporate targets versus standalone consumer machines. In June 2026, Symantec/Carbon Black linked KongTuke to a new fileless, self-deleting backdoor named Mistic (aka MLTBackdoor), which uses DLL side-loading against a legitimate Microsoft security binary (MpExtMs.exe) to execute entirely in memory. KongTuke has been confirmed as an access broker supplying corporate footholds to six of the most active ransomware operations — Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta.

Other threat actors and campaigns observed abusing ClickFix in the same window include: DeepLoad, an AI-obfuscated PowerShell loader that injects into the Windows lock-screen process (LockAppHost.exe) to steal credentials; LeakNet, a ransomware operator that pivoted from IAB-purchased access to running its own ClickFix campaigns via compromised legitimate websites, paired with a Deno-runtime in-memory loader, jli.dll side-loading into Java, PsExec lateral movement, and S3-bucket payload staging; Storm-0249, an IAB that combined ClickFix with DLL side-loading of a trojanized component alongside a legitimate SentinelOne EDR binary to conceal post-exploitation activity; DriveSurge, a new threat actor operating a traffic-distribution system (zTDS) across thousands of compromised legitimate websites to dynamically serve either ClickFix or FakeUpdates lures, including a macOS-specific clipboard-hijacking payload; the Lorem Ipsum loader operators, who pivoted to ClickFix-based delivery via compromised WordPress sites after Microsoft's May 2026 takedown of the Fox Tempest infrastructure and revocation of 1,000+ fraudulent Microsoft Trusted Signing certificates; and North Korea's Sapphire Sleet/UNC1069 (overlapping with APT38/Stardust Chollima/Lazarus Group), which uses ClickFix-style fake technical-interview and video-call lures to deploy a multi-stage macOS malware stack (WAVESHAPER, HYPERCALL, HIDDENCALL, DEEPBREATH, CHROMEPUSH) against cryptocurrency-sector targets. A parallel macOS-focused ClickFix wave delivers the MacSync infostealer, harvesting credentials, files, Keychain data, and cryptocurrency wallet contents via fake macOS-utility lures.

Payloads delivered via ClickFix now span the full spectrum of the criminal ecosystem: infostealers (Lumma Stealer, Danabot, StealC, MacSync), RATs (ModeloRAT, Quasar RAT, NetSupport RAT, SectopRAT), loaders (DeepLoad, Lorem Ipsum Loader, GateKeeper), backdoors (Mistic/MLTBackdoor), proxy tools (PySoxy, used for durable encrypted C2 that survives outbound blocking via scheduled-task re-execution), keyloggers, cryptominers, and ransomware precursors. ReliaQuest anticipates roughly 30% of Ransomware-as-a-Service affiliates will integrate ClickFix in the near term, and a July 2026 independent analysis of over 3,000 live ClickFix payloads found attackers increasingly rely on API-driven backend infrastructure to dynamically generate and rotate lures, payloads, and C2 endpoints at scale.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1583.001 Domains
- T1608.001 Upload Malware
- T1585.003 Cloud Accounts
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1548.002 Bypass User Account Control
- T1553.002 Code Signing
- T1574.001 DLL
- T1036.003 Rename Legitimate Utilities
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1202 Indirect Command Execution
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1070.004 File Deletion
- T1620 Reflective Code Loading
- T1552.001 Credentials In Files
- T1555.001 Keychain
- T1518.001 Security Software Discovery
- T1057 Process Discovery
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1016 System Network Configuration Discovery
- T1087.001 Local Account
- T1482 Domain Trust Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1115 Clipboard Data
- T1071.001 Web Protocols
- T1090.002 External Proxy
- T1568.002 Domain Generation Algorithms
- T1567.002 Exfiltration to Cloud Storage
- T1486 Data Encrypted for Impact

## Sources

- [And the Winner in Dominant Malware Delivery? ClickFix](https://www.darkreading.com/vulnerabilities-threats/winner-dominant-malware-delivery-clickfix)
- [What's Trending: Top Cyber Attacker Techniques, March - May 2026 | Threat Spotlight](https://reliaquest.com/blog/threat-spotlight-whats-trending-top-cyber-attacker-techniques-march-may-2026)
- [Dissecting CrashFix: KongTuke's New Toy](https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke)
- [New Clickfix variant 'CrashFix' deploying Python RAT Trojan](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/)
- [Think before you Click(Fix): Analyzing the ClickFix social engineering technique](https://www.microsoft.com/en-us/security/blog/2025/08/21/think-before-you-clickfix-analyzing-the-clickfix-social-engineering-technique/)
- [DeepLoad Malware Pairs ClickFix Delivery with AI-Generated Evasion](https://reliaquest.com/blog/threat-spotlight-deepload-malware-pairs-clickfix-delivery-with-ai-generated-evasion/)
- [ClickFix Evolves with PySoxy Proxying](https://reliaquest.com/blog/threat-spotlight-clickfix-evolves-with-pysoxy-proxying/)
- [700+ education and tech websites hijacked in huge ClickFix malware campaign](https://www.malwarebytes.com/blog/bugs/2026/05/700-education-and-tech-websites-hijacked-in-huge-clickfix-malware-campaign)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- ['Lorem Ipsum' Malware Pivots to ClickFix Delivery](https://www.darkreading.com/cyberattacks-data-breaches/lorem-ipsum-malware-clickfix-delivery)
- [Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine](https://www.bluevoyant.com/blog/orem-ipsum-clickfix-rapid-brigantine)
- [Casting a Wider Net: ClickFix, Deno, and LeakNet's Scaling Threat](https://reliaquest.com/blog/threat-spotlight-casting-a-wider-net-clickfix-deno-and-leaknets-scaling-threat/)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Stealthy Mistic backdoor linked to ransomware access broker KongTuke](https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/)
- [DriveSurge Hijacks Thousands of Sites for ClickFix, FakeUpdate Attacks](https://www.darkreading.com/cyberattacks-data-breaches/drivesurge-hijacks-thousands-sites-clickfix-fakeupdate-attacks)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1127