ClickFix Archives

Winsage

January 7, 2026

Hackers Use Fake Windows BSOD To Spread Malware

Security researchers have identified a social engineering campaign that mimics the Windows Blue Screen of Death (BSOD) to deceive users into installing a remote access Trojan (RAT). The campaign, named PHALT#BLYX, begins with phishing emails that appear to be legitimate cancellation notices from travel websites, leading victims to a fake login page and an interactive CAPTCHA. This culminates in a full-screen imitation of the BSOD, prompting users to follow instructions that ultimately allow attackers to gain control of their computers. The attackers use a “ClickFix” process that involves executing commands through native Windows tools like PowerShell and MSBuild, making detection more challenging. The malware delivered is an obfuscated version of DCRat, which provides attackers with remote control capabilities, keylogging, and the ability to download additional malware. The campaign primarily targets hotels and hospitality businesses in Europe, exploiting the urgency of front-desk staff to respond to apparent technical issues. Indicators of a fake BSOD include the ability to interact with the screen, requests to execute commands via Windows tools, and the presence of CAPTCHA prompts. Organizations are advised to train employees, implement application control, enhance email and web defenses, and prepare for incident response to mitigate risks associated with such attacks.

Winsage

January 6, 2026

ClickFix attack uses fake Windows BSOD screens to push malware

A new social engineering attack campaign called ClickFix is targeting the hospitality sector in Europe, using fake Windows Blue Screen of Death (BSOD) screens to trick users into executing malware. Initially identified in December by Securonix as "PHALT#BLYX," the campaign involves phishing emails that appear to be notifications from Booking.com, often mentioning significant refunds to create urgency. Victims are directed to a counterfeit Booking.com site that mimics the legitimate one and displays a fake error message prompting them to execute a malicious command. This command launches a PowerShell script that downloads and compiles malware known as DCRAT, a remote access Trojan that allows attackers to control infected devices, exfiltrate data, and spread within networks.

Winsage

December 11, 2025

December Patch Tuesday fixes three zero-days, including one that hijacks Windows devices

Microsoft has released a security update addressing 57 vulnerabilities, including three critical zero-day exploits. The update targets vulnerabilities in Windows 10, Windows 11, Windows Server, Office, and related services. Specific vulnerabilities fixed include: - CVE-2025-62221: A privilege escalation vulnerability in the Windows Cloud Files Mini Filter Driver. - CVE-2025-64671: A remote code execution vulnerability affecting GitHub Copilot for JetBrains. - CVE-2025-54100: A remote code execution issue within Windows PowerShell. PowerShell now provides warnings when the Invoke-WebRequest command fetches web pages without safe parameters to prevent unintended script execution. Users can apply the latest updates by checking Windows Update in Settings, downloading, and installing the updates, and ensuring their system is up to date.

Winsage

December 4, 2025

This Windows Update Pop-Up Is a Scam

Hackers have exploited Windows update screens to deliver malware disguised as a "critical security update," a tactic known as the ClickFix attack. This attack uses social engineering techniques, including fake error messages and CAPTCHA forms, to trick users into executing harmful commands. The scam appears as a pop-up mimicking the standard Windows blue screen but originates from a malicious domain. Users are prompted to paste and execute harmful commands, leading to malware installation. Researchers from Huntress have detailed this attack, noting that malicious code can be embedded within PNG images. Although recent law enforcement actions have reduced the presence of malware payloads on these domains, the threat remains. Users should be cautious of any update screens that do not show a progress indicator or require manual command input, as these are signs of a ClickFix attack. Microsoft releases security updates on the second Tuesday of each month, and users are advised to enable automatic updates and consider disabling the Windows Run box for added security.

Winsage

November 30, 2025

Week in review: Fake “Windows Update” fuels malware, Salesforce details Gainsight breach

Colonel Ludovic Monnerat emphasized the need for satellite systems to adopt quantum-safe methods due to looming quantum threats. Graham McMillan noted that past AI failures have not led to industry maturity, predicting significant structural shifts from AI meltdowns. Marina Marceta highlighted the importance of a risk-aware culture in cybersecurity to align security with business objectives. A new wave of ClickFix attacks uses deceptive “Windows Update” screens to distribute malware. Researchers from watchTowr found that code formatting sites are exposing sensitive information like API keys. cnspec is an open-source tool for maintaining security and compliance across cloud environments. The Tor Project plans to implement Counter Galois Onion encryption to enhance user anonymity. An ISC2 survey revealed that supply chain risks are a top concern for cybersecurity professionals. There are various job openings in the cybersecurity field for different skill levels.

Winsage

November 29, 2025

Maybe don’t trust every Windows Update without checking – hackers hijack images to spread dangerous malware

Cybercriminals are using fake Windows Update screens to spread sophisticated malware, employing social engineering techniques to deceive users. These ClickFix attacks create convincing illusions of legitimate update prompts in full-screen web browser pages, prompting users to execute malicious commands. The malware, known as Stego Loader, reconstructs its payload in memory using C# routines, making it difficult for standard antivirus solutions to detect and remove. Recommended precautions include regular antivirus scanning, robust firewall protection, disabling the Windows Run Box, and careful examination of image-based files, as they can be weaponized to deliver malware. Organizations must be vigilant about the manipulation of seemingly legitimate assets, which complicates logging, monitoring, and forensic analysis, and poses significant risks to supply chain security.

Winsage

November 26, 2025

Do Not Click—This Porn Site Installs Malware On Your Device

Attackers are using malicious emails with links to adult websites to exploit human curiosity and urgency, leading to the installation of harmful malware through deceptive update processes. Acronis has identified these "JackFix" attacks, which use screen hijacking techniques combined with ClickFix methods, presenting victims with fake Windows Update screens that claim to deliver critical security updates. This campaign leverages counterfeit adult websites as phishing mechanisms, increasing psychological pressure on victims to comply with prompts to install updates. The attack takes over the victim's screen and displays a convincing update interface, occurring entirely within the browser. Acronis advises users to avoid accessing adult sites through links in emails or messages and to navigate directly to these sites for safer browsing.

Winsage

November 25, 2025

JackFix Uses Fake Windows Update Pop-Ups on Adult Sites to Deliver Multiple Stealers

Cybersecurity experts have identified a new campaign that combines ClickFix tactics with counterfeit adult websites to trick users into executing harmful commands under the guise of a "critical" Windows security update. This campaign uses fake adult sites, including clones of popular platforms, as phishing mechanisms, increasing psychological pressure on victims. ClickFix-style attacks have risen significantly, accounting for 47% of all attacks, according to Microsoft data. The campaign features convincing fake Windows update screens that take over the user's screen and instruct them to execute commands that initiate malware infections. The attack begins when users are redirected to a fake adult site, where they encounter an "urgent security update." The counterfeit Windows Update screen is created using HTML and JavaScript, and it attempts to prevent users from escaping the alert. The initial command executed is an MSHTA payload that retrieves a PowerShell script from a remote server, which is designed to deliver multiple payloads, including various types of malware. The downloaded PowerShell script employs obfuscation techniques and seeks to elevate privileges, potentially allowing attackers to deploy remote access trojans (RATs) that connect to command-and-control servers. The campaign has been linked to other malware execution chains that also utilize ClickFix lures. Security researchers recommend enhancing defenses through employee training and disabling the Windows Run box to mitigate risks associated with these attacks.

Winsage

November 25, 2025

Do Not Download These Windows Security Updates, Experts Warn

Security experts at Huntress have confirmed that hackers are using ClickFix malware to distribute fake Windows security updates, deceiving users into executing harmful commands. Over the past year, these attacks have increased, with both state-sponsored actors and cybercriminal organizations employing this tactic. Microsoft has indicated that ClickFix is the most frequently used method for gaining initial access, representing 47 percent of attacks noted in Microsoft Defender notifications. A report released on November 24 revealed a new wave of ClickFix attacks utilizing realistic Windows Security Update screens to deploy credential-stealing malware. The campaign employs steganography to conceal malware within PNG images, embedding harmful code directly within the pixel data. Windows users are advised to remain vigilant and recognize that legitimate updates will never request users to cut and paste commands into the Windows run prompt from a web page.

Winsage

November 25, 2025

ClickFix attack uses fake Windows Update screen to push malware

Recent observations have identified ClickFix attack variants where cybercriminals use deceptive Windows Update animations on full-screen browser pages to hide malicious code within images. Victims are misled into executing harmful commands through specific key sequences that copy and execute commands via JavaScript. Security researchers have documented these attacks since October, noting the use of LummaC2 and Rhadamanthys information stealers. Attackers utilize steganography to embed malware payloads within PNG images, reconstructing and decrypting them in memory using PowerShell and a .NET assembly called the Stego Loader. A dynamic evasion tactic known as ctrampoline complicates detection by initiating calls to numerous empty functions. The shellcode extracted from the encrypted image can execute various file types directly in memory. Following a law enforcement operation on November 13, the Rhadamanthys variant's payload delivery through fake Windows Update domains ceased, although the domains remain active. Researchers recommend disabling the Windows Run box and monitoring suspicious process chains to mitigate risks.