ClickFix attackers hide malware payloads in browser caches

Compromised websites use fake verification prompts to trick visitors into executing malicious commands. Cyber Security News says victims are instructed to paste text into the Windows Run dialog and press Enter. The Hacker News reports that Microsoft identified scripts disguised as PNG files and loaded into browser caches before execution.

• The Record reports over 100 websites compromised in Ukraine to spread Lunex malware.
• Dark Reading also reports payload concealment using DNS TXT records.

Covered by 4 publishers within 32 hours of the first report.

• The Record: ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware

Reporting4

CSN Cyber Security News ClickFix Fake CAPTCHA Attack Executes Malware Hidden Inside Browser Cache · Tushar Subhra Dutta 9:02 AM

THN The Hacker News ClickFix Smuggles Payloads Through Browser Cache to Bypass Windows Run Limits · info@thehackernews.com (The Hacker News) 1:22 AM

REC The Record ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware 9:17 AM

DR Dark Reading ClickFix Attacks Evolve to Better Hide Malicious Payloads · Alexander Culafi 4:32 PM

Related

BC Nikkei says attackers breached employee email accounts October 5

THN Microsoft issues emergency Exchange Server fixes for privilege escalation flaw October 5

WCN Microsoft announces Surface Laptop Ultra for local AI workloads October 5

BL OpenAI's Jason Kwon apologizes over AI breach of Australian government site October 5

Topics Microsoft