{"id":284352,"date":"2026-07-01T01:32:00","date_gmt":"2026-07-01T05:32:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/07\/01\/researcher-analyzes-3000-live-clickfix-payloads-exposing-api-driven-malware-delivery\/"},"modified":"2026-07-01T05:05:07","modified_gmt":"2026-07-01T09:05:07","slug":"researcher-analyzes-3000-live-clickfix-payloads-exposing-api-driven-malware-delivery","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/07\/01\/researcher-analyzes-3000-live-clickfix-payloads-exposing-api-driven-malware-delivery\/","title":{"rendered":"Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery"},"content":{"rendered":"

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery<\/a><\/p>\n

https:\/\/thehackernews.com\/2026\/07\/researcher-analyzes-3000-live-clickfix.html<\/a><\/p>\n

Publish Date: 2026-07-01 01:32:00<\/a><\/p>\n

Source Domain: thehackernews.com<\/a><\/p>\n

ClickFix, the trick that fools people into running malware by hand, has quietly grown a back office.<\/p>\n

New research shows the malicious commands behind its fake “prove you’re human” pages are now handed out by API-driven servers that give each visitor the same malware in a different disguise. The same research also turned up a new delivery method built to slip past Windows’ script scanning.<\/p>\n

Security researcher Bert-Jan Pals took apart several ClickFix platforms and analyzed roughly 3,000 payloads from live campaigns. He presented the findings at\u00a0OrangeCon\u00a0in early June and\u00a0published the details\u00a0on June 30.<\/p>\n

ClickFix is simple by design. A booby-trapped page shows a fake CAPTCHA or error, hidden JavaScript drops a command into your clipboard, and the page tells you to press a key combo, paste, and hit Enter. You run the malware yourself.<\/p>\n

There’s usually no exploit at the first step and often no file for traditional antivirus to flag, so conventional email and endpoint controls have less to catch.<\/p>\n

It works well enough that ESET measured a\u00a0517% jump\u00a0from late 2024 into the first half of 2025, and Microsoft’s\u00a02025 Digital Defense Report\u00a0put it at 47% of the initial-access cases seen by its Defender Experts team.<\/p>\n

The technique now has its own entry in MITRE ATT&CK,\u00a0T1204.004.<\/p>\n

Payloads made to order<\/h2>\n

The new part is how the payloads are produced. Pals found the pages pulling their commands from backend servers that work like an on-demand service: they take requests, check an access token, log the caller, and return a freshly scrambled command each time.<\/p>\n

He asked one server for 100 payloads and got 100 different ones, wrapped in a rotating mix of Base64, AES, TripleDES, Rijndael, and Deflate. Strip the wrapping and, at least for now, they all unpack to the same script, which runs in memory through a PowerShell runspace.<\/p>\n

The disguise is disposable; the malware under it is not, though Pals warns the core payload will likely start changing per victim before…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Researcher Analyzes 3,000 Live ClickFix Payloads, Exposing API-Driven Malware Delivery https:\/\/thehackernews.com\/2026\/07\/researcher-analyzes-3000-live-clickfix.html Publish Date: 2026-07-01 01:32:00…<\/p>\n","protected":false},"author":1,"featured_media":284353,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjXEaR4unJmt3rBY1LzI0Gq_veoF7Qzi-yPQNUcoR2oNV802lQ4MZAviyeq7bBh73PLAyp1quTozDq0ki_zm_9qsJIIfAUTaG8jFTv5dpxvuDUPJZA2BU4Zo11wIVyysWeMROXv8z2XOZoPOoJPVqMEJEhCI_OE1mM5wnSCFHJ1sgjl5411fZ4srklq5Fbs\/s1600\/clickfix-payloads.jpg","fifu_image_alt":"","footnotes":""},"categories":[15],"tags":[31,32],"class_list":["post-284352","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-exploit","tag-malware"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/284352"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=284352"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/284352\/revisions"}],"predecessor-version":[{"id":284354,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/284352\/revisions\/284354"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/284353"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=284352"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=284352"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=284352"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}