Cybercriminals have come up with a clever idea to trick users into running malware on their own systems—no exploits, just deception. The ClickFix technique disguises fake reCAPTCHA pages and "Fix It" pop-ups to auto-copy malicious PowerShell scripts straight to your clipboard. One wrong move, and infostealers like Lumma, Vidar, CStealer, AMOS, and DarkGate are on your system.

What’s happening?
🔹Fake bot verifications copy malicious commands without your knowledge
🔹Victims unknowingly paste and execute malware in their Run dialog
🔹Cybercriminals & APT groups are using ClickFix for large-scale hacking campaigns

Group-IB’s latest research uncovers real-world attack chains, technical breakdowns, and must-know defense strategies.

🔗Read the full blog here

#ClickFix #ThreatIntelligence #APT #InfoStealer