Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
30 / 31 results
highbug_reportVulnerabilityClickFix attacks surge via fake AI installers and malicious search ads
Organizations using AI tools (Claude, ChatGPT, Codex, NotebookLM). All platforms (Windows, macOS). Users accessing AI tools via search engines or shared chatbot links. ClickFix now represents 52-67% of browser-based attacks detected in Q2-Q3 2026.
highbug_reportVulnerabilityFake Claude installers via Google Ads and Bing redirects deliver ClickFix
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
highbug_reportVulnerabilityClickFix attacks evolve with browser cache smuggling to bypass Run limits
Windows systems with Firefox and other browsers; users targeted via compromised websites and phishing lures. No specific product vulnerability—relies on social engineering to execute cached VBScript payloads that deploy credential-stealing .NET assem…
highperson_alertThreat ActorUnidentified Actors Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
The threat actors behind this campaign remain unidentified. Their motivation appears to be financially driven, leveraging trusted AI platforms (ChatGPT Custom GPTs) to conduct social engineering attacks that deliver remote access trojans.
highbug_reportVulnerabilityMalicious custom ChatGPTs in Google ads deliver RAT via ClickFix attacks
Users searching for ChatGPT via Google Search who click sponsored results. Campaign leverages OpenAI's custom GPT feature (retiring December 11, 2026) and Google Sites infrastructure.
![Placeholder domain third-party[.]com weaponized with ClickFix malware](/previews/2026-09-24-placeholder-domain-third-party-com-weaponized-clickfix-75c268ef.webp)
highbug_reportVulnerabilityPlaceholder domain third-party[.]com weaponized with ClickFix malware
Over 1,700 public GitHub repositories referencing third-party[.]com as a documentation placeholder. Additional 13 non-reserved placeholder domains identified (yoursite[.]com, your-domain[.]com, acme[.]com, etc.), with two serving scams/scareware.
highbug_reportVulnerabilityClickFix campaign targets Ukrainian sites with Psychedelic stealer
Legitimate Ukrainian business websites compromised to serve fake Cloudflare verification pages. Victims on Windows systems tricked into executing msiexec commands that install Psychedelic information stealer.
highbug_reportVulnerabilityClickFix social engineering now top enterprise attack vector via blockchain
All enterprise environments with Windows, macOS, and Linux endpoints. ClickFix is a social engineering technique that bypasses traditional security controls by tricking users into pasting malicious commands into trusted system interfaces (PowerShell,…
highbug_reportVulnerabilityPlaceholder domain third-party.com hijacked to serve ClickFix malware attacks
Windows users accessing third-party.com, a domain widely used as a placeholder in developer documentation (W3C, Chromium, GitHub examples). Over 1,500 files across 1,700+ repositories reference this domain.
highbug_reportVulnerabilityCisco ISE auth bypass zero-day exploited; AI agent RCE and browser malware
Cisco Identity Services Engine (ISE) - CVE-2026-76460 actively exploited. AI coding agents (Claude Code, OpenAI Codex, GitHub Copilot, Google Gemini CLI) vulnerable to Plugin4Shell RCE.
highperson_alertThreat ActorClickFix Lures Deploy ChainScript RAT via Polygon Blockchain C2
The Blackpoint Adversary Pursuit Group has identified threat actors leveraging ClickFix-style social engineering lures to distribute ChainScript, a previously undocumented remote access trojan.
criticalbug_reportVulnerabilityBrevo supply-chain attack: stolen Cloudflare API key injected malware
Brevo CRM/marketing platform and up to 100,000 customer websites embedding Brevo forms, Conversations widget, or SDK loader scripts. Affected domains: brevo.com, sendinblue.com, login/account/my/onboarding.brevo.com, sibforms.com.
highperson_alertThreat ActorThreat Actors Abuse Claude AI Platform to Distribute ClickFix Malware
Unattributed threat actors conducting opportunistic campaigns that exploit the trust and visibility of AI platforms for malware distribution. Motivation appears to be financially driven, leveraging the growing adoption of AI tools and the inherent tr…
highbug_reportVulnerability5,400+ compromised sites deliver ClickFix via BNB Smart Chain contracts
Over 5,400 compromised small-business websites used as distribution infrastructure. Targets are end users visiting these sites. ClickFix social engineering payloads hosted on BNB Smart Chain (BSC) smart contracts to evade takedown.
highperson_alertThreat ActorClickFix Operators Dominate Initial Access via Social Engineering
ClickFix operators are threat actors leveraging a social engineering technique that manipulates users into executing malicious commands through clipboard manipulation.
highbug_reportVulnerabilityTerminalFix campaign uses fake CAPTCHAs to deploy reverse tunnels
Windows systems with PowerShell and Windows Terminal enabled. Targets organizations with Active Directory environments. Attack vector: compromised websites displaying fake Cloudflare CAPTCHA prompts.
highbug_reportVulnerability19 malicious Chrome/Edge extensions steal crypto and credentials
Google Chrome and Microsoft Edge users who installed any of 19 malicious extensions, including "Enable Right Click & Copy" (70,000+ Chrome users, 10,000+ Edge users). Campaign active since early 2024.
highbug_reportVulnerabilityTerminalFix campaign uses fake CAPTCHAs to deploy reverse-tunnel backdoor
Organizations across multiple sectors using Windows environments with PowerShell and Windows Terminal. Attack leverages compromised websites serving fake Cloudflare CAPTCHA pages to social engineer users into executing malicious PowerShell commands.
highbug_reportVulnerability24 npm packages abuse unpkg mirrors as phishing infrastructure
24 malicious npm packages (e.g., bgzxcuite2, prezdentkxheiw, egair0810) hosted on npm registry and mirrored on unpkg.com and similar CDN services. Affects users who click links to these mirrored HTML pages, not developers installing packages directly…
highbug_reportVulnerabilityWordlistLoader and SynkLoader malware target Windows via ClickFix and Teams
Windows endpoints exposed to ClearFake/ClickFix campaigns (WordlistLoader delivering Amatera Stealer) and Microsoft Teams phishing (SynkLoader credential theft).
highbug_reportVulnerabilityClickFix attacks deliver macOS stealer targeting crypto wallets and Keychain
macOS systems (all CPU architectures). Users tricked into pasting malicious commands into Terminal. Targets cryptocurrency wallets (Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, XRP), browser passwords, Apple iCloud Keychain, and cached credentials.
highbug_reportVulnerabilityClickFix campaign delivers Go-based macOS stealer targeting crypto wallets
macOS users across all versions; targets cryptocurrency wallets (Bitcoin, Ethereum, Litecoin, Dogecoin, Monero, XRP), browser password databases, Apple Keychain, and cached browser credentials.
highperson_alertThreat ActorClickFix Campaign Uses Browser Fingerprinting to Target macOS Users
ClickFix is a macOS-focused social engineering campaign tracked by Microsoft Threat Intelligence. The operators remain unidentified, but the campaign demonstrates sophisticated evasion capabilities through server-side browser fingerprinting across mo…
highbug_reportVulnerabilitymacOS ClickFix campaign adds fingerprinting to evade detection
macOS users targeted via 250+ algorithmically generated domains (e.g., filecopperbasket, apricotfilepoint[.]com). Campaign delivers MacSync and Atomic Stealer (AMOS) infostealers. All macOS versions susceptible to social engineering technique.
highperson_alertThreat ActorDOUBLECUP LaaS Uses ClickFix and Steganography to Deploy CountLoader
DOUBLECUP is a Russian loader-as-a-service (LaaS) operation active since early June 2026. The service provides operators with licenses and a Go-based Windows GUI client to orchestrate campaigns that deliver malware via ClickFix social engineering lur…
highperson_alertThreat ActorDOUBLECUP loader-as-a-service delivers malware via ClickFix attacks
DOUBLECUP is a Russian loader-as-a-service platform that has operated since early June 2026. The service provides customers with licenses and a Go-based Windows tool for creating malicious ClickFix campaigns.
highperson_alertThreat ActorClickFix Abuses Steam Forums to Deliver XMRig Cryptominer
ClickFix is a threat actor conducting social engineering campaigns that leverage fake technical support content to distribute malware. The actor exploits user trust in community-driven platforms, specifically targeting gaming communities through Stea…
highperson_alertThreat ActorUAC-0145 (Sandworm sub-cluster) deploys ClickFix lures vs Ukraine
UAC-0145 is a sub-cluster of Sandworm, a Russian state-sponsored APT group attributed to the GRU (Main Intelligence Directorate of the General Staff of the Armed Forces of the Russian Federation).
highperson_alertThreat ActorClickFix Targets macOS with Terminal-Based Infostealer Campaign
ClickFix is a threat actor conducting social engineering campaigns that trick users into executing malicious commands. The actor leverages deceptive techniques to convince victims to manually run Terminal commands on macOS systems, facilitating the d…
highperson_alertThreat ActorDriveSurge Distributes Malware via ClickFix and FakeUpdate Campaigns
DriveSurge is a threat actor conducting large-scale malware distribution operations. The actor leverages compromised website infrastructure at scale, utilizing thousands of sites to host and deliver malicious payloads.